Fedora-Fr

Ce site est optimisé pour être consulté depuis un navigateur moderne dans lequel JavaScript est activé.

Comment installer openvpn serveur sur fédora 17

andykimpe

Bonjour a tous j'essaye de crée un script d'installation automatique pour les serveur openvpn

j'essaye de faire en sorte que ce script soit compatible sur tous les système ont a déjà debian 6, ubuntu 12.04 , centos 5.9 et centos 6.2 qui fonctionne parfaitement

seulement mon problème et qu'il n'y a aucune documentation pour l'installation d'un serveur openvpn sur fédora (la doc s’arrête a fédora 9)

donc après avoir installer openvpn depuis les dépot yum, j'ai télécharger easy-rsa depuis github que j'ai placer dans /etc/openvpn/easy-rsa les clés ce génère bien mais impossible de lancer openvpn et ce même en lançant manuellement

openvpn --config /etc/openvpn/server.conf

j'ai essayer plusieurs configuration celle de centos celle de debian rien a faire il ne ce lance pas et n'affiche aucune erreur (même dans le fichier de log)

quelle qu'un a t'il déjà installer openvpn serveur sur fédora 17 ?

si oui quelle configuration avez vous utilisez.

merci à tous ceux qui prendront le temps de répondre a ce message.

andykimpe

je croit que le problème vient de iptables je vais essayer de le recompiller

je vous tient au courrant

madko

Bonjour,

recompiler iptables? C'est pas iptables qui empêchera un service de démarrer, ça c'est sûr.

sinon pour info easy-rsa est fournit dans le paquet openvpn.

Sinon tu as regardé dans /var/log/audit/audit.log si c'est pas selinux qui bloque? tu utilises le port par defaut d'openvpn? Peux tu nous donner ton fichier de conf?

andykimpe

merci de prendre le temps de résoudre notre problème j'ai modifier la config maintenant le serveur fonctionne mais quand ont ce connecte au vpn ont a pas d'internet

pour la config tout et ici https://github.com/andykimpe/openvpnscripts/ j'ai mis le port 443 en tcp

voici la partie du script pour fédora

if [ "$VERSION" = "17" -o "$VERSION" = "18" ]
then
rpm -Uvh lzo-*.rpm
rm lzo-*.rpm
yum install openvpn -y
cp -R /usr/share/doc/openvpn-2.2.2/easy-rsa/ /etc/openvpn/
cd /etc/openvpn
git clone git://github.com/OpenVPN/easy-rsa.git /etc/openvpn/test
mkdir /etc/openvpn/easy-rsa
cp -R /etc/openvpn/test/easy-rsa/2.0/* /etc/openvpn/easy-rsa
rm -rf /etc/openvpn/test
cd /etc/openvpn/easy-rsa/
chmod 755 *
rm -f /etc/openvpn/easy-rsa/vars
touch /etc/openvpn/easy-rsa/vars
cat > /etc/openvpn/easy-rsa/vars <<EOF
# easy-rsa parameter settings

# NOTE: If you installed from an RPM,
# don't edit this file in place in
# /usr/share/openvpn/easy-rsa --
# instead, you should copy the whole
# easy-rsa directory to another location
# (such as /etc/openvpn) so that your
# edits will not be wiped out by a future
# OpenVPN package upgrade.

# This variable should point to
# the top level of the easy-rsa
# tree.
export EASY_RSA="/etc/openvpn/easy-rsa/"

#
# This variable should point to
# the requested executables
#
export OPENSSL="openssl"
export PKCS11TOOL="pkcs11-tool"
export GREP="grep"


# This variable should point to
# the openssl.cnf file included
# with easy-rsa.
export KEY_CONFIG=/etc/openvpn/easy-rsa/openssl-1.0.0.cnf

# Edit this variable to point to
# your soon-to-be-created key
# directory.
#
# WARNING: clean-all will do
# a rm -rf on this directory
# so make sure you define
# it correctly!
export KEY_DIR="/etc/openvpn/easy-rsa/keys"

