CentOS 8搭建ocserv服务
1.安装ocserv主程序
yum install ocserv -y
2.打开防火墙端口
在云服务器供应商那里打开443/tcp，80/tcp，4433/tcp，4433/udp，端口，并在CentOS系统里修改防火墙策略。其中443和80是https和http端口，4433是设定的ocserv监听端口
firewall-cmd --add-masquerade --per
firewall-cmd --zone=public --add-port=443/tcp --per
firewall-cmd --add-port=80/tcp --per
firewall-cmd --zone=public --add-port=4443/tcp --per
firewall-cmd --zone=public --add-port=4443/udp --per
firewall-cmd --reload
3.开启数据包内核转发
echo "net.ipv4.ip_forward = 1
net.ipv4.conf.all.proxy_arp = 1" >> /etc/sysctl.conf && sysctl -p
4.编辑ocserv配置文件
vim /etc/ocserv/ocserv.conf
直接用下面内容替代
采用账号密码方式认证
auth = "plain[passwd=/etc/ocserv/ocpasswd]"
设置服务器监听端口，默认的是443端口，但是会和https冲突，
可以设置成任意不冲突的端口
tcp-port = 4433
udp-port = 4433
程序以哪个用户和组运行
run-as-user = ocserv
run-as-group = ocserv
socket文件
socket-file = /var/run/ocserv.sock
默认证书配置
server-cert = /etc/pki/ocserv/public/server.crt
server-key = /etc/pki/ocserv/private/server.key
开启lz4压缩
compression = true
隔离工作，默认不动
isolate-workers = true
最大客户端数量，0表示无限数量
max-clients = 16
同一用户可以同时登陆的客户端数量
max-same-clients = 5
默认不动
rate-limit-ms = 100
服务器统计重置时间，不动
server-stats-reset-time = 604800
保持连接，每隔多少秒向客户端发送连接数据包，防止断线。
IOS系统5分钟会关闭后台数据通讯，然后就会断线。
因此将keepalive和mobile-dpd设置成200秒
keepalive = 200
dpd = 90
mobile-dpd = 200
udp端口无传输25秒后转成tcp端口
switch-to-tcp-timeout = 25
启用MTU转发以优化性能
try-mtu-discovery = true
空闲断开时间，如果想无限期连接，注释这两行
idle-timeout=1200
mobile-idle-timeout=2400
仅使用TLS1.2以上版本
cert-user-oid = 0.9.2342.19200300.100.1.1
tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA:-VERS-SSL3.0:-ARCFOUR-128:-VERS-TLS1.0:-VERS-TLS1.1"
认证超时时间
auth-timeout = 240
最小重新认证时间
min-reauth-time = 300
max-ban-score = 80
ban-reset-time = 1200
cookie-timeout = 324000
deny-roaming = false
rekey-time = 172800
rekey-method = ssl
use-occtl = true
pid-file = /var/run/ocserv.pid
device = vpns
predictable-ips = true
默认域名，修改为你的域名或ip地址，这个设置没有任何作用
default-domain = xxx.com:4433
配置自定义私有IP地址范围，注释默认的两行
ipv4-network = 192.168.1.0
ipv4-netmask = 255.255.255.0
ipv4-network = 10.70.25.0
ipv4-netmask = 255.255.255.0
以VPN隧道传输所有DNS查询
tunnel-all-dns = true
更改DNS服务器(国内服务器就填写国内dns)
dns = 8.8.8.8
dns = 1.1.1.1
允许思科客户端连接
cisco-client-compat = true
以下路由表不通过VPN隧道，直接本地网络连接
一定要添加自己服务器的ip地址，否则连上VPN后打不开自己的网站
no-route = x.x.x.x / 255.255.255.255
国内网站路由表请见文章最后
5.设置SSL证书
ocserv使用的是SSL加密方式，可以选择不添加证书，但是客户端每次连接都会提示服务器不安全。SSL证书可以在云服务器供应商那里免费申请（有效期1年，到期后重新免费申请）。
申请证书后，下载apache使用格式的，含有3个有用的文件：
xxx.com.crt，xxx.com.key，root_bundle.crt
将xxx.com.crt重命名为server.crt，root_bundle.crt重命名为ca.crt，xxx.com.key复制为两份，分别重命名为server.key和ca.key。
server.crt 拷贝至 /etc/pki/ocserv/public/
ca.crt 拷贝至 /etc/pki/ocserv/cacerts/
server.key和ca.key 拷贝至 /etc/pki/ocserv/private/
6.重启服务，并设置开机启动
systemctl restart ocserv
systemctl enable ocserv
7.创建客户端账号
ocpasswd -c /etc/ocserv/ocpasswd xxx
会提示输入两次密码
删除客户端账户可以直接在/etc/ocserv/ocpasswd文件删除对应的行
查看目前在线的客户端
occtl show users
8.客户端软件
安卓和苹果手机及平板，可在应用商店下载到思科的anyconnect。
Windows、Linux、Mac可以使用思科的anyconnect电脑版，
或者开源的OpenConnect软件：
https://github.com/openconnect/openconnect-gui/releases
9.国内网站路由表
不是非常全，全部国内网站路由表有6000多条，但是Windows版客户端最多只能识别2500条，手机版客户端能识别多少还没测试过。这里提供的190多条，勉强满足日常使用。
此外个路由表可能有bug，目前发现的就有把Instagram的照片全部no-route了，不过已经修改了。
设置no-route主要是因为大陆外服务器访问国内网站，再回程到国内客户端延迟非常严重，而且也会消耗不必要的流量，阻塞带宽，因此把国内网站排除到VPN隧道外面，直接使用本地网络访问。
把下面的路由表直接复制粘贴到/etc/ocserv/ocserv.conf文件的最后
no-route = 0.0.0.0/255.0.0.0
no-route = 1.0.0.0/255.128.0.0
no-route = 1.160.0.0/255.224.0.0
no-route = 1.192.0.0/255.224.0.0
no-route = 10.0.0.0/255.0.0.0
no-route = 14.0.0.0/255.224.0.0
no-route = 14.96.0.0/255.224.0.0
no-route = 14.128.0.0/255.224.0.0
no-route = 14.192.0.0/255.224.0.0
no-route = 14.208.0.0/255.240.0.0
no-route = 27.0.0.0/255.192.0.0
no-route = 27.96.0.0/255.224.0.0
no-route = 27.128.0.0/255.128.0.0
no-route = 36.0.0.0/255.192.0.0
no-route = 36.96.0.0/255.224.0.0
no-route = 36.128.0.0/255.128.0.0
no-route = 39.0.0.0/255.224.0.0
no-route = 39.64.0.0/255.192.0.0
no-route = 39.128.0.0/255.192.0.0
no-route = 42.0.0.0/255.0.0.0
no-route = 43.224.0.0/255.224.0.0
no-route = 45.64.0.0/255.192.0.0
no-route = 47.64.0.0/255.192.0.0
no-route = 49.0.0.0/255.128.0.0
no-route = 49.128.0.0/255.224.0.0
no-route = 49.192.0.0/255.192.0.0
no-route = 54.192.0.0/255.224.0.0
no-route = 58.0.0.0/255.128.0.0
no-route = 58.128.0.0/255.224.0.0
no-route = 58.192.0.0/255.192.0.0
no-route = 59.32.0.0/255.224.0.0
no-route = 59.64.0.0/255.192.0.0
no-route = 59.128.0.0/255.128.0.0
no-route = 60.0.0.0/255.192.0.0
no-route = 60.160.0.0/255.224.0.0
no-route = 60.192.0.0/255.192.0.0
no-route = 61.0.0.0/255.192.0.0
no-route = 61.64.0.0/255.224.0.0
no-route = 61.128.0.0/255.192.0.0
no-route = 61.224.0.0/255.224.0.0
no-route = 100.64.0.0/255.192.0.0
no-route = 101.0.0.0/255.128.0.0
no-route = 101.128.0.0/255.224.0.0
no-route = 101.192.0.0/255.192.0.0
no-route = 103.0.0.0/255.192.0.0
no-route = 103.224.0.0/255.224.0.0
no-route = 106.0.0.0/255.128.0.0
no-route = 106.224.0.0/255.224.0.0
no-route = 110.0.0.0/254.0.0.0
no-route = 112.0.0.0/255.128.0.0
no-route = 112.128.0.0/255.224.0.0
no-route = 112.192.0.0/255.192.0.0
no-route = 113.0.0.0/255.128.0.0
no-route = 113.128.0.0/255.224.0.0
no-route = 113.192.0.0/255.192.0.0
no-route = 114.0.0.0/255.128.0.0
no-route = 114.128.0.0/255.224.0.0
no-route = 114.192.0.0/255.192.0.0
no-route = 115.0.0.0/255.0.0.0
no-route = 116.0.0.0/255.0.0.0
no-route = 117.0.0.0/255.128.0.0
no-route = 117.128.0.0/255.192.0.0
no-route = 118.0.0.0/255.224.0.0
no-route = 118.64.0.0/255.192.0.0
no-route = 118.128.0.0/255.128.0.0
no-route = 119.0.0.0/255.128.0.0
no-route = 119.128.0.0/255.192.0.0
no-route = 119.224.0.0/255.224.0.0
no-route = 120.0.0.0/255.192.0.0
no-route = 120.64.0.0/255.224.0.0
no-route = 120.128.0.0/255.224.0.0
no-route = 120.192.0.0/255.192.0.0
no-route = 121.0.0.0/255.128.0.0
no-route = 121.192.0.0/255.192.0.0
no-route = 122.0.0.0/254.0.0.0
no-route = 124.0.0.0/255.0.0.0
no-route = 125.0.0.0/255.128.0.0
no-route = 125.160.0.0/255.224.0.0
