青莲

euserv安装openvpn

2024-07-13T15:57:00.000+08:00

1安装openvpn squid

apt install nginx squid openvpn net-tools

2设置ca证书

cd /usr/share/easy-rsa/

./easyrsa init-pki #1、初始化，在当前目录创建PKI目录，用于存储整数

./easyrsa build-ca nopass #2、创建根证书，会提示设置密码，用于ca对之后生成的server和client证书签名时使用，其他提示内容直接回车即可

#生成/usr/share/easy-rsa/pki/ca.crt文件

3创建服务器证书

./easyrsa gen-req server nopass #3、创建server端证书和私钥文件，nopass表示不加密私钥文件，提示内容直接回车即可

#生成/usr/share/easy-rsa/pki/private/server.key 私钥

./easyrsa sign server server #4、给server端证书签名，提示内容需要输入yes和创建ca根证书时候的密码

#生成 /usr/share/easy-rsa/pki/issued/server.crt 文件

./easyrsa gen-dh #5、创建Diffie-Hellman文件，密钥交换时的Diffie-Hellman算法

#生成/usr/share/easy-rsa/pki/dh.pem文件

./easyrsa gen-req client nopass #6、创建client端的证书和私钥文件，nopass表示不加密私钥文件，提示内容直接回车即可

#生成/usr/share/easy-rsa/pki/private/client.key文件

./easyrsa sign client client #7、给client端证书前面，提示内容输入yes和创建ca根证书时候的密码

#生成 /usr/share/easy-rsa/pki/issued/client.crt文件

一下是文件结构

root@srv18823:/usr/share/easy-rsa# tree

├── easyrsa

├── openssl-easyrsa.cnf

├── pki

│ ├── ca.crt #ca根证书，服务端与客户端都需要用

│ ├── certs_by_serial

│ │ ├── 2AD3DC96E6524594003F578D8421C7C4.pem

│ │ └── FF031323EAF488595E8F8E26BA8914F1.pem

│ ├── dh.pem #认证算法服务端

│ ├── index.txt

│ ├── index.txt.attr

│ ├── index.txt.attr.old

│ ├── index.txt.old

│ ├── issued

│ │ ├── client.crt #客户端证书

│ │ └── server.crt #服务端证书

│ ├── openssl-easyrsa.cnf

│ ├── private

│ │ ├── ca.key #ca私钥

│ │ ├── client.key #客户端私钥

│ │ └── server.key #服务端私钥

│ ├── reqs

│ │ ├── client.req

│ │ └── server.req

│ ├── revoked

│ │ ├── certs_by_serial

│ │ ├── private_by_serial

│ │ └── reqs_by_serial

│ ├── safessl-easyrsa.cnf

│ ├── serial

│ ├── serial.old

│ └── vars.example

├── vars

├── vars.example

└── x509-types

├── ca

├── client

├── code-signing

├── COMMON

├── email

├── kdc

├── server

└── serverClient

11 directories, 32 files

如以后需要添加用户

直接 ./easyrsa gen-req 开始

编辑openvpn服务器配置文件

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

#################################################

# Sample OpenVPN 2.0 config file for #

# multi-client server. #

# #

# This file is for the server side #

# of a many-clients <-> one-server #

# OpenVPN configuration. #

# #

# OpenVPN also supports #

# single-machine <-> single-machine #

# configurations (See the Examples page #

# on the web site for more info). #

# #

# This config should work on Windows #

# or Linux/BSD systems. Remember on #

# Windows to quote pathnames and use #

# double backslashes, e.g.: #

# "C:\\Program Files\\OpenVPN\\config\\foo.key" #

# #

# Comments are preceded with '#' or ';' #

#################################################

# Which local IP address should OpenVPN

# listen on? (optional)

;local a.b.c.d

# Which TCP/UDP port should OpenVPN listen on?

# If you want to run multiple OpenVPN instances

# on the same machine, use a different port

# number for each one. You will need to

# open up this port on your firewall.

port 443

# TCP or UDP server?

proto tcp

;proto udp

# "dev tun" will create a routed IP tunnel,

# "dev tap" will create an ethernet tunnel.

# Use "dev tap0" if you are ethernet bridging

# and have precreated a tap0 virtual interface

# and bridged it with your ethernet interface.

# If you want to control access policies

# over the VPN, you must create firewall

# rules for the the TUN/TAP interface.

# On non-Windows systems, you can give

# an explicit unit number, such as tun0.

# On Windows, use "dev-node" for this.

# On most systems, the VPN will not function

# unless you partially or fully disable

# the firewall for the TUN/TAP interface.

;dev tap

dev tun

# Windows needs the TAP-Win32 adapter name

# from the Network Connections panel if you

# have more than one. On XP SP2 or higher,

# you may need to selectively disable the

# Windows firewall for the TAP adapter.

# Non-Windows systems usually don't need this.

;dev-node MyTap

# SSL/TLS root certificate (ca), certificate

# (cert), and private key (key). Each client

# and the server must have their own cert and

# key file. The server and all clients will

# use the same ca file.

# See the "easy-rsa" directory for a series

# of scripts for generating RSA certificates

# and private keys. Remember to use

# a unique Common Name for the server

# and each of the client certificates.

# Any X509 key management system can be used.

# OpenVPN can also use a PKCS #12 formatted key file

# (see "pkcs12" directive in man page).

ca /usr/share/easy-rsa/pki/ca.crt

cert /usr/share/easy-rsa/pki/issued/server.crt

key /usr/share/easy-rsa/pki/private/client.key # This file should be kept secret

# Diffie hellman parameters.

# Generate your own with:

# openssl dhparam -out dh2048.pem 2048

dh /usr/share/easy-rsa/pki/dh.pem

# Network topology

# Should be subnet (addressing via IP)

# unless Windows clients v2.0.9 and lower have to

# be supported (then net30, i.e. a /30 per client)

# Defaults to net30 (not recommended)

;topology subnet

# Configure server mode and supply a VPN subnet

# for OpenVPN to draw client addresses from.

# The server will take 10.8.0.1 for itself,

# the rest will be made available to clients.

# Each client will be able to reach the server

# on 10.8.0.1. Comment this line out if you are

# ethernet bridging. See the man page for more info.

server 10.8.0.0 255.255.255.0

# Maintain a record of client <-> virtual IP address

# associations in this file. If OpenVPN goes down or

# is restarted, reconnecting clients can be assigned

# the same virtual IP address from the pool that was

# previously assigned.

ifconfig-pool-persist /var/log/openvpn/ipp.txt