# Issue rm -rf warning
echo NOTE: If you run ./clean-all, I will be doing a rm -rf on $KEY_DIR

# PKCS11 fixes
export PKCS11_MODULE_PATH="dummy"
export PKCS11_PIN="dummy"

# Increase this to 2048 if you
# are paranoid.  This will slow
# down TLS negotiation performance
# as well as the one-time DH parms
# generation process.
export KEY_SIZE=1024

# In how many days should the root CA key expire?
export CA_EXPIRE=3650

# In how many days should certificates expire?
export KEY_EXPIRE=3650

# These are the default values for fields
# which will be placed in the certificate.
# Don't leave any of these fields blank.
export KEY_COUNTRY="$country"
export KEY_PROVINCE="$dep"
export KEY_CITY="$ville"
export KEY_ORG="$org"
export KEY_EMAIL="$email"
export KEY_EMAIL=$email
export KEY_CN=changeme
export KEY_NAME=changeme
export KEY_OU=changeme
export PKCS11_MODULE_PATH=changeme
export PKCS11_PIN=1234
EOF

mkdir keys
chmod 755 *
source ./vars
./vars
./clean-all
./build-ca
./build-key-server server
./build-dh
cp keys/ca.crt keys/server.crt keys/server.key keys/dh1024.pem /etc/openvpn/
cat > /etc/openvpn/server.conf <<EOF
mode server
proto tcp
port 443
dev tun
# Cles et certificats
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
# Reseau
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status 443.log
verb 3
status 443.log
EOF
echo 0 > /selinux/enforce
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
ln -s /lib/systemd/system/openvpn\@.service /etc/systemd/system/multi-user.target.wants/openvpn\@server.service
systemctl enable openvpn@server.service
systemctl start openvpn@server.service
echo net.ipv4.ip_forward = 1 >> /etc/sysctl.conf
echo 1 > /proc/sys/net/ipv4/ip_forward
cat > /etc/sysconfig/iptables<<EOF
# Generated by iptables-save v1.4.14 on Wed Feb 27 18:59:14 2013
*raw
:PREROUTING ACCEPT [253:20060]
:OUTPUT ACCEPT [197:23072]
COMMIT
# Completed on Wed Feb 27 18:59:14 2013
# Generated by iptables-save v1.4.14 on Wed Feb 27 18:59:14 2013
*nat
:PREROUTING ACCEPT [4:240]
:INPUT ACCEPT [4:240]
:OUTPUT ACCEPT [4:836]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Wed Feb 27 18:59:14 2013
# Generated by iptables-save v1.4.14 on Wed Feb 27 18:59:14 2013
*mangle
:PREROUTING ACCEPT [253:20060]
:INPUT ACCEPT [253:20060]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [197:23072]
:POSTROUTING ACCEPT [197:23072]
COMMIT
# Completed on Wed Feb 27 18:59:14 2013
# Generated by iptables-save v1.4.14 on Wed Feb 27 18:59:14 2013
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [550:64375]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Wed Feb 27 18:59:14 2013
EOF
service iptables restart
iptables-restore </etc/sysconfig/iptables
systemctl restart openvpn@server.service

madko

Question bête, le service httpd tourne?

Si tu utilises le port 443, en dehors d'être en conflit avec un serveur web, tu sors du contexte habituel d'openvpn, qui n'utilise normalement pas ce port. Donc blocage SELinux. Que donne le audit.log lors du démarrage d'openvpn? Si tu désactive temporairement SeLinux (setenforce 0) est-ce que le service openvpn démarre?

andykimpe

j'ai déjà désactiver selinux

comment tu peut le voir dans le script il y a les commande suivante

echo 0 > /selinux/enforce
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config

cependant même en utilisant setenforce 0 toujours le même problème

httpd n'est pas installer

le port 443 n'est peut être pas le port par défaut pour openvpn mes c'est le plus utilisez car il permet de passez outre les blocage de port des fai comme c'est mon cas

sur mon ordi seul les tcp 443 80 8080 22 25 143 110 et udp 53 22 sont ouvert

la raison et que je me connecte depuis un hotpost sfr wifi car je suis presque tout temps en déplacement et presque jamais cher moi

