服务器端
#################################################
# Sample OpenVPN 2.6 config file for #
# multi-client server. #
# #
# This file is for the server side #
# of a many-clients <-> one-server #
# OpenVPN configuration. #
# #
# OpenVPN also supports #
# single-machine <-> single-machine #
# configurations (See the Examples page #
# on the web site for more info). #
# #
# This config should work on Windows #
# or Linux/BSD systems. Remember on #
# Windows to quote pathnames and use #
# double backslashes, e.g.: #
# "C:\\Program Files\\OpenVPN\\config\\foo.key" #
# #
# Comments are preceded with '#' or ';' #
#################################################
#################################################
# OpenVPN 2.6 多客户端服务器示例配置文件
#
# 此文件用于多客户端对一服务器的 OpenVPN 配置的服务器端
#
# OpenVPN 也支持单机对单机的配置（更多信息请参阅网站上的示例页面）
#
# 此配置适用于 Windows 或 Linux/BSD 系统。
# 在 Windows 上请记得用引号括住路径并使用双反斜杠，
# 例如："C:\\Program Files\\OpenVPN\\config\\foo.key"
#
# 注释以 '#' 或 ';' 开头
#################################################
# Which local IP address should OpenVPN
# listen on? (optional)
#
# OpenVPN 应该监听哪个本地 IP 地址？（可选）
;local a.b.c.d
# Which TCP/UDP port should OpenVPN listen on?
# If you want to run multiple OpenVPN instances
# on the same machine, use a different port
# number for each one. You will need to
# open up this port on your firewall.
#
# OpenVPN 应该监听哪个 TCP/UDP 端口？
# 如果你想在同一台机器上运行多个 OpenVPN 实例，请为每个实例使用不同的端口号。
# 你需要在防火墙上开放此端口。
port 1194
# TCP or UDP server?
#
# TCP 还是 UDP 服务器？
;proto tcp
proto udp
# "dev tun" will create a routed IP tunnel,
# "dev tap" will create an ethernet tunnel.
# Use "dev tap0" if you are ethernet bridging
# and have precreated a tap0 virtual interface
# and bridged it with your ethernet interface.
# If you want to control access policies
# over the VPN, you must create firewall
# rules for the TUN/TAP interface.
# On non-Windows systems, you can give
# an explicit unit number, such as tun0.
# On Windows, use "dev-node" for this.
# On most systems, the VPN will not function
# unless you partially or fully disable/open
# the firewall for the TUN/TAP interface.
#
# "dev tun" 将创建一个路由 IP 隧道，"dev tap" 将创建一个以太网隧道。
# 如果你正在进行以太网桥接并且已预先创建了 tap0 虚拟接口并将其与以太网接口桥接，请使用 "dev tap0"。
# 如果你想通过 VPN 控制访问策略，必须为 TUN/TAP 接口创建防火墙规则。
# 在非 Windows 系统上，你可以指定明确的单元编号，如 tun0。
# 在 Windows 上，请使用 "dev-node" 来实现。
# 在大多数系统上，除非你部分或完全禁用/开放 TUN/TAP 接口的防火墙，否则 VPN 将无法正常工作。
;dev tap
dev tun
# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel if you
# have more than one.
# You may need to selectively disable the
# Windows firewall for the TAP adapter.
# Non-Windows systems usually don't need this.
#
# 如果你有多个 TAP-Win32 适配器，Windows 需要从网络连接面板中获取适配器名称。
# 你可能需要有选择地为 TAP 适配器禁用 Windows 防火墙。
# 非 Windows 系统通常不需要此设置。
;dev-node MyTap