# Configure server mode for ethernet bridging.

# You must first use your OS's bridging capability

# to bridge the TAP interface with the ethernet

# NIC interface. Then you must manually set the

# IP/netmask on the bridge interface, here we

# assume 10.8.0.4/255.255.255.0. Finally we

# must set aside an IP range in this subnet

# (start=10.8.0.50 end=10.8.0.100) to allocate

# to connecting clients. Leave this line commented

# out unless you are ethernet bridging.

;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100

# Configure server mode for ethernet bridging

# using a DHCP-proxy, where clients talk

# to the OpenVPN server-side DHCP server

# to receive their IP address allocation

# and DNS server addresses. You must first use

# your OS's bridging capability to bridge the TAP

# interface with the ethernet NIC interface.

# Note: this mode only works on clients (such as

# Windows), where the client-side TAP adapter is

# bound to a DHCP client.

;server-bridge

# Push routes to the client to allow it

# to reach other private subnets behind

# the server. Remember that these

# private subnets will also need

# to know to route the OpenVPN client

# address pool (10.8.0.0/255.255.255.0)

# back to the OpenVPN server.

;push "route 192.168.10.0 255.255.255.0"

;push "route 192.168.20.0 255.255.255.0"

# To assign specific IP addresses to specific

# clients or if a connecting client has a private

# subnet behind it that should also have VPN access,

# use the subdirectory "ccd" for client-specific

# configuration files (see man page for more info).

# EXAMPLE: Suppose the client

# having the certificate common name "Thelonious"

# also has a small subnet behind his connecting

# machine, such as 192.168.40.128/255.255.255.248.

# First, uncomment out these lines:

;client-config-dir ccd

;route 192.168.40.128 255.255.255.248

# Then create a file ccd/Thelonious with this line:

# iroute 192.168.40.128 255.255.255.248

# This will allow Thelonious' private subnet to

# access the VPN. This example will only work

# if you are routing, not bridging, i.e. you are

# using "dev tun" and "server" directives.

# EXAMPLE: Suppose you want to give

# Thelonious a fixed VPN IP address of 10.9.0.1.

# First uncomment out these lines:

;client-config-dir ccd

;route 10.9.0.0 255.255.255.252

# Then add this line to ccd/Thelonious:

# ifconfig-push 10.9.0.1 10.9.0.2

# Suppose that you want to enable different

# firewall access policies for different groups

# of clients. There are two methods:

# (1) Run multiple OpenVPN daemons, one for each

# group, and firewall the TUN/TAP interface

# for each group/daemon appropriately.

# (2) (Advanced) Create a script to dynamically

# modify the firewall in response to access

# from different clients. See man

# page for more info on learn-address script.

;learn-address ./script

# If enabled, this directive will configure

# all clients to redirect their default

# network gateway through the VPN, causing

# all IP traffic such as web browsing and

# and DNS lookups to go through the VPN

# (The OpenVPN server machine may need to NAT

# or bridge the TUN/TAP interface to the internet

# in order for this to work properly).

#client-config-dir ccd

#route 10.8.0.0 255.255.255.252

#push "route 0.0.0.0 0.0.0.0"

push "redirect-gateway def1 bypass-dhcp"

#push "redirect-gateway def1"

#push "route 10.8.0.0 255.255.224.0"

# Certain Windows-specific network settings

# can be pushed to clients, such as DNS

# or WINS server addresses. CAVEAT:

# http://openvpn.net/faq.html#dhcpcaveats

# The addresses below refer to the public

# DNS servers provided by opendns.com.

push "dhcp-option DNS 1.1.1.1"

push "dhcp-option DNS 8.8.8."

# Uncomment this directive to allow different

# clients to be able to "see" each other.

# By default, clients will only see the server.

# To force clients to only see the server, you

# will also need to appropriately firewall the

# server's TUN/TAP interface.

client-to-client

# Uncomment this directive if multiple clients

# might connect with the same certificate/key

# files or common names. This is recommended

# only for testing purposes. For production use,

# each client should have its own certificate/key

# pair.

# IF YOU HAVE NOT GENERATED INDIVIDUAL

# CERTIFICATE/KEY PAIRS FOR EACH CLIENT,

# EACH HAVING ITS OWN UNIQUE "COMMON NAME",

# UNCOMMENT THIS LINE OUT.

duplicate-cn

# The keepalive directive causes ping-like

# messages to be sent back and forth over

# the link so that each side knows when

# the other side has gone down.

# Ping every 10 seconds, assume that remote

# peer is down if no ping received during

# a 120 second time period.

#keepalive 5 30

keepalive 7 15

# For extra security beyond that provided

# by SSL/TLS, create an "HMAC firewall"

# to help block DoS attacks and UDP port flooding.

# Generate with:

# openvpn --genkey --secret ta.key

# The server and each client must have

# a copy of this key.

# The second parameter should be '0'

# on the server and '1' on the clients.

;tls-auth ta.key 0 # This file is secret

# Select a cryptographic cipher.

# This config item must be copied to

# the client config file as well.

# Note that v2.4 client/server will automatically

# negotiate AES-256-GCM in TLS mode.

# See also the ncp-cipher option in the manpage

cipher AES-256-CBC

# Enable compression on the VPN link and push the

# option to the client (v2.4+ only, for earlier

# versions see below)

;compress lz4-v2

;push "compress lz4-v2"