voici ce qui et afficher sur le client quand je me connecte avec les commande

cd /etc/openvpn
sudo openvpn client.conf

andy@andy-ubuntu:/etc/openvpn$ sudo openvpn client.conf
Thu Feb 28 20:05:32 2013 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Mar 30 2012
Thu Feb 28 20:05:32 2013 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Thu Feb 28 20:05:32 2013 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Thu Feb 28 20:05:32 2013 NOTE: --script-security method='system' is deprecated due to the fact that passed parameters will be subject to shell expansion
Thu Feb 28 20:05:32 2013 WARNING: file 'andys1.key' is group or others accessible
Thu Feb 28 20:05:32 2013 LZO compression initialized
Thu Feb 28 20:05:32 2013 Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
Thu Feb 28 20:05:32 2013 Socket Buffers: R=[87380->131072] S=[16384->131072]
Thu Feb 28 20:05:32 2013 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Thu Feb 28 20:05:32 2013 Local Options hash (VER=V4): '2547efd2'
Thu Feb 28 20:05:32 2013 Expected Remote Options hash (VER=V4): '77cf0943'
Thu Feb 28 20:05:32 2013 Attempting to establish TCP connection with [AF_INET]91.121.177.128:443 [nonblock]
Thu Feb 28 20:05:33 2013 TCP connection established with [AF_INET]91.121.177.128:443
Thu Feb 28 20:05:33 2013 TCPv4_CLIENT link local: [undef]
Thu Feb 28 20:05:33 2013 TCPv4_CLIENT link remote: [AF_INET]91.121.177.128:443
Thu Feb 28 20:05:33 2013 TLS: Initial packet from [AF_INET]91.121.177.128:443, sid=23f20421 c710a228
Thu Feb 28 20:05:34 2013 VERIFY OK: depth=1, /C=FR/ST=59/L=Roubaix/O=s1.frabelu.eu/OU=changeme/CN=changeme/name=changeme/emailAddress=andykimpe@gmail.com
Thu Feb 28 20:05:34 2013 VERIFY OK: depth=0, /C=FR/ST=59/L=Roubaix/O=s1.frabelu.eu/OU=changeme/CN=server/name=changeme/emailAddress=andykimpe@gmail.com
Thu Feb 28 20:05:35 2013 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1576', remote='link-mtu 1544'
Thu Feb 28 20:05:35 2013 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1532', remote='tun-mtu 1500'
Thu Feb 28 20:05:35 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 28 20:05:35 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 28 20:05:35 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 28 20:05:35 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 28 20:05:35 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Feb 28 20:05:35 2013 [server] Peer Connection Initiated with [AF_INET]91.121.177.128:443
Thu Feb 28 20:05:37 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Feb 28 20:05:37 2013 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 5,ping-restart 30,ifconfig 10.8.0.6 10.8.0.5'
Thu Feb 28 20:05:37 2013 OPTIONS IMPORT: timers and/or timeouts modified
Thu Feb 28 20:05:37 2013 OPTIONS IMPORT: --ifconfig/up options modified
Thu Feb 28 20:05:37 2013 OPTIONS IMPORT: route options modified
Thu Feb 28 20:05:37 2013 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Feb 28 20:05:37 2013 ROUTE default_gateway=192.168.2.1
Thu Feb 28 20:05:37 2013 TUN/TAP device tun0 opened
Thu Feb 28 20:05:37 2013 TUN/TAP TX queue length set to 100
Thu Feb 28 20:05:37 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Feb 28 20:05:37 2013 /sbin/ifconfig tun0 10.8.0.6 pointopoint 10.8.0.5 mtu 1500
Thu Feb 28 20:05:37 2013 /etc/openvpn/update-resolv-conf tun0 1500 1576 10.8.0.6 10.8.0.5 init
dhcp-option DNS 8.8.8.8
dhcp-option DNS 8.8.4.4
Thu Feb 28 20:05:37 2013 /sbin/route add -net 91.121.177.128 netmask 255.255.255.255 gw 192.168.2.1
Thu Feb 28 20:05:37 2013 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.8.0.5
Thu Feb 28 20:05:37 2013 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.8.0.5
Thu Feb 28 20:05:37 2013 /sbin/route add -net 10.8.0.1 netmask 255.255.255.255 gw 10.8.0.5
Thu Feb 28 20:05:37 2013 Initialization Sequence Completed

