发现以前搭建的版本不太好用了，重新搭建了一次，记录一下。

其他配置此处省略

发个配置：

server.conf

port 12306

proto udp
dev tun
ca /etc/open***/keys/ca.crt
cert /etc/open***/keys/server.crt
key /etc/open***/keys/server.key  # This file should be kept secret
dh /etc/open***/keys/dh1024.pem
push "redirect-gateway"
push "dhcp-option DNS 8.8.8.8" #客户端获得的DNS地址
push "dhcp-option DNS 202.106.0.20" #客户端获得的DNS地址
server 10.8.0.0 255.255.255.0
push "route 10.10.20.0 255.255.255.0"
ifconfig-pool-persist ipp.txt
client-to-client
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status /etc/open***/open***-status.log
log /etc/open***/open***.log
verb 4

客户端配置

client.o***

 

client

dev tun
proto udp
remote 119.254.11.16 12306
#resolv-retry infinite
ns-cert-type server
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
comp-lzo
verb 4
script-security 3

 

 cp /usr/local/src/open***-2.2.1/sample-scripts/open***.init /etc/init.d/open***(配置自动启动)

iptables防火墙配置

安装完open***下面的部分保存为~/iptables-init.sh，然后运行即可

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE (注:eth0为物理网卡名称)

iptables -A INPUT -i lo -p all -j ACCEPT
iptables -A INPUT -p all -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 465 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -p udp --dport 1194 -j ACCEPT
iptables -A INPUT -s 10.8.0.0/24 -p all -j ACCEPT
iptables -A FORWARD -d 10.8.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT