一、OpenVPN是靠虛擬的TUN/TAP裝置實現SSL VPN的，因此核心必須支援TUN/TAP裝置模組，這個配置選項在2.6.x核心中，位於Device Drivers ->Network device support 選單中，全稱是Universal TUN/TAP device driver support ，通常在標準核心 中，會以模組方式提供，在Open VPN啟動時，它會自動載入此模組，因此不需要手工載入此模組。
[[email protected] 2.6.18-238.12.1.el5-i686]# pwd
/usr/src/kernels/2.6.18-238.12.1.el5-i686
[

二、在安裝OpenVPN之前，還需要安裝一些支援包，包括OpenSSL開發庫和LZO壓縮開發庫
1、可使用yum安裝OpenSSL開發庫，但需要手工下載並安裝LZO開發包。

2、可到 http://www.oberhumer.com/opensource/lzo/ 下載LZO
[[email protected] src]#tar zxvf lzo-2.03.tar.gz 
[[email protected] src]#cd lzo-2.03
[[email protected] lzo-2.03]#./configure
[[email protected]

三、配置SSL VPN服務
1、到 http://openvpn.net/release/ 下載openvpn-2.0.9.tar.gz並安裝
[[email protected] src]# tar zxvf openvpn-2.0.9.tar.gz 
[[email protected] src]# cd openvpn-2.0.9/
[[email protected] openvpn-2.0.9]# ./configure
[[email protected] openvpn-2.0.9]# make
[[email protected] openvpn-2.0.9]# make install
[[email protected] openvpn-2.0.9]# cp -p sample-scripts/openvpn.init /etc/init.d/openvpn
[[email protected] openvpn-2.0.9]# chkconfig --add openvpn
[[email protected] openvpn-2.0.9]# service openvpn status #檢視服務狀態
openvpn: service not started
[[email protected] openvpn-2.0.9]# chkconfig --level 235 openvpn on 
[[email protected] openvpn-2.0.9]# chkconfig --list openvpn
openvpn 0:off 1:off 2:on 3:on 4:on 5:on 6:off

2、開啟IP轉發功能
[[email protected] openvpn-2.0.9]# vi /etc/sysctl.conf
net.ipv4.ip_forward = 1
[[email protected] openvpn-2.0.9]# sysctl -p
3、定義OpenVPN的配置目錄為/etc/openvpn，把伺服器配置檔案定義為/etc/openvpn/server.conf
OpenVPN是一個SSL VPN實現，因此，認證中最重要的是伺服器和客戶端的SSL證書管理，如果管理員之前沒有SSL證書釋出機制，那麼可以使用OpenVPN附帶的一組工具來完成所有的工作。
在/usr/src/openvpn-2.0.9/中，有一個easy-rsa目錄，這下面就是一些一成和管理SSL證書的工具，以下為生成證書操作。
[[email protected] openvpn-2.0.9]# mkdir -p /etc/openvpn
[[email protected] openvpn-2.0.9]# cp -p sample-config-files/server.conf /etc/openvpn/#將樣本配置檔案複製到/etc/openvpn/，後面再做修改

4、修改vars檔案變數，設定國家程式碼、省份、地市、機構名單、單位名稱郵件等
[[email protected] openvpn-2.0.9]# cd easy-rsa/
[[email protected] easy-rsa]# grep -v "#" vars 
export D=`pwd`
export KEY_CONFIG=$D/openssl.cnf
export KEY_DIR=$D/keys
echo NOTE: when you run ./clean-all, I will be doing a rm -rf on $KEY_DIR
export KEY_SIZE=1024
export KEY_COUNTRY=CN
export KEY_PROVINCE=GD
export KEY_CITY=SZ
export KEY_ORG="DIC"
export KEY_EMAIL="[email protected]"
[[email protected] easy-rsa]# source vars
NOTE: when you run ./clean-all, I will be doing a rm -rf on /usr/src/openvpn-2.0.9/easy-rsa/keys#提示可使用./clean-all清除所有包括CA在內的所有證書

5、使用clean-all指令碼清除包括CA在內的所有證書，再建立CA證書。
[[email protected] easy-rsa]# ./clean-all #先清除證書，再建立證書
[[email protected] easy-rsa]# ./build-ca #建立CA證書
Generating a 1024 bit RSA private key
..........++++++
................++++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [GD]:
Locality Name (eg, city) [SZ]:
Organization Name (eg, company) [DIC]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:dic172#伺服器主機名
Email Address [[email protected]]:

6、建立伺服器金鑰。
[[email protected] easy-rsa]# ./build-key-server server #建立伺服器端金鑰
Generating a 1024 bit RSA private key
............................................++++++
....++++++
writing new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [GD]:
Locality Name (eg, city) [SZ]:
Organization Name (eg, company) [DIC]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:dic172#伺服器主機名
Email Address [[email protected]]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:dic172
An optional company name []:dic172
Using configuration from /usr/src/openvpn-2.0.9/easy-rsa/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'CN'
stateOrProvinceName :PRINTABLE:'GD'
localityName :PRINTABLE:'SZ'
organizationName :PRINTABLE:'DIC'
commonName :PRINTABLE:'dic172'
emailAddress :IA5STRING:'[email protected]'
Certificate is to be certified until Jul 16 05:51:08 2021 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
7、建立客戶端金鑰，客戶端金鑰名可隨意命名。
[[email protected] easy-rsa]# ./build-key client
Generating a 1024 bit RSA private key
.....++++++
.......................++++++
writing new private key to 'client.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [GD]:
Locality Name (eg, city) [SZ]:
Organization Name (eg, company) [DIC]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:tgh #不同客戶端，命名絕不能一樣
Email Address [[email protected]]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:dic172
An optional company name []:dic172
Using configuration from /usr/src/openvpn-2.0.9/easy-rsa/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'CN'
stateOrProvinceName :PRINTABLE:'GD'
localityName :PRINTABLE:'SZ'
organizationName :PRINTABLE:'DIC'
commonName :PRINTABLE:'tgh'
emailAddress :IA5STRING:'[email protected]'
Certificate is to be certified until Jul 16 05:52:27 2021 GMT (3650 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

8、建立dhDiffie-Hellman ）金鑰演算法檔案
[[email protected] easy-rsa]# ./build-dh 
Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time
...+.......+.....+........................+......................+.....+...........................+..........+.......+.................................................+.....................+............+..............................................+..........................................................+..............................+...........................+..+.....+......++*++*++*

9、生成 tls-auth 金鑰 ，tls-auth金鑰可以為點對點的VPN連線提供了進一步的安全驗證，如果選擇使用這一方式，伺服器端和客戶端都必須擁有該金鑰檔案。 
[[email protected] easy-rsa]# openvpn --genkey --secret keys/ta.key 
[[email protected] easy-rsa]# cp -rp keys/ /etc/openvpn/ #將證書檔案複製到/etc/openvpn/

10、修改server.conf配置檔案
[[email protected] openvpn]# grep -v "#" server.conf

local 192.168.161.172 #伺服器所使用的IP
port 1194 #使用1194埠 埠需要修改
proto udp #使用UDP協議 可同時使用TCP UDP 搭建多程序ssl-VPN服務
dev tun #使用tun裝置
ca /etc/openvpn/keys/ca.crt #指定CA證書檔案路徑
cert /etc/openvpn/keys/server.crt
dh /etc/openvpn/keys/dh1024.pem
tls-auth /etc/openvpn/keys/ta.key 0
server 172.16.10.0 255.255.255.0 #VPN客戶端撥入後，所獲得的IP地址池
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 202.96.134.133" #客戶端所獲得的DNS
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
mute 20

[[email protected] openvpn-2.0.9]# service openvpn start
Starting openvpn: [ OK ]
[[email protected] openvpn-2.0.9]# netstat -anp |grep :1194
udp 0 0 192.168.161.172:1194 0.0.0.0:* 25162/openvpn

四、在XP客戶端配置SSL VPN（客戶端IP 192.168.163.96）
1、到http://openvpn.se/files/install_packages/下載openvpn-2.0.9-gui-1.0.3-install.exe
2、安裝openvpn-2.0.9-gui-1.0.3-install.exe，一路next。由於只是做客戶端使用，不必安裝OpenVPN Service

安裝完成後，在工作列會新增加一個OpenVPN GUI和本地連線圖示。

3、配置客戶端，把伺服器上/etc/openvpn/keys/ca.*,client.*,ta.* 複製客戶端C:\Program Files\OpenVPN\config下；再從C:\Program Files\OpenVPN\sample-config複製一個客戶端配置樣本檔案client.ovpn到C:\Program Files\OpenVPN\config下。

4、修改client.ovpn檔案如下並儲存。
client
dev tun
proto udp #proto tcp
remote 192.168.161.172 1194
resolv-retry infinite
nobind
ca ca.crt
cert client.crt
key client.key
tls-auth ta.key 1
comp-lzo
verb 3
mute 20
5、啟動連線。右擊右下角的OpenVPN GUI圖示，連線

6、連線成功後，圖示如下。到此，SSL VPN服務就配置好了。