# For compression compatible with older clients use comp-lzo

# If you enable it here, you must also

# enable it in the client config file.

comp-lzo

# The maximum number of concurrently connected

# clients we want to allow.

;max-clients 100

# It's a good idea to reduce the OpenVPN

# daemon's privileges after initialization.

# You can uncomment this out on

# non-Windows systems.

user nobody

group nogroup

# The persist options will try to avoid

# accessing certain resources on restart

# that may no longer be accessible because

# of the privilege downgrade.

persist-key

persist-tun

# Output a short status file showing

# current connections, truncated

# and rewritten every minute.

status /var/log/openvpn/openvpn-status.log

# By default, log messages will go to the syslog (or

# on Windows, if running as a service, they will go to

# the "\Program Files\OpenVPN\log" directory).

# Use log or log-append to override this default.

# "log" will truncate the log file on OpenVPN startup,

# while "log-append" will append to it. Use one

# or the other (but not both).

log /var/log/openvpn/openvpn.log

;log-append /var/log/openvpn/openvpn.log

# Set the appropriate level of log

# file verbosity.

# 0 is silent, except for fatal errors

# 4 is reasonable for general usage

# 5 and 6 can help to debug connection problems

# 9 is extremely verbose

verb 3

# Silence repeating messages. At most 20

# sequential messages of the same message

# category will be output to the log.

;mute 20

# Notify the client that when the server restarts so it

# can automatically reconnect.

;explicit-exit-notify 1

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

开启内核转发

echo "net.ipv4.ip_forward = 1" >>/etc/sysctl.conf

sysctl -p

iptables-t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE # 设置nat 转发

编辑openvpn客户端

红色是要修改的文件内容

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

##############################################

# Sample client-side OpenVPN 2.0 config file #

# for connecting to multi-client server. #

# #

# This configuration can be used by multiple #

# clients, however each client should have #

# its own cert and key files. #

# #

# On Windows, you might want to rename this #

# file so it has a .ovpn extension #

##############################################

# Specify that we are a client and that we

# will be pulling certain config file directives

# from the server.

client

# Use the same setting as you are using on

# the server.

# On most systems, the VPN will not function

# unless you partially or fully disable

# the firewall for the TUN/TAP interface.

;dev tap

dev tun

# Windows needs the TAP-Win32 adapter name

# from the Network Connections panel

# if you have more than one. On XP SP2,

# you may need to disable the firewall

# for the TAP adapter.

;dev-node MyTap

# Are we connecting to a TCP or

# UDP server? Use the same setting as

# on the server.

proto tcp

;proto udp

# The hostname/IP and port of the server.

# You can have multiple remote entries

# to load balance between the servers.

remote 127.0.0.1 443

;remote my-server-2 1194

# Choose a random host from the remote

# list for load-balancing. Otherwise

# try hosts in the order specified.

;remote-random

# Keep trying indefinitely to resolve the

# host name of the OpenVPN server. Very useful

# on machines which are not permanently connected

# to the internet such as laptops.

resolv-retry infinite

# Most clients don't need to bind to

# a specific local port number.

nobind

# Downgrade privileges after initialization (non-Windows only)

;user nobody

;group nogroup

# Try to preserve some state across restarts.

persist-key

persist-tun

# If you are connecting through an

# HTTP proxy to reach the actual OpenVPN

# server, put the proxy server/IP and

# port number here. See the man page

# if your proxy server requires

# authentication.

;http-proxy-retry # retry on connection failures

;http-proxy [proxy server] [proxy port #]

http-proxy-retry # retry on connection failures

http-proxy srv18823.blue.kundencontroller.de 8080

# Wireless networks often produce a lot

# of duplicate packets. Set this flag

# to silence duplicate packet warnings.

;mute-replay-warnings

# SSL/TLS parms.

# See the server config file for more

# description. It's best to use

# a separate .crt/.key file pair

# for each client. A single ca

# file can be used for all clients.

;ca ca.crt

;cert client.crt

;key client.key

# Verify server certificate by checking that the

# certicate has the correct key usage set.

# This is an important precaution to protect against

# a potential attack discussed here:

# http://openvpn.net/howto.html#mitm

# To use this feature, you will need to generate

# your server certificates with the keyUsage set to

# digitalSignature, keyEncipherment

# and the extendedKeyUsage to

# serverAuth

# EasyRSA can do this for you.

remote-cert-tls server

# If a tls-auth key is used on the server

# then every client must also have the key.

;tls-auth ta.key 1

# Select a cryptographic cipher.

# If the cipher option is used on the server

# then you must also specify it here.

# Note that v2.4 client/server will automatically

# negotiate AES-256-GCM in TLS mode.

# See also the ncp-cipher option in the manpage

cipher AES-256-CBC

# Enable compression on the VPN link.

# Don't enable this unless it is also

# enabled in the server config file.

comp-lzo

# Set log file verbosity.

verb 3

# Silence repeating messages

;mute 20

<ca>

-----BEGIN CERTIFICATE-----

ca.crt文件内容

-----END CERTIFICATE-----

</ca>

<cert>

-----BEGIN CERTIFICATE-----

client.crt 文件内容

-----END CERTIFICATE-----

</cert>

<key>

-----BEGIN PRIVATE KEY-----

client.key文件内容

-----END PRIVATE KEY-----

</key>

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

配置squid文件

cd /etc/squid/

vi ./squid.conf #打开squid配置文件并修改3128为8080

vi ./conf.d/debian.conf #打开文件并在写入下面代码，红色是自己的服务器IP地址

~~~~~~~~~~~~~~~~~~~

acl okip dst 140.238.32.146 127.0.0.1

http_access allow okip

