wstngfw中使用Viscosity连接OpenV-P-N服务器

wstngfw中使用Viscosity连接OpenV-P-N服务器

在本例中，将假设以下设置：

站点 A		站点 B
名称	Beijing Office（北京办公室）	名称	Shenzheng Office（深圳办公室）
WAN IP	192.168.10.46	WAN IP	192.168.20.46
LAN 子网	192.168.11.0/24	LAN 子网	192.168.21.0/24
LAN IP	192.168.11.6	LAN IP	192.168.21.6

注意：隧道网络填入的信息必须严格匹配网段，192.168.21.82/28 不符合要求，必须改为 192.168.21.80/28

1. 配置 Shenzheng的设备

a. 添加 openvpn 服务端

高级选项中的内容:   push "route 192.168.21.0 255.255.255.0";mute 10;comp-lzo;

b. 为要连接到服务器的每个设备生成客户端证书

>>> Installing pfSense-pkg-openvpn-client-export...
Updating pfSense-core repository catalogue...
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
pfSense repository is up to date.
All repositories are up to date.
The following 4 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
	pfSense-pkg-openvpn-client-export: 1.4.18_3 [pfSense]
	openvpn-client-export: 2.4.7 [pfSense]
	zip: 3.0_1 [pfSense]
	p7zip: 16.02_1 [pfSense]

Number of packages to be installed: 4

The process will require 18 MiB more space.
12 MiB to be downloaded.
[1/4] Fetching pfSense-pkg-openvpn-client-export-1.4.18_3.txz: ... done
[2/4] Fetching openvpn-client-export-2.4.7.txz: .......... done
[3/4] Fetching zip-3.0_1.txz: .......... done
[4/4] Fetching p7zip-16.02_1.txz: .......... done
Checking integrity... done (0 conflicting)
[1/4] Installing openvpn-client-export-2.4.7...
[1/4] Extracting openvpn-client-export-2.4.7: .......... done
[2/4] Installing zip-3.0_1...
[2/4] Extracting zip-3.0_1: .......... done
[3/4] Installing p7zip-16.02_1...
[3/4] Extracting p7zip-16.02_1: .......... done
[4/4] Installing pfSense-pkg-openvpn-client-export-1.4.18_3...
[4/4] Extracting pfSense-pkg-openvpn-client-export-1.4.18_3: .......... done
Saving updated package information...
done.
Loading package configuration... done.
Configuring package components...
Loading package instructions...
Custom commands...
Writing configuration... done.
>>> Cleaning up cache... done.
成功

c. 导出CA证书(Shenzheng-VPN-CA.crt)(但是不需要导出CA密钥)，导出客户端证书(Shenzheng-VPN-Client01.crt)和客户端密钥(Shenzheng-VPN-Client01.key)，
以及导出TLS密钥(Shenzheng-TLS-AUTH.key)

Shenzheng-VPN-config.conf 文件内容

#-- Config Auto Generated By HG-NGFW for Viscosity --#

#viscosity startonopen false
#viscosity dhcp true
#viscosity dnssupport true
#viscosity name VPNServer

dev tun
persist-tun
persist-key
cipher AES-256-CBC
auth SHA
tls-client
client
resolv-retry infinite
remote 192.168.20.46 1194 udp
verify-x509-name "Shenzheng-VPN-Server" name
auth-user-pass
remote-cert-tls server
compress lzo

ca Shenzheng-VPN-CA.crt
tls-auth Shenzheng-TLS-AUTH.key 1
cert Shenzheng-VPN-Client01.crt
key Shenzheng-VPN-Client01.key

2. 使用Beijing站点内网windows7系统测试隧道的连通性

a. 配置Viscosity客户端

故障日志：

======================= End