et fichier de status du serveur /etc/openvpn/443.log

[root@ks363075 ~]#cat /etc/openvpn/443.log
OpenVPN CLIENT LIST
Updated,Thu Feb 28 20:09:04 2013
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
andys1,109.28.132.11:38359,127721,33661,Thu Feb 28 20:05:32 2013
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
10.8.0.6,andys1,109.28.132.11:38359,Thu Feb 28 20:09:03 2013
GLOBAL STATS
Max bcast/mcast queue length,0
END

fichier de configuration du serveur

[root@ks363075 ~]# cat /etc/openvpn/server.conf
mode server
proto tcp
port 443
dev tun
# Cles et certificats
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
# Reseau
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status 443.log
verb 3

fichier de configuration du serveur

andy@andy-ubuntu:/etc/openvpn$
# Client
client
dev tun
proto tcp
remote ipduserveur 443
resolv-retry infinite
nobind
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
persist-key
persist-tun
ca ca.crt
cert andys1.crt
key andys1.key
comp-lzo
reneg-sec 0
verb 3
script-security 3 system
up /etc/openvpn/update-resolv-conf

sur le client dans /etc/openvpn/update-resolv-conf j'ai ceci

#!/bin/bash
# 
# Parses DHCP options from openvpn to update resolv.conf
# To use set as 'up' and 'down' script in your openvpn *.conf:
# up /etc/openvpn/update-resolv-conf
# down /etc/openvpn/update-resolv-conf
#
# Used snippets of resolvconf script by Thomas Hood <jdthood@yahoo.co.uk> 
# and Chris Hanson
# Licensed under the GNU GPL.  See /usr/share/common-licenses/GPL. 
#
# 05/2006 chlauber@bnc.ch
# 
# Example envs set from openvpn:
# foreign_option_1='dhcp-option DNS 193.43.27.132'
# foreign_option_2='dhcp-option DNS 193.43.27.133'
# foreign_option_3='dhcp-option DOMAIN be.bnc.ch'

[ -x /sbin/resolvconf ] || exit 0

case $script_type in

up)
	for optionname in ${!foreign_option_*} ; do
		option="${!optionname}"
		echo $option
		part1=$(echo "$option" | cut -d " " -f 1)
		if [ "$part1" == "dhcp-option" ] ; then
			part2=$(echo "$option" | cut -d " " -f 2)
			part3=$(echo "$option" | cut -d " " -f 3)
			if [ "$part2" == "DNS" ] ; then
				IF_DNS_NAMESERVERS="$IF_DNS_NAMESERVERS $part3"
			fi
			if [ "$part2" == "DOMAIN" ] ; then
				IF_DNS_SEARCH="$IF_DNS_SEARCH $part3"
			fi
		fi
	done
	R=""
	for SS in $IF_DNS_SEARCH ; do
        	R="${R}search $SS
"
	done
	for NS in $IF_DNS_NAMESERVERS ; do
        	R="${R}nameserver $NS
"
	done
	echo -n "$R" | /sbin/resolvconf -a "${dev}.inet"
	;;
down)
	/sbin/resolvconf -d "${dev}.inet"
	;;
esac

pour information le serveur et cher ovh il et installer sur la distribution Fedora Core 17 "Beefy Miracle" qui et une distribution 64 bit

le client et sur ubuntu 12.04 64 bit également

madko

La d'après les log la connexion à openvpn est OK:

