vpn
installsforks
How to install vpn?
chaterm/terminal-skills/vpn
$npx -y skills add chaterm/terminal-skills --skill vpnVPN 配置与管理
SKILL.md
| 1 | # VPN 配置与管理 |
| 2 | |
| 3 | ## 概述 |
| 4 | OpenVPN、WireGuard、IPSec VPN 配置与管理技能。 |
| 5 | |
| 6 | ## WireGuard |
| 7 | |
| 8 | ### 安装 |
| 9 | ```bash |
| 10 | # Debian/Ubuntu |
| 11 | apt install wireguard |
| 12 | |
| 13 | # CentOS/RHEL |
| 14 | yum install epel-release elrepo-release |
| 15 | yum install kmod-wireguard wireguard-tools |
| 16 | |
| 17 | # 验证安装 |
| 18 | wg --version |
| 19 | ``` |
| 20 | |
| 21 | ### 生成密钥 |
| 22 | ```bash |
| 23 | # 生成私钥 |
| 24 | wg genkey > privatekey |
| 25 | |
| 26 | # 从私钥生成公钥 |
| 27 | wg pubkey < privatekey > publickey |
| 28 | |
| 29 | # 一步生成 |
| 30 | wg genkey | tee privatekey | wg pubkey > publickey |
| 31 | |
| 32 | # 生成预共享密钥（可选，增强安全） |
| 33 | wg genpsk > presharedkey |
| 34 | ``` |
| 35 | |
| 36 | ### 服务端配置 |
| 37 | ```bash |
| 38 | # /etc/wireguard/wg0.conf |
| 39 | [Interface] |
| 40 | Address = 10.0.0.1/24 |
| 41 | ListenPort = 51820 |
| 42 | PrivateKey = <server_private_key> |
| 43 | |
| 44 | # 启用 IP 转发 |
| 45 | PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE |
| 46 | PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE |
| 47 | |
| 48 | [Peer] |
| 49 | PublicKey = <client_public_key> |
| 50 | AllowedIPs = 10.0.0.2/32 |
| 51 | ``` |
| 52 | |
| 53 | ### 客户端配置 |
| 54 | ```bash |
| 55 | # /etc/wireguard/wg0.conf |
| 56 | [Interface] |
| 57 | Address = 10.0.0.2/24 |
| 58 | PrivateKey = <client_private_key> |
| 59 | DNS = 8.8.8.8 |
| 60 | |
| 61 | [Peer] |
| 62 | PublicKey = <server_public_key> |
| 63 | Endpoint = server.example.com:51820 |
| 64 | AllowedIPs = 0.0.0.0/0 |
| 65 | PersistentKeepalive = 25 |
| 66 | ``` |
| 67 | |
| 68 | ### 管理命令 |
| 69 | ```bash |
| 70 | # 启动 |
| 71 | wg-quick up wg0 |
| 72 | systemctl start wg-quick@wg0 |
| 73 | |
| 74 | # 停止 |
| 75 | wg-quick down wg0 |
| 76 | systemctl stop wg-quick@wg0 |
| 77 | |
| 78 | # 开机启动 |
| 79 | systemctl enable wg-quick@wg0 |
| 80 | |
| 81 | # 查看状态 |
| 82 | wg show |
| 83 | wg show wg0 |
| 84 | |
| 85 | # 添加 peer |
| 86 | wg set wg0 peer <public_key> allowed-ips 10.0.0.3/32 |
| 87 | ``` |
| 88 | |
| 89 | ## OpenVPN |
| 90 | |
| 91 | ### 安装 |
| 92 | ```bash |
| 93 | # Debian/Ubuntu |
| 94 | apt install openvpn easy-rsa |
| 95 | |
| 96 | # CentOS/RHEL |
| 97 | yum install epel-release |
| 98 | yum install openvpn easy-rsa |
| 99 | ``` |
| 100 | |
| 101 | ### 初始化 PKI |
| 102 | ```bash |
| 103 | # 创建 CA 目录 |
| 104 | make-cadir ~/openvpn-ca |
| 105 | cd ~/openvpn-ca |
| 106 | |
| 107 | # 初始化 PKI |
| 108 | ./easyrsa init-pki |
| 109 | |
| 110 | # 创建 CA |
| 111 | ./easyrsa build-ca nopass |
| 112 | |
| 113 | # 生成服务器证书 |
| 114 | ./easyrsa gen-req server nopass |
| 115 | ./easyrsa sign-req server server |
| 116 | |
| 117 | # 生成 DH 参数 |
| 118 | ./easyrsa gen-dh |
| 119 | |
| 120 | # 生成 TLS 密钥 |