~~~~~~~~~~~~~~~~~~~

启动squid

systemctl start squid

euserv访问ipv4

2022-09-24T17:12:00.001+08:00

vi /etc/resolv.conf

添加下面代码

nameserver 2a03:7900:2:0:31:3:104:161

vps 安装aria2配置文件备份

2022-08-11T17:38:00.003+08:00

# touch /data/aria2.session

# vim /etc/aria2/aria2.conf

## '#'开头为注释内容, 选项都有相应的注释说明, 根据需要修改 ##

## 被注释的选项填写的是默认值, 建议在需要修改时再取消注释 ##

## 文件保存相关 ##

# 文件的保存路径(可使用绝对路径或相对路径), 默认: 当前启动位置

dir=/home/ubuntu/download

# 启用磁盘缓存, 0为禁用缓存, 需1.16以上版本, 默认:16M

#disk-cache=32M

# 文件预分配方式, 能有效降低磁盘碎片, 默认:prealloc

# 预分配所需时间: none < falloc ? trunc < prealloc

# falloc和trunc则需要文件系统和内核支持

# NTFS建议使用falloc, EXT3/4建议trunc, MAC 下需要注释此项

file-allocation=prealloc

# 断点续传

continue=true

## 下载连接相关 ##

# 最大同时下载任务数, 运行时可修改, 默认:5

max-concurrent-downloads=10

# 同一服务器连接数, 添加时可指定, 默认:1

max-connection-per-server=10

# 最小文件分片大小, 添加时可指定, 取值范围1M -1024M, 默认:20M

# 假定size=10M, 文件为20MiB 则使用两个来源下载; 文件为15MiB 则使用一个来源下载

min-split-size=10M

# 单个任务最大线程数, 添加时可指定, 默认:5

split=5

# 整体下载速度限制, 运行时可修改, 默认:0

#max-overall-download-limit=0

# 单个任务下载速度限制, 默认:0

#max-download-limit=0

# 整体上传速度限制, 运行时可修改, 默认:0

max-overall-upload-limit=1k

# 单个任务上传速度限制, 默认:0

max-upload-limit=1k

# 禁用IPv6, 默认:false

disable-ipv6=true

## 进度保存相关 ##

# 从会话文件中读取下载任务

input-file=/home/ubuntu/aria2/aria2.session

# 在Aria2退出时保存`错误/未完成`的下载任务到会话文件

save-session=/home/ubuntu/aria2/aria2.session

# 定时保存会话, 0为退出时才保存, 需1.16.1以上版本, 默认:0

save-session-interval=60

## RPC相关设置 ##

enable-rpc=true

pause=false

rpc-allow-origin-all=true

rpc-listen-all=true

rpc-save-upload-metadata=true

rpc-secure=false

# 启用RPC, 默认:false

#enable-rpc=true

# 允许所有来源, 默认:false

#rpc-allow-origin-all=true

# 允许非外部访问, 默认:false

#rpc-listen-all=true

# 事件轮询方式, 取值:[epoll, kqueue, port, poll, select], 不同系统默认值不同

#event-poll=select

# RPC监听端口, 端口被占用时可以修改, 默认:6800

rpc-listen-port=6800

# 设置的RPC授权令牌, v1.18.4新增功能, 取代 --rpc-user 和 --rpc-passwd 选项

#rpc-secure=17945

# 设置的RPC访问用户名, 此选项新版已废弃, 建议改用 --rpc-secret 选项

#rpc-user=<USER>

# 设置的RPC访问密码, 此选项新版已废弃, 建议改用 --rpc-secret 选项

#rpc-passwd=<PASSWD>

## BT/PT下载相关 ##

# 当下载的是一个种子(以.torrent结尾)时, 自动开始BT任务, 默认:true

#follow-torrent=true

# BT监听端口, 当端口被屏蔽时使用, 默认:6881-6999

listen-port=51413

# 单个种子最大连接数, 默认:55

#bt-max-peers=55

# 打开DHT功能, PT需要禁用, 默认:true

enable-dht=true

# 打开IPv6 DHT功能, PT需要禁用

#enable-dht6=false

# DHT网络监听端口, 默认:6881-6999

#dht-listen-port=6881-6999

# 本地节点查找, PT需要禁用, 默认:false

bt-enable-lpd=true

# 种子交换, PT需要禁用, 默认:true

enable-peer-exchange=false

# 每个种子限速, 对少种的PT很有用, 默认:50K

#bt-request-peer-speed-limit=50K

# 客户端伪装, PT需要

#peer-id-prefix=-TR2770-

user-agent=Transmission/2.92

#user-agent=netdisk;4.4.0.6;PC;PC-Windows;6.2.9200;WindowsBaiduYunGuanJia

# 当种子的分享率达到这个数时, 自动停止做种, 0为一直做种, 默认:1.0

seed-ratio=0.2

#作种时间大于30分钟，则停止作种

seed-time=3

# 强制保存会话, 话即使任务已经完成, 默认:false

# 较新的版本开启后会在任务完成后依然保留.aria2文件

#force-save=false

# BT校验相关, 默认:true

#bt-hash-check-seed=true

# 继续之前的BT任务时, 无需再次校验, 默认:false

bt-seed-unverified=true

# 保存磁力链接元数据为种子文件(.torrent文件), 默认:false

bt-save-metadata=true

#下载完成后删除.ara2的同名文件

on-download-complete=/home/ubuntu/aria2/delete_aria2

#on-download-complete=/home/ubuntu/aria2/rasp.sh

您能浏览我的网站，能让我高兴一整天！

Oracle Ubuntu ipv6 arm

2021-12-27T20:52:00.001+08:00

编辑以下文件：

sudo vim /etc/netplan/50-cloud-init.yaml
添加 adreesses 配置

然后执行命令: sudo netplan apply

我的文件如下：

network:
ethernets:
      enp0s3:
         dhcp4: true
         dhcp6: false
         match:
            macaddress: 02:00:17:01:51:e9
         addresses:
            – 2603:c022:8000:ab00:7db4:c28f:xxxx/128 #  具体地址去甲骨文后台查看
         set-name: enp0s3
version: 2
解决了

