kbsonlong
约 400 字 预计阅读 1 分钟
安装ocserv
1
| apt-get install ocserv -y
|
申请免费证书
修改dns指向服务器
生成证书
1
2
3
4
| certbot certonly --standalone --preferred-challenges http --agree-tos --email [email protected] -d myvpn.alongparty.cn
# 续签证书
certbot renew --quiet --no-self-upgrade
|
修改配置
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
| auth = "plain[/etc/ocserv/ocpasswd]"
tcp-port = 443
udp-port = 443
run-as-user = nobody
run-as-group = daemon
socket-file = /var/run/ocserv-socket
server-cert = /etc/letsencrypt/live/myvpn.alongparty.cn/fullchain.pem
server-key = /etc/letsencrypt/live/myvpn.alongparty.cn/privkey.pem
isolate-workers = false
max-clients = 16
max-same-clients = 2
rate-limit-ms = 100
server-stats-reset-time = 604800
keepalive = 32400
dpd = 90
mobile-dpd = 1800
switch-to-tcp-timeout = 25
try-mtu-discovery = true
cert-user-oid = 0.9.2342.19200300.100.1.1
tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1"
auth-timeout = 240
min-reauth-time = 300
max-ban-score = 80
ban-reset-time = 1200
cookie-timeout = 300
deny-roaming = false
rekey-time = 172800
rekey-method = ssl
use-occtl = true
pid-file = /var/run/ocserv.pid
device = vpns
predictable-ips = true
default-domain = example.com
ipv4-network = 10.255.255.0
ipv4-netmask = 255.255.255.0
tunnel-all-dns = true
dns = 8.8.8.8
dns = 4.2.2.4
dns = 2001:4860:4860::8888
dns = 2001:4860:4860::8844
ping-leases = false
cisco-client-compat = true
dtls-legacy = true
|
开启 IP Forwarding
1
2
3
4
5
6
7
| cat << EOF > /etc/sysctl.d/60-custom.conf
net.ipv4.ip_forward = 1
net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr
EOF
sysctl -p /etc/sysctl.d/60-custom.conf
|
设置防火墙规则
1
2
3
| iptables -A FORWARD -s 10.255.253.0/24 -j ACCEPT
iptables -t nat -I POSTROUTING -s 10.255.253.0/24 -o ens5 -j MASQUERADE
iptables-save > /etc/iptables
|
检查 ufw 是否开启
如果开启ufw,可以参考[1]设置,或者直接关闭
1
2
3
| systemctl stop ufw
systemctl disable ufw
ufw disable
|
1