| 121 | openvpn --genkey secret ta.key |
| 122 | |
| 123 | # 生成客户端证书 |
| 124 | ./easyrsa gen-req client1 nopass |
| 125 | ./easyrsa sign-req client client1 |
| 126 | ``` |
| 127 | |
| 128 | ### 服务端配置 |
| 129 | ```bash |
| 130 | # /etc/openvpn/server.conf |
| 131 | port 1194 |
| 132 | proto udp |
| 133 | dev tun |
| 134 | |
| 135 | ca ca.crt |
| 136 | cert server.crt |
| 137 | key server.key |
| 138 | dh dh.pem |
| 139 | tls-auth ta.key 0 |
| 140 | |
| 141 | server 10.8.0.0 255.255.255.0 |
| 142 | ifconfig-pool-persist ipp.txt |
| 143 | |
| 144 | push "redirect-gateway def1 bypass-dhcp" |
| 145 | push "dhcp-option DNS 8.8.8.8" |
| 146 | push "dhcp-option DNS 8.8.4.4" |
| 147 | |
| 148 | keepalive 10 120 |
| 149 | cipher AES-256-GCM |
| 150 | auth SHA256 |
| 151 | |
| 152 | user nobody |
| 153 | group nogroup |
| 154 | persist-key |
| 155 | persist-tun |
| 156 | |
| 157 | status /var/log/openvpn-status.log |
| 158 | log-append /var/log/openvpn.log |
| 159 | verb 3 |
| 160 | ``` |
| 161 | |
| 162 | ### 客户端配置 |
| 163 | ```bash |
| 164 | # client.ovpn |
| 165 | client |
| 166 | dev tun |
| 167 | proto udp |
| 168 | remote server.example.com 1194 |
| 169 | resolv-retry infinite |
| 170 | nobind |
| 171 | |
| 172 | persist-key |
| 173 | persist-tun |
| 174 | |
| 175 | ca ca.crt |
| 176 | cert client1.crt |
| 177 | key client1.key |
| 178 | tls-auth ta.key 1 |
| 179 | |
| 180 | cipher AES-256-GCM |
| 181 | auth SHA256 |
| 182 | verb 3 |
| 183 | ``` |
| 184 | |
| 185 | ### 管理命令 |
| 186 | ```bash |
| 187 | # 启动服务 |
| 188 | systemctl start openvpn@server |
| 189 | systemctl enable openvpn@server |
| 190 | |
| 191 | # 查看状态 |
| 192 | systemctl status openvpn@server |
| 193 | |
| 194 | # 查看连接 |
| 195 | cat /var/log/openvpn-status.log |
| 196 | |
| 197 | # 吊销证书 |
| 198 | cd ~/openvpn-ca |
| 199 | ./easyrsa revoke client1 |
| 200 | ./easyrsa gen-crl |
| 201 | ``` |
| 202 | |
| 203 | ## IPSec (strongSwan) |
| 204 | |
| 205 | ### 安装 |
| 206 | ```bash |
| 207 | # Debian/Ubuntu |
| 208 | apt install strongswan strongswan-pki |
| 209 | |
| 210 | # CentOS/RHEL |
| 211 | yum install strongswan |
| 212 | ``` |
| 213 | |
| 214 | ### 生成证书 |
| 215 | ```bash |
| 216 | # 生成 CA |
| 217 | ipsec pki --gen --type rsa --size 4096 --outform pem > ca-key.pem |
| 218 | ipsec pki --self --ca --lifetime 3650 \ |
| 219 | --in ca-key.pem --type rsa \ |
| 220 | --dn "CN=VPN CA" \ |
| 221 | --outform pem > ca-cert.pem |
| 222 | |
| 223 | # 生成服务器证书 |
| 224 | ipsec pki --gen --type rsa --size 4096 --outform pem > server-key.pem |
| 225 | ipsec pki --pub --in server-key.pem --type rsa | \ |
| 226 | ipsec pki --issue --lifetime 1825 \ |
| 227 | --cacert ca-cert.pem --cakey ca-key.pem \ |
| 228 | --dn "CN=vpn.example.com" \ |
| 229 | --san vpn.example.com \ |
| 230 | --flag serverAuth --flag ikeIntermediate \ |
| 231 | --outform pem > server-cert.pem |
| 232 | ``` |
| 233 | |
| 234 | ### 服务端配置 |