# SSL/TLS root certificate (ca), certificate
# (cert), and private key (key). Each client
# and the server must have their own cert and
# key file. The server and all clients will
# use the same ca file.
#
# SSL/TLS 根证书 (ca)、证书 (cert) 和私钥 (key)。
# 每个客户端和服务器都必须有自己的证书和密钥文件。
# 服务器和所有客户端将使用相同的 ca 文件。
#
# See the "easy-rsa" project at
# https://github.com/OpenVPN/easy-rsa
# for generating RSA certificates
# and private keys. Remember to use
# a unique Common Name for the server
# and each of the client certificates.
#
# 有关生成 RSA 证书和私钥的信息，请参阅 https://github.com/OpenVPN/easy-rsa 上的 "easy-rsa" 项目。
# 请记住为服务器和每个客户端证书使用唯一的通用名称 (Common Name)。
#
# Any X509 key management system can be used.
# OpenVPN can also use a PKCS #12 formatted key file
# (see "pkcs12" directive in man page).
#
# 可以使用任何 X509 密钥管理系统。
# OpenVPN 也可以使用 PKCS #12 格式的密钥文件
# (请参阅手册页中的 "pkcs12" 指令)。
#
# If you do not want to maintain a CA
# and have a small number of clients
# you can also use self-signed certificates
# and use the peer-fingerprint option.
# See openvpn-examples man page for a
# configuration example.
#
# 如果你不想维护 CA 并且只有少量客户端，你也可以使用自签名证书并使用 peer-fingerprint 选项。
# 有关配置示例，请参阅 openvpn-examples 手册页。
ca ca.crt
cert server.crt
key server.key # This file should be kept secret # 此文件应保密
# Diffie hellman parameters.
# Generate your own with:
# openssl dhparam -out dh2048.pem 2048
#
# Diffie hellman 参数。使用以下命令生成：
# openssl dhparam -out dh2048.pem 2048
dh dh2048.pem
# Allow to connect to really old OpenVPN versions
# without AEAD support (OpenVPN 2.3.x or older)
# This adds AES-256-CBC as fallback cipher and
# keeps the modern ciphers as well.
#
# 允许连接到不支持 AEAD 的非常旧的 OpenVPN 版本（OpenVPN 2.3.x 或更早版本）。
# 这会添加 AES-256-CBC 作为备用加密算法，同时保留现代加密算法。
;data-ciphers AES-256-GCM:AES-128-GCM:?CHACHA20-POLY1305:AES-256-CBC
# Network topology
# Should be subnet (addressing via IP)
# unless Windows clients v2.0.9 and lower have to
# be supported (then net30, i.e. a /30 per client)
# Defaults to net30 (not recommended)
#
# 网络拓扑。
# 除非需要支持 Windows 客户端 v2.0.9 及更低版本（则使用 net30，即每个客户端 /30），
# 否则应使用 subnet（通过 IP 寻址）。
# 默认为 net30（不推荐）。
topology subnet
# Configure server mode and supply a VPN subnet
# for OpenVPN to draw client addresses from.
# The server will take 10.8.0.1 for itself,
# the rest will be made available to clients.
# Each client will be able to reach the server
# on 10.8.0.1. Comment this line out if you are
# ethernet bridging. See the man page for more info.
#
# 配置服务器模式并提供一个 VPN 子网供 OpenVPN 分配客户端地址。
# 服务器将使用 10.8.0.1，其余地址将分配给客户端。
# 每个客户端都可以通过 10.8.0.1 访问服务器。
# 如果你正在进行以太网桥接，请注释掉此行。更多信息请参阅手册页。
server 10.8.0.0 255.255.255.0
# Maintain a record of client <-> virtual IP address
# associations in this file. If OpenVPN goes down or
# is restarted, reconnecting clients can be assigned
# the same virtual IP address from the pool that was
# previously assigned.
#
# 在此文件中维护客户端与虚拟 IP 地址关联的记录。
# 如果 OpenVPN 关闭或重启，重新连接的客户端可以从池中分配到之前分配的相同虚拟 IP 地址。
ifconfig-pool-persist /var/log/openvpn/ipp.txt
# Configure server mode for ethernet bridging.
# You must first use your OS's bridging capability
# to bridge the TAP interface with the ethernet
# NIC interface. Then you must manually set the
# IP/netmask on the bridge interface, here we
# assume 10.8.0.4/255.255.255.0. Finally we
# must set aside an IP range in this subnet
# (start=10.8.0.50 end=10.8.0.100) to allocate
# to connecting clients. Leave this line commented
# out unless you are ethernet bridging.
#
# 配置以太网桥接的服务器模式。
# 你必须首先使用操作系统的桥接功能将 TAP 接口与以太网 NIC 接口桥接。
# 然后你必须手动设置桥接接口上的 IP/子网掩码，这里我们假设为 10.8.0.4/255.255.255.0。
# 最后我们必须在此子网中预留一个 IP 范围（起始=10.8.0.50 结束=10.8.0.100）以分配给连接的客户端。
# 除非你正在进行以太网桥接，否则请保持此行注释。
;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