您能浏览我的网站，能让我高兴一整天！

FreeBSD12.1更换pkg，portsnap，ports，update源

2021-02-11T21:26:00.002+08:00

您能浏览我的网站，能让我高兴一整天！

debian 禁用默认服务

2016-10-20T08:42:00.004+08:00

debian默认启动很多服务，有时占时用不到占用内存，现在我们用两条命令来对它进行修改
1查询启动的服务 service --status-all
2修改默认启动服务update-rc.d

用server --status-all查询时 +表示正在运行，-表示没有运行，?表示不详（？），可能是不支持用status查询状态。
查询到默认启动的服务名称时用update-rc.d来进行修改，用法也很简单 update-rc.d name enable|disable [s|2|3|4|5]

openvpn云免流之debian系统搭建全能云免服务器

2016-07-06T06:05:00.000+08:00

免流所需要的设备可以搭openvpn的vps一台 android iphone的手机
vps系统是debian vps先更改时区dpkg-reconfigure tzdata

1 安装软件 apt-get update&&apt-get dist-upgrade
&&apt-get install openvpn squid3

2 用easy-rsa生成服务端证书
cp -r /usr/share/easy-rsa/ /etc/openvpn/

cd /etc/openvpn/easy-rsa/2.0

source vars

./clean-all

./build-ca

3 生成服务器证书和密钥

./build-key-server server #server服务器名称

期间也会提示输入一些信息，直接回车默认，选择[Y/n]的都选Y。

4 生成客户端证书和密钥：（client为客户端名字可以自定义，注意这里的客户端名字不能与上步的服务端名字相同）

./build-key client

期间也会提示输入一些信息，直接回车默认，选择[Y/n]的都选Y。若要生成多个客户端的证书和密钥，将client改成另外的名字重复操作即可。所有生成的证书和密钥存都放在/etc/openvpn/easy-rsa/2.0/keys/下面。

5 生成Diffie Hellman参数：

./build-dh

6 配置openvpn 服务器密钥
把2 3 生成的文件复制到 /etc/openvpn下
cd /etc/openvpn/easy-rsa/keys/
cp ca.crt dh2048.pem server.crt server.key /etc/openvpn/

7 配置openvpn 服务器
将/usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz文件复制到/etc/openvpn目录，并解压
# cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn
# gzip -d /etc/openvpn/server.conf.gz
修改 /etc/openvpn/server.conf 文件
local ip
dh dh2048.pem
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
client-to-client
duplicate-cn
cipher AES-128-CBC
log-append openvpn.log
auth-nocache

8 修改 /etc/sysctl.conf内容为
net.ipv4.ip_forward=1 运行sysctl -p 启动

8 设置IP转发
若Xen或KVM的请输入：（eth0要根据具体的网卡标示来，可以通过ifconfig查看）
iptables -t nat -A POSTROUTING -s 10.8.0.0/16 -o eth0 -j MASQUERADE
若OpenVZ的请输入：（11.22.33.44是你VPS的IP）
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source x.x.x.x # x.x.x.x为服务器IP
应对GFW封锁，我们要忽略RST包

iptables -A INPUT -p tcp --tcp-flags RST RST -j DROP
~~iptables -I INPUT -p tcp --tcp-flags ACK,SYN,FIN,RST,URG,PSH RST -j DROP~~
为防止重启后转发丢失，把代码写进 /etc/rc.local中

#!/bin/sh -e
#
# rc.local
#
# This script is executed at the end of each multiuser runlevel.
# Make sure that the script will "exit 0" on success or any other
# value on error.
#
# In order to enable or disable this script just change the execution
# bits.
#
# By default this script does nothing.
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source x.x.x.x
iptables -A INPUT -p tcp --tcp-flags RST RST -j DROP
iptables -t filter -A OUTPUT -p tcp --tcp-flags RST RST -j DROP
/etc/init.d/dnsmasq restart

exit 0

9 配置openvpn客户端文件
mkdir /home/openvpn-client
cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf /home/openvpn-client/client.ovpn
cd /etc/openvpn/easy-rsa/keys/
cp -r ./ca.crt client.key client.crt /home/openvpn-client/
cd /home/openvpn-client/

将密钥文件添加到client.ovpn里

echo "" >> client.ovpn
echo "" >>client.ovpn
cat ca.crt | grep -A 100 "BEGIN CERTIFICATE" | grep -B 100 "END CERTIFICATE" >> client.ovpn
echo "
" >> client.ovpnecho "" >> client.ovpn
cat client.crt | grep -A 100 "BEGIN CERTIFICATE" | grep -B 100 "END CERTIFICATE" >> client.ovpn
echo "
" >> client.ovpnecho "" >> client.ovpn
cat client.key | grep -A 100 "BEGIN PRIVATE KEY" | grep -B 100 "END PRIVATE KEY" >> client.ovpn
echo "
" >> client.ovpn

以下是cmcc 免流代码
mssfix 1400
auth-nocache
http-proxy 服务器IP 8080
http-proxy-retry
http-proxy-timeout 1
http-proxy-option EXT1 "GET http://rd.go.10086.cn"
http-proxy-option EXT1 "POST http://rd.go.10086.cn"
http-proxy-option EXT1 "X-Online-Host: rd.go.10086.cn"
http-proxy-option EXT1 "Host: rd.go.10086.cn"
http-proxy-option AGENT "Iphone 9x"