no-route = 125.192.0.0/255.192.0.0
no-route = 127.0.0.0/255.0.0.0
no-route = 139.0.0.0/255.224.0.0
no-route = 139.128.0.0/255.128.0.0
no-route = 140.64.0.0/255.224.0.0
no-route = 140.128.0.0/255.224.0.0
no-route = 140.192.0.0/255.192.0.0
no-route = 144.0.0.0/255.192.0.0
no-route = 144.96.0.0/255.224.0.0
no-route = 144.224.0.0/255.224.0.0
no-route = 150.0.0.0/255.224.0.0
no-route = 150.96.0.0/255.224.0.0
no-route = 150.128.0.0/255.224.0.0
no-route = 150.192.0.0/255.192.0.0
no-route = 152.96.0.0/255.224.0.0
no-route = 153.0.0.0/255.192.0.0
no-route = 153.96.0.0/255.224.0.0
no-route = 157.0.0.0/255.192.0.0
no-route = 157.96.0.0/255.224.0.0
no-route = 157.128.0.0/255.224.0.0
no-route = 157.224.0.0/255.248.0.0
no-route = 159.224.0.0/255.224.0.0
no-route = 161.192.0.0/255.224.0.0
no-route = 162.96.0.0/255.224.0.0
no-route = 163.0.0.0/255.192.0.0
no-route = 163.96.0.0/255.224.0.0
no-route = 163.128.0.0/255.192.0.0
no-route = 163.192.0.0/255.224.0.0
no-route = 166.96.0.0/255.224.0.0
no-route = 167.128.0.0/255.192.0.0
no-route = 168.160.0.0/255.224.0.0
no-route = 169.254.0.0/255.255.0.0
no-route = 171.0.0.0/255.128.0.0
no-route = 171.192.0.0/255.224.0.0
no-route = 172.16.0.0/255.240.0.0
no-route = 175.0.0.0/255.128.0.0
no-route = 175.128.0.0/255.192.0.0
no-route = 180.64.0.0/255.192.0.0
no-route = 180.128.0.0/255.128.0.0
no-route = 182.0.0.0/255.0.0.0
no-route = 183.0.0.0/255.192.0.0
no-route = 183.64.0.0/255.224.0.0
no-route = 183.128.0.0/255.128.0.0
no-route = 192.0.0.0/255.255.255.0
no-route = 192.0.2.0/255.255.255.0
no-route = 192.88.99.0/255.255.255.0
no-route = 192.96.0.0/255.224.0.0
no-route = 192.160.0.0/255.248.0.0
no-route = 192.168.0.0/255.255.0.0
no-route = 192.169.0.0/255.255.0.0
no-route = 192.170.0.0/255.254.0.0
no-route = 192.172.0.0/255.252.0.0
no-route = 192.176.0.0/255.240.0.0
no-route = 198.18.0.0/255.254.0.0
no-route = 198.51.100.0/255.255.255.0
no-route = 202.0.0.0/255.128.0.0
no-route = 202.128.0.0/255.192.0.0
no-route = 202.192.0.0/255.224.0.0
no-route = 203.0.0.0/255.128.0.0
no-route = 203.128.0.0/255.192.0.0
no-route = 203.192.0.0/255.224.0.0
no-route = 210.0.0.0/255.192.0.0
no-route = 210.64.0.0/255.224.0.0
no-route = 210.160.0.0/255.224.0.0
no-route = 210.192.0.0/255.224.0.0
no-route = 211.64.0.0/255.192.0.0
no-route = 211.128.0.0/255.192.0.0
no-route = 218.0.0.0/255.128.0.0
no-route = 218.160.0.0/255.224.0.0
no-route = 218.192.0.0/255.192.0.0
no-route = 219.64.0.0/255.224.0.0
no-route = 219.128.0.0/255.224.0.0
no-route = 219.192.0.0/255.192.0.0
no-route = 220.96.0.0/255.224.0.0
no-route = 220.128.0.0/255.128.0.0
no-route = 221.0.0.0/255.224.0.0
no-route = 221.96.0.0/255.224.0.0
no-route = 221.128.0.0/255.128.0.0
no-route = 222.0.0.0/255.0.0.0
no-route = 223.0.0.0/255.224.0.0
no-route = 223.64.0.0/255.192.0.0
no-route = 223.128.0.0/255.128.0.0
no-route = 224.0.0.0/224.0.0.0
重启ocserv服务
systemctl restart ocserv
本文系作者 @Leo 原创发布在开封菜博客站点。未经许可，禁止转载。
评论