Thu Feb 28 20:05:37 2013 Initialization Sequence Completed

andykimpe

oui la connexion et ok mais une fois connecter je n'ai plus d'internet

j'ai essayer

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

mais sa ne change rien

voici le fichier iptables

[root@ks363075 ~]# cat /etc/sysconfig/iptables<<EOF
# Generated by iptables-save v1.4.14 on Wed Feb 27 18:59:14 2013
*raw
:PREROUTING ACCEPT [253:20060]
:OUTPUT ACCEPT [197:23072]
COMMIT
# Completed on Wed Feb 27 18:59:14 2013
# Generated by iptables-save v1.4.14 on Wed Feb 27 18:59:14 2013
*nat
:PREROUTING ACCEPT [4:240]
:INPUT ACCEPT [4:240]
:OUTPUT ACCEPT [4:836]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Wed Feb 27 18:59:14 2013
# Generated by iptables-save v1.4.14 on Wed Feb 27 18:59:14 2013
*mangle
:PREROUTING ACCEPT [253:20060]
:INPUT ACCEPT [253:20060]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [197:23072]
:POSTROUTING ACCEPT [197:23072]
COMMIT
# Completed on Wed Feb 27 18:59:14 2013
# Generated by iptables-save v1.4.14 on Wed Feb 27 18:59:14 2013
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [550:64375]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Wed Feb 27 18:59:14 2013

madko

ip_forward est activé? De plus dans tes règles iptables tu bloques le forward:

-A FORWARD -j REJECT --reject-with icmp-host-prohibited

Essaye en commentant cette ligne, ou en l'adaptant en autorisant le forward vers et depuis l'interface tun de ton openvpn.

andykimpe

ok merci j'ai aussi trouver ceci https://docs.fedoraproject.org/en-US/Fedora/13/html/Security_Guide/sect-Security_Guide-Firewalls-FORWARD_and_NAT_Rules.html

je vais tester les deux et je tient au courrant

andykimpe

merci je confirme le problème venez bien du forward

j'ai modifier le script et maintenant sa fonctionne parfaitement

début du script

#!/bin/bash
# centos 6 , ubuntu and debian
# vérifier si la distribution et de type debian ou read hat
if [ "$LANG" = "fr_FR" -o "$LANG" = "fr_FR.UTF-8" ]; then
echo -e "\033[34m###########################""\033[00m""\033[37m###########################""\033[00m""\033[31m##########################""\033[00m"
echo -e "\033[34m###########################""\033[00m""\033[37m###########################""\033[00m""\033[31m##########################""\033[00m"
echo -e "\033[34m###########################""\033[00m""\033[37m###########################""\033[00m""\033[31m##########################""\033[00m"
echo -e "\033[34m######################openv""\033[00m""\033[37mpn Instalation "automatique"\033[00m""\033[31m en francais###############""\033[00m"
echo -e "\033[34m###########################""\033[00m""\033[37m###########################""\033[00m""\033[31m##########################""\033[00m"
echo -e "\033[34m###########################""\033[00m""\033[37m###########################""\033[00m""\033[31m##########################""\033[00m"
echo -e "\033[34m###########################""\033[00m""\033[37m###########################""\033[00m""\033[31m##########################""\033[00m"
echo -e "\033[34m###########################""\033[00m""\033[37m###########################""\033[00m""\033[31m##########################""\033[00m"
echo -e "\033[34m###########################""\033[00m""\033[37m###########################""\033[00m""\033[31m##########################""\033[00m"
echo -e "\033[34m###########################""\033[00m""\033[37m###########################""\033[00m""\033[31m##########################""\033[00m"
echo -e "\033[34m###########################""\033[00m""\033[37m###########################""\033[00m""\033[31m##########################""\033[00m"
echo -e "\033[34m###########################""\033[00m""\033[37m###########################""\033[00m""\033[31m##########################""\033[00m"


echo "Entrez les premierre lettre de votre pays en majuscule"
echo "ex : pour la france FR"
read -e -p "Entrez les premierre lettre de votre pays en majuscule  : " country
read -e -p "Entrez le numero de votre departemant : " dep
read -e -p "Entrez le numéro de port qui sera utilise par le serveur (recommander 443) : " port
cat > /etc/openvpnport <<EOF
$port
EOF
read -e -p "Entrez le protocol udp ou tcp (recommander tcp) : " proto
cat > /etc/openvpnproto<<EOF
$proto
EOF
read -e -p " Entrez le nom de votre ville : " ville
read -e -p "Entrez le nom de votre entreprise ou si vous ete un particulier entrez le nom de votre serveur : " org
read -e -p "Entrez votre adresse mail : " email
else
echo "################################################################################"
echo "################################################################################"
echo "################################################################################"
echo "################################################################################"
echo "################################################################################"
echo "##########################Openvpn Auto Install English##########################"
echo "################################################################################"
echo "################################################################################"
echo "################################################################################"
echo "################################################################################"
echo "################################################################################"