;script-security 3 system
;route-up "net stop dnscache"
;route-up "net start dnscache"
;route-up "ipconfig /flushdns"
;route-up "ipconfig /registerdns"
ns-cert-type server # 要求客户端证书 nsCertType 为 server
remote-cert-tls server # 检查客户端证书 key usage 和 extended key usage

您能浏览我的网站，能让我高兴一整天！

openvpn云免流之squid3及防恶意扫描

2016-05-27T08:53:00.003+08:00

服务器架设了squid3代理,无奈扫代理的成堆
access.log 一天就几个G
现在设置让squid3只能连接一个ip

在配置文件（/etc/squid3/squid3.conf）中找到 http_access deny all
在上面添加以下2行代码，让squid3只能连接服务器IP

1 安装squid3
apt-get install squid3

2 设置squid3
vi /etc/squid3/squid.conf
找到http_access deny all 在上面添加以下代码

acl okip dst 服务器IP
http_access allow okip
http_access deny all

3设置端口
http_port 8080

4检查squid配置是否正确

squid -k check

5启动squid

/etc/init.d/squid3 start

您能浏览我的网站，能让我高兴一整天！
参考：
http://wangzan18.blog.51cto.com/8021085/1690504
http://home.arcor.de/pangj/squid/chap06.html

把ca.crt证书放入client.ovpn配置文件

2016-05-19T12:34:00.001+08:00

如果你有好几个网站的openvpn配置你可以在config目录下为每一个网站建一个文件夹，也可以都放在config目录下，不过是不是有很多.crt和.key文件很烦人呀，其实你可以把它们都删除了，只需要把他们放入client.ovpn配置文件。

用写字板打开各个client.ovpn文件在最后面添加

<ca>

</ca>

<cert>

</cert>

<key>

</key>

key-direction 1
<tls-auth>

</tls-auth>

用记事本打开ca.crt把文件内容复制到<ca>和</ca>的中间，

用记事本打开client.crt把文件内容复制到<cert>和</cert>的中间，

用记事本打开client.key把文件内容复制到<key>和</key>的中间，

用记事本打开ta.key把文件内容复制到<tls-auth>和</tls-auth>的中间，

（ca.crt、client.crt、client.key、ta.key这些文件不一定全都与，有那些就修改那些；这些文件的名字不一定都是这样，可以在.ovpn配置文件里搜索ca、cert、key、tls-auth看他们所对应的文件名）

修改完成后删除类似

tls-auth ta.key 1
ca ca.crt
cert client.crt
key client.key

的那几行，然后保.ovpn文件即可删除那些.crt和.key文件而正常使用了（你可以把密码都保存在一个文件夹下，修改如下：把：auth-user-pass 改成： auth-user-pass pwd/mypass.txt 并在client.ovpn所在目录建立pwd文件夹并在此文件夹下建mypass.txt文件…）。

不用下载任何软件用win7的vhd安装多系统

2015-08-04T07:10:00.000+08:00

win10正式版开放下载了,大家都想下载试用一下.我这里有个好方法,不用破坏旧系统,安装新系统,不好用了还可以把新系统删掉.

主系统要是win7以上.这样才可以使用vhd功能.

1,打开计算机管理如下图,点创建vhd

2,在位置上把文件放到D盘上,选动态扩展,大小的话最少要20G的空间.
3,这时在磁盘里就有个磁盘1,然后点初始化,然后格式化硬盘.
4,用压缩软件打开下载的win10系统,解压sources文件下的install.wim文件到D盘.
5,用压缩软件解压install.wim文件到新创建的硬盘上.
6,用管理员权限运行CMD.exe,然后运行 bcdboot.exe g:\windows /s c: /l zh_cn 把G盘的windows系统添加到C盘启动菜单.
7运行msconfig,把系统默认启动系统由win10改为win7.

您能浏览我的网站，能让我高兴一整天！

windows版googletalk 客户最好的替代产品

2015-03-01T15:37:00.002+08:00

gtalk这几天无法登陆了.这么好的软件怎么说不能用就不能用了,软件小,启动快,还没有后门,各方面QQ都不能比.

最后终于找到一款和它类似的软件.和gtalk大小差不多,但是比它功能还强大.支持gtalk,自家帐号和xmpp协议的帐号登陆.软件名子就是talkonaut.支持s60 android iphone win.

gtalk无法登陆后,这个软件用google帐号也无法登陆,但是如果把协议改为xmpp后照样能登陆.具体方法是运行软件,把软件界面的(Account type:Talkonaut)改为(Account type:Jabber)后填入gmail的帐号密码就可以登陆成功.

软件官主网站下载绿色免安装版本下载

您能浏览我的网站，能让我高兴一整天！

talkonaut用gmail帐号在国内无法登陆的解决方法

2015-02-26T14:31:00.001+08:00

我老nokia手机上gtalk只有talkonaut可以用.以前还是可以登陆的.后来防火墙升级后就无法登陆了.
最近我又能登陆了.解决方法是:在连接设置里服务器地址填入六四点二三三点一八九点一二五,保存退可登陆.
如果你要问我这个IP是怎么找的.我的方法是用gtalk代理登陆,然后查看防火墙看看它连接哪个IP,我找到这个IP在浏览器可以正常使用.没有被墙,真幸运.