| 235 | ```bash |
| 236 | # /etc/ipsec.conf |
| 237 | config setup |
| 238 | charondebug="ike 2, knl 2, cfg 2" |
| 239 | uniqueids=no |
| 240 | |
| 241 | conn ikev2-vpn |
| 242 | auto=add |
| 243 | compress=no |
| 244 | type=tunnel |
| 245 | keyexchange=ikev2 |
| 246 | fragmentation=yes |
| 247 | forceencaps=yes |
| 248 | |
| 249 | dpdaction=clear |
| 250 | dpddelay=300s |
| 251 | rekey=no |
| 252 | |
| 253 | left=%any |
| 254 | leftid=@vpn.example.com |
| 255 | leftcert=server-cert.pem |
| 256 | leftsendcert=always |
| 257 | leftsubnet=0.0.0.0/0 |
| 258 | |
| 259 | right=%any |
| 260 | rightid=%any |
| 261 | rightauth=eap-mschapv2 |
| 262 | rightsourceip=10.10.10.0/24 |
| 263 | rightdns=8.8.8.8,8.8.4.4 |
| 264 | rightsendcert=never |
| 265 | |
| 266 | eap_identity=%identity |
| 267 | ``` |
| 268 | |
| 269 | ### 用户配置 |
| 270 | ```bash |
| 271 | # /etc/ipsec.secrets |
| 272 | : RSA "server-key.pem" |
| 273 | user1 : EAP "password1" |
| 274 | user2 : EAP "password2" |
| 275 | ``` |
| 276 | |
| 277 | ### 管理命令 |
| 278 | ```bash |
| 279 | # 启动 |
| 280 | systemctl start strongswan |
| 281 | systemctl enable strongswan |
| 282 | |
| 283 | # 重载配置 |
| 284 | ipsec reload |
| 285 | ipsec rereadall |
| 286 | |
| 287 | # 查看状态 |
| 288 | ipsec statusall |
| 289 | ipsec status |
| 290 | |
| 291 | # 查看 SA |
| 292 | ipsec listall |
| 293 | ``` |
| 294 | |
| 295 | ## 常见场景 |
| 296 | |
| 297 | ### 场景 1：WireGuard 站点到站点 |
| 298 | ```bash |
| 299 | # 站点 A 配置 |
| 300 | [Interface] |
| 301 | Address = 10.0.0.1/24 |
| 302 | PrivateKey = <site_a_private> |
| 303 | ListenPort = 51820 |
| 304 | |
| 305 | [Peer] |
| 306 | PublicKey = <site_b_public> |
| 307 | Endpoint = site-b.example.com:51820 |
| 308 | AllowedIPs = 10.0.0.2/32, 192.168.2.0/24 |
| 309 | |
| 310 | # 站点 B 配置 |
| 311 | [Interface] |
| 312 | Address = 10.0.0.2/24 |
| 313 | PrivateKey = <site_b_private> |
| 314 | ListenPort = 51820 |
| 315 | |
| 316 | [Peer] |
| 317 | PublicKey = <site_a_public> |
| 318 | Endpoint = site-a. |
People who liked this also viewed
6 picksType
- microsoft-foundryDeploy, evaluate, fine-tune, and manage Foundry agents end-to-end with azd: hosted agent scaffold/run/deploy, prompt agent create, batch eval, continuous eval, prompt optimizer, Agent Optimizer scaffoSkillsJul 2026
- azure-deployExecute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application SkillsJul 2026
- azure-preparePrepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wSkillsJul 2026
- azure-validate--- name: azure-validate description: "Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity pSkillsJul 2026
- azure-aigatewayConfigure Azure API Management as an AI Gateway for AI models, MCP tools, and agents. WHEN: semantic caching, token limit, content safety, load balancing, AI model governance, MCP rate limiting, jailbSkillsJul 2026
- azure-hosted-copilot-sdkOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