echo "Enter the first letter of your country in uppercase"
echo "eg : for France FR"
read -e -p "Enter the first letter of your country in uppercase  : " country
read -e -p "Enter the number of your department : " dep
read -e -p "Enter the port number that will be used by the server (443 recommended) : " port
cat > /etc/openvpnport <<EOF
$port
EOF
read -e -p "Enter the protocol tcp or udp (tcp recommended) : " proto
cat > /etc/openvpnproto<<EOF
$proto
EOF
read -e -p "Enter the name of your city : " ville
read -e -p "Enter your company name or if particular enter the name of the server : " org
read -e -p "Enter your email address : " email
fi

partie du code pour fédora

cd /root
yum -y update
if [ "$LANG" = "fr_FR" -o "$LANG" = "fr_FR.UTF-8" ]; then
echo "Entrez votre numéro de version de read-hat"
echo "ex: pour centos 6 entrez 6 pour centos 5 entrez 5 pour fedora 17 entrez 17 pour fedora 18 entrez 18"
read -e -p "Entrez votre numéro de version de read-hat : " VERSION
else
echo "Enter the version number of read-hat"
echo "eg: centos 6 to enter 6 centos 5 to enter 5 fedora 17 to 17 fedora 18 to 18"
read-e-p "Enter the version number of read-hat : " VERSION
fi
yum -y install gcc make iptables rpm-build autoconf.noarch zlib-devel pam-devel openssl-devel wget chkconfig zip unzip sudo
wget http://openvpn.net/release/lzo-1.08-4.rf.src.rpm
rpmbuild --rebuild lzo-1.08-4.rf.src.rpm
if [ "$VERSION" = "17" -o "$VERSION" = "18" ]
then
rpm -Uvh lzo-*.rpm
rm lzo-*.rpm
yum install openvpn -y
cd /etc/openvpn
git clone git://github.com/OpenVPN/easy-rsa.git /etc/openvpn/test
mkdir /etc/openvpn/easy-rsa
cp -R /etc/openvpn/test/easy-rsa/2.0/* /etc/openvpn/easy-rsa
rm -rf /etc/openvpn/test
cd /etc/openvpn/easy-rsa/
chmod 755 *
rm -f /etc/openvpn/easy-rsa/vars
touch /etc/openvpn/easy-rsa/vars
cat > /etc/openvpn/easy-rsa/vars <<EOF
# easy-rsa parameter settings

# NOTE: If you installed from an RPM,
# don't edit this file in place in
# /usr/share/openvpn/easy-rsa --
# instead, you should copy the whole
# easy-rsa directory to another location
# (such as /etc/openvpn) so that your
# edits will not be wiped out by a future
# OpenVPN package upgrade.

# This variable should point to
# the top level of the easy-rsa
# tree.
export EASY_RSA="/etc/openvpn/easy-rsa/"

#
# This variable should point to
# the requested executables
#
export OPENSSL="openssl"
export PKCS11TOOL="pkcs11-tool"
export GREP="grep"


# This variable should point to
# the openssl.cnf file included
# with easy-rsa.
export KEY_CONFIG=/etc/openvpn/easy-rsa/openssl-1.0.0.cnf

# Edit this variable to point to
# your soon-to-be-created key
# directory.
#
# WARNING: clean-all will do
# a rm -rf on this directory
# so make sure you define
# it correctly!
export KEY_DIR="/etc/openvpn/easy-rsa/keys"

# Issue rm -rf warning
echo NOTE: If you run ./clean-all, I will be doing a rm -rf on $KEY_DIR

# PKCS11 fixes
export PKCS11_MODULE_PATH="dummy"
export PKCS11_PIN="dummy"

# Increase this to 2048 if you
# are paranoid.  This will slow
# down TLS negotiation performance
# as well as the one-time DH parms
# generation process.
export KEY_SIZE=1024