您能浏览我的网站，能让我高兴一整天！

windows7 windows8 开启无线热点批处理单文件版

2015-02-15T10:29:00.003+08:00

笔记本开启无线热点的批处理,一个文件自动打开关闭无线热点文件.
将下面命令保存为批处理文件.
_________________________________________________________________________

@ECHO OFF
setlocal enabledelayedexpansion
%~d0
cd %~dp0
title Wifi 热点控制
echo ++++++++++++++++++++++++++++++++++++
echo **********************************
echo * *
echo * Wifi 热点控制 *
echo * *
echo * 注意：本文件需以管理员身份运行 *
echo * *
echo **********************************
echo ++++++++++++++++++++++++++++++++++++
IF EXIST 启用 (
rd 启用
netsh wlan set hostednetwork mode=disallow
netsh wlan stop hostednetwork
echo ----------------------------------------
echo wifi分享已关闭
echo ----------------------------------------
)ELSE (
md 启用
set /p var=输入 wifi 名称:
set /p pwd=输入 wifi 密码:
netsh wlan set hostednetwork mode=allow ssid=!var! key=!pwd!
netsh wlan start hostednetwork
echo ###### 请按提示操作完成最后的设置： ######
echo =====================================================================
echo * 打开 [网络和共享中心]-[更改适配器设置]
echo * 在可用的网络连接上 [右键]-[属性]-[共享] 在下拉框中选择虚拟出的网络
echo =====================================================================
echo ###### 操作完成后就可以连接 wifi 了 ######)

pause>nul
exit

_________________________________________________________________________

您能浏览我的网站，能让我高兴一整天！

Gobi2000 电信EVDO有信号无法上网的解决方法

2015-02-08T23:31:00.003+08:00

自己用的笔记本老想安装debian系统。终于前天安装上了。但是gobi2000安装后无法使用电信上网卡。折腾一天无解，又换回了win系统。但是win系统也无法上网了。

后来自己用手机找到了解决方法，需要用QPST这款软件

1.打开QPST Configuration软件，首先添加Gobi2000端口，新版软件自动识别商品。
2.在Start Clients中打开Service Programming，点击”Read from phone”读卡，(整个过程只点一次读卡就可以了)，
System选项中，默认值(不需要改变)
1x/HDR Security选项中，选择”R-UIM if avail”，[必须选R-UIM if avail模式]
M.IP选项中，选择”Simple IP onle”
gpsOne选项中，
PPP Config选项中，Um用户名写ctnet@mycdma.cn，密码写vnet.mobi，删除AN中的信息ctnet@mycdma.cn，AN不写任何信息，最后点击”Write to Phone”就可以了，
保存过程中会有提示点击”OK或确定”，退出即可完成设置，然后设置拨号软件。

您能浏览我的网站，能让我高兴一整天！

win8.1系统下3G无线上网卡无法修改DNS的解决方法

2015-01-16T17:28:00.002+08:00

由于我上网用的是gobi2000安装手机卡上网,所以无法更改dns,只能使用河南省的dns,造成无法登陆googletalk.终于在网上找到解决方法.在这里做个记号.

用系统管理员模式打开cmd命令提示符
netsh interface ipv4 add dnsserver "移动宽带" 127.0.0.1 index=1
移动宽带改为你上网卡在系统中的名子
127.0.0.1 改为你的dns服务器

您能浏览我的网站，能让我高兴一整天！

解决 (Goagent客户端 pac漏洞可被远程遍历目录及下载任意文件) 的漏洞

2014-12-03T18:06:00.000+08:00

今天看到网友爆出来goagent的漏洞,发现一招就解决了方法

把下面红色 0.0.0.0 改成 127.0.0.1就解决了问题
如果你说访问http://127.0.0.1:8086/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f/
还能打开,其实只把它改成127.0.0.1是只能在自己的电脑上访问这个网址,在别的电脑是无法访问的.
以下是代码
_______________________________________________________________________
[pac]
enable = 1
ip = 0.0.0.0
port = 8086
file = proxy.pac
admode = 1
adblock = https://easylist-downloads.adblockplus.org/easylistchina.txt
gfwlist = https://autoproxy-gfwlist.googlecode.com/svn/trunk/gfwlist.txt
expired = 86400
_______________________________________________________________________

您能浏览我的网站，能让我高兴一整天！

goagent看youtube速度慢出现黄字的解决方法

2014-11-29T13:56:00.000+08:00

google_hk = 216.58.220.110|216.58.217.112|64.233.166.143|74.125.202.19

[autorange]
threads = 4
maxsize = 1048576
waitsize = 524288
bufsize = 32768

Nginx上传文件出现413 Request Entity Too Large 错误解决方法

2014-07-08T14:34:00.000+08:00

重装vps后在恢复mysql数据库时上传数据库文件出现413错误

php上传限制修改
vi /etc/php5/fpm/php.ini
upload_max_filesize = 8M

打开 /etc/nginx/nginx.conf
在http://{ 下添加
lient_max_body_size 20m; ##可以根据自己的实际需要去定义上传附件的大小；

--
yiyi <hdp5252@gmail.com>

dnsforwarder 绿色免安装版下载

2014-07-03T12:53:00.002+08:00

前几天发个DNSCrypt来阻止国家防火墙的DSN解析攻击，但是很多网友说不稳定。今天我再发一个软件，我自认为很稳定。
软件主页 https://github.com/holmium/dnsforwarder
您可以下载我自用的绿色免安装版：
https://www.dropbox.com/s/4kn50fqkkkffbz8/dnsforwarder.7z
32/64位通用版

您能浏览我的网站，能让我高兴一整天！

DNSCrypt0.0.6绿色免安装版可以永久解决国家防火墙（GFW）dns污染问题

2014-06-25T10:17:00.003+08:00

有网友说dnscrypt有不稳定现象，本人测试中确实发现有时无法解析IP地址，建议使用 dnsforwarder 下载地址：http://hdp5252.blogspot.com/2014/07/dnsforwarder.html

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
只能永久解决dns污染问题，GFW的其它问题还需别的工具来解决。
解压到本地合适的位置，运行install.bat把程序注册成服务，程序自动设置本机dns为 127.0.0.1
卸载方法是运行uninstall.bat,然后删除文件夹即卸载。

