🔑 OpenVPN

$ sudo apt update && sudo apt install -y openvpn easy-rsa

$ make-cadir ~/openvpn-ca && cd ~/openvpn-ca

# 初始化 PKI
./easyrsa init-pki

# 建立 CA（憑證頒發機構）
./easyrsa build-ca nopass

# 產生伺服器憑證
./easyrsa gen-req server nopass
./easyrsa sign-req server server

# 產生 Diffie-Hellman 參數（耗時較長）
./easyrsa gen-dh

# 產生 TLS 認證 key
openvpn --genkey secret ta.key

# 產生客戶端憑證
./easyrsa gen-req client1 nopass
./easyrsa sign-req client client1

$ # 複製伺服器所需的檔案
sudo cp pki/ca.crt pki/issued/server.crt pki/private/server.key \
       pki/dh.pem ta.key /etc/openvpn/server/

port 1194
proto udp
dev tun

ca   ca.crt
cert server.crt
key  server.key
dh   dh.pem

tls-auth ta.key 0
cipher AES-256-GCM
auth SHA256

server 10.8.0.0 255.255.255.0   # VPN 子網段
ifconfig-pool-persist /var/log/openvpn/ipp.txt

# 讓客戶端的所有流量通過 VPN
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 8.8.8.8"

keepalive 10 120
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
verb 3

$ # 開啟 IP 轉發與防火牆
echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf && sudo sysctl -p
sudo ufw allow 1194/udp
sudo systemctl enable --now openvpn-server@server

client
dev tun
proto udp
remote 你的伺服器IP 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-GCM
auth SHA256
verb 3
key-direction 1

# 將憑證內容嵌入（方便單檔分發）
<ca>
# ca.crt 的內容
</ca>
<cert>
# client1.crt 的內容
</cert>
<key>
# client1.key 的內容
</key>
<tls-auth>
# ta.key 的內容
</tls-auth>