# In how many days should the root CA key expire?
export CA_EXPIRE=3650

# In how many days should certificates expire?
export KEY_EXPIRE=3650

# These are the default values for fields
# which will be placed in the certificate.
# Don't leave any of these fields blank.
export KEY_COUNTRY="$country"
export KEY_PROVINCE="$dep"
export KEY_CITY="$ville"
export KEY_ORG="$org"
export KEY_EMAIL="$email"
export KEY_EMAIL=$email
export KEY_CN=changeme
export KEY_NAME=changeme
export KEY_OU=changeme
export PKCS11_MODULE_PATH=changeme
export PKCS11_PIN=1234
EOF

mkdir keys
chmod 755 *
source ./vars
./vars
./clean-all
./build-ca
./build-key-server server
./build-dh
cp keys/ca.crt keys/server.crt keys/server.key keys/dh1024.pem /etc/openvpn/
cat > /etc/openvpn/server.conf <<EOF
mode server
proto $proto
port $port
dev tun
# Cles et certificats
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
# Reseau
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status $port.log
verb 3
EOF
setenforce 0
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
ln -s '/usr/lib/systemd/system/openvpn@.service' '/etc/systemd/system/multi-user.target.wants/openvpn@server.service'
systemctl enable openvpn@server.service
systemctl start openvpn@server.service
sed -i 's/net.ipv4.ip_forward = 0/net.ipv4.ip_forward = 1/g' /etc/sysctl.conf
sysctl -w net.ipv4.ip_forward=1
cat > /etc/sysconfig/iptables<<EOF
# Generated by iptables-save v1.4.14 on Wed Feb 27 18:59:14 2013
*raw
:PREROUTING ACCEPT [253:20060]
:OUTPUT ACCEPT [197:23072]
COMMIT
# Completed on Wed Feb 27 18:59:14 2013
# Generated by iptables-save v1.4.14 on Wed Feb 27 18:59:14 2013
*nat
:PREROUTING ACCEPT [4:240]
:INPUT ACCEPT [4:240]
:OUTPUT ACCEPT [4:836]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Wed Feb 27 18:59:14 2013
# Generated by iptables-save v1.4.14 on Wed Feb 27 18:59:14 2013
*mangle
:PREROUTING ACCEPT [253:20060]
:INPUT ACCEPT [253:20060]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [197:23072]
:POSTROUTING ACCEPT [197:23072]
COMMIT
# Completed on Wed Feb 27 18:59:14 2013
# Generated by iptables-save v1.4.14 on Wed Feb 27 18:59:14 2013
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [550:64375]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
COMMIT
# Completed on Wed Feb 27 18:59:14 2013
EOF
service iptables restart
iptables-restore </etc/sysconfig/iptables
systemctl restart openvpn@server.service
mkdir /etc/openvpn/clientconf
cp /tmp/openvpnscripts/ovcreateclient-fedora.sh /bin/ovcreateclient
dos2unix /bin/ovcreateclient
chmod +x /bin/ovcreateclient
rm -rf /tmp/openvpnscripts/
exit
else

encore merci à toi d’être toujours la quand à besoin d'aide

alou

Bonjour,
Je veux installer un serveur vpn mais je rencontre des problemes pour le demarrage du service avec systemctl.
J'ai besoin de mieux comprendre son fonctionnement. et aussi j'aimerai savoir l'importance de iptables sur openvpn,
Merci d'avance

andykimpe

essayer ces commande script d'installation automatique merci encore à madko de m'avoir aider a mètre ce script en place

il a était tester et fonctionnel sur fédora 17

désinstallation de openvpn

yum -y remove oepnvpn
rm -rf /etc/openvpn

installation des dépandance

yum -y install git dos2unix

pour avoir l'installation en français il faut exporter la variable LANG

LANG=FR
export LANG=FR

installation d'openvpn

cd /tmp && git clone git://github.com/andykimpe/openvpnscripts.git && dos2unix openvpnscripts/install.sh && chmod +x openvpnscripts/install.sh && openvpnscripts/install.sh

maintenant il te suffit de répondre au question posez et l'installation se fera automatiquement