文件下载地址放在dropbox，需翻墙下载。 https://www.dropbox.com/s/y9n2tdldm1f4ff6/DNSCrypt0.0.6.rar
您能浏览我的网站，能让我高兴一整天！

torbrowser-3.6.2_zh-CN 绿色版下载

2014-06-17T08:56:00.000+08:00

Tor项目宣布弃用obfs2。obfs2插件被用于混淆流量避开包检测，但由于中国利用主动探测技术成功屏蔽了obfs2，Tor项目决定抛弃obfs2，而obfs3也可以通过主动探测技术屏蔽，但中国目前尚未实现。Tor项目刚刚发布的Tor Browser Bundle 3.6就默认使用obfs3。开发者称，如果中国屏蔽了内置的网桥，用户可尝试通过分布式数据库BridgeDB获取更多网桥地址。开发者表示，他们目前正在开发新的插件obfs4。obfs4类似scramblesuit，网桥将使用随机密码保护。另一个新的流量混淆插件Meek将会模拟 Firefox浏览行为，使用第三方服务GAE作为代理，不需要输入网桥。

最新版tor 3.6.2 绿色软件下载https://www.dropbox.com/s/8tmm5yz6llvl0s7/torbrowser_3.6.2_zh-CN.zip
经测试，可以正常使用

您能浏览我的网站，能让我高兴一整天！

翻墙利器shadowsocks win免配置客户端

2014-06-14T13:50:00.000+08:00

我不是黑客，无法攻击GFW，只有翻墙方法一个。

https://www.dropbox.com/s/q8nidne5l8dmcu2/shadowsocks-local-win32-1.1.1.7z

浏览器设置代理端口1080.

您能浏览我的网站，能让我高兴一整天！

Google 全球 IP 地址库

2014-06-11T19:35:00.000+08:00

Google在测试自动驾驶汽车，推进全球上网，开发手机操作系统，提交内核补丁；我们则在这里苦苦寻找Google可用的IP
奉上google 所有IP
https://github.com/justjavac/Google-IPs
您能浏览我的网站，能让我高兴一整天！

在vps.me上搭建shadowsocks-libev

2014-06-10T16:10:00.002+08:00

大家都知道vps.me是一个免费的vps服务器，这里我就不讲怎么注册这个了，其实只有两个重要步骤，美国IP和美国电话。

如果你的vps安装的系统是debian 2.6.32
更新安装程序 sudo apt-get update&& sudo apt-get upgrade&&sudo apt-get install shadowsocks-libev libssl-dev

如果你的Vps系统是debian 8
运行 sh -c 'printf "deb http://httpredir.debian.org/debian jessie-backports main" > /etc/apt/sources.list.d/jessie-backports.list'
更新安装程序 apt-get update&apt-get -t jessie-backports install shadowsocks-libev

修改配置文件 sudo vi /etc/shadowsocks-libev/config.json 文件内容如下：

"server":"127.0.0.1",
"server_port":8388,
"local_port":1080,
"password":"barfoo!",
"timeout":60,
"method":null

只需把127.0.0.1 修改为0.0.0.0 保存退出。
运行 /etc/init.d/shadowsocks restart 重启。

登陆 vps.me点击IPv4 Mapping 打开ipv4转发，
添加一条规则名称随便，共享IP为你的vps的IP，源端口写一个没有用的端口，我这里用55532代替，目标端口写config.json里的“server_port”的端口，我这里是8388，协议为tcp，保存。服务器配置完成。

配置客户端也比较容易，下载程序，修改配置文件，服务器IP为你的vps的共享IP 端口为转发IP，我这里为55532，密码为config.json的password。

客户端程序下载地址

您可能想在vps上安装lnmp教程,
您能浏览我的网站，能让我高兴一整天！

linux 卸载软件包最好的方法

2014-06-04T19:42:00.000+08:00

以前卸载软件用了统配符，然后删掉了好多软件，只有一个桌面，输入法文件的关闭按钮都没有，最后只能重装系统。
后来就在网上找软件的卸载方法，很多都复杂，后来意外找到一个我个人感觉很好的方法，在这里记录下来。
先用dpkg -l|grep apache 查一下相关软件包然后dpkg -P 包名就卸载完成了。
或
apt-get autoremove 包名等同dpkg -r 包名
然后 find / -name apache2 查看apache文件夹删除

青莲

euserv安装openvpn

euserv访问ipv4

vps 安装aria2配置文件备份

Oracle Ubuntu ipv6 arm

FreeBSD12.1更换pkg，portsnap，ports，update源

debian 禁用默认服务

openvpn云免流之debian系统搭建全能云免服务器

openvpn云免流之squid3及防恶意扫描

把ca.crt证书放入client.ovpn配置文件

不用下载任何软件 用win7的vhd安装多系统

windows版googletalk 客户最好的替代产品

talkonaut用gmail帐号在国内无法登陆的解决方法

windows7 windows8 开启无线热点批处理单文件版

Gobi2000 电信EVDO有信号无法上网的解决方法

win8.1系统下3G无线上网卡无法修改DNS的解决方法

解决 (Goagent客户端 pac漏洞 可被远程遍历目录及下载任意文件) 的漏洞

goagent看youtube速度慢出现黄字的解决方法

Nginx上传文件出现413 Request Entity Too Large 错误解决方法

dnsforwarder 绿色免安装版下载

DNSCrypt0.0.6绿色免安装版可以永久解决国家防火墙（GFW）dns污染问题

torbrowser-3.6.2_zh-CN 绿色版下载

翻墙利器shadowsocks win免配置客户端

Google 全球 IP 地址库

在vps.me上搭建shadowsocks-libev

linux 卸载软件包最好的方法

不用下载任何软件用win7的vhd安装多系统

解决 (Goagent客户端 pac漏洞可被远程遍历目录及下载任意文件) 的漏洞