# Configure server mode for ethernet bridging
# using a DHCP-proxy, where clients talk
# to the OpenVPN server-side DHCP server
# to receive their IP address allocation
# and DNS server addresses. You must first use
# your OS's bridging capability to bridge the TAP
# interface with the ethernet NIC interface.
# Note: this mode only works on clients (such as
# Windows), where the client-side TAP adapter is
# bound to a DHCP client.
#
# 使用 DHCP 代理配置以太网桥接的服务器模式，客户端与 OpenVPN 服务器端的 DHCP 服务器通信以获取 IP 地址分配和 DNS 服务器地址。
# 你必须首先使用操作系统的桥接功能将 TAP 接口与以太网 NIC 接口桥接。
# 注意：此模式仅适用于客户端侧 TAP 适配器绑定到 DHCP 客户端的客户端（如 Windows）。
;server-bridge
# Push routes to the client to allow it
# to reach other private subnets behind
# the server. Remember that these
# private subnets will also need
# to know to route the OpenVPN client
# address pool (10.8.0.0/255.255.255.0)
# back to the OpenVPN server.
#
# 向客户端推送路由，使其能够访问服务器后面的其他私有子网。
# 请记住，这些私有子网也需要知道如何将 OpenVPN 客户端地址池（10.8.0.0/255.255.255.0）路由回 OpenVPN 服务器。
;push "route 192.168.10.0 255.255.255.0"
;push "route 192.168.20.0 255.255.255.0"
# To assign specific IP addresses to specific
# clients or if a connecting client has a private
# subnet behind it that should also have VPN access,
# use the subdirectory "ccd" for client-specific
# configuration files (see man page for more info).
#
# 要为特定客户端分配特定 IP 地址，或者如果连接的客户端后面有一个也应该具有 VPN 访问权限的私有子网，请使用 "ccd" 子目录存放客户端特定的配置文件（更多信息请参阅手册页）。
# EXAMPLE: Suppose the client
# having the certificate common name "Thelonious"
# also has a small subnet behind his connecting
# machine, such as 192.168.40.128/255.255.255.248.
# First, uncomment out these lines:
#
# 示例：假设证书通用名称为 "Thelonious" 的客户端在其连接机器后面还有一个小型子网，如 192.168.40.128/255.255.255.248。首先，取消注释以下行：
;client-config-dir ccd
;route 192.168.40.128 255.255.255.248
# Then create a file ccd/Thelonious with this line:
# iroute 192.168.40.128 255.255.255.248
# This will allow Thelonious' private subnet to
# access the VPN. This example will only work
# if you are routing, not bridging, i.e. you are
# using "dev tun" and "server" directives.
# 然后创建一个文件 ccd/Thelonious，包含此行：iroute 192.168.40.128 255.255.255.248。这将允许 Thelonious 的私有子网访问 VPN。此示例仅在你使用路由而非桥接时有效，即你正在使用 "dev tun" 和 "server" 指令。
# EXAMPLE: Suppose you want to give
# Thelonious a fixed VPN IP address of 10.9.0.1.
# First uncomment out these lines:
# 示例：假设你想给 Thelonious 分配一个固定的 VPN IP 地址 10.9.0.1。首先取消注释以下行：
;client-config-dir ccd
;route 10.9.0.0 255.255.255.252
# Then add this line to ccd/Thelonious:
# ifconfig-push 10.9.0.1 10.9.0.2
# 然后将此行添加到 ccd/Thelonious：ifconfig-push 10.9.0.1 10.9.0.2
# Suppose that you want to enable different
# firewall access policies for different groups
# of clients. There are two methods:
# (1) Run multiple OpenVPN daemons, one for each
# group, and firewall the TUN/TAP interface
# for each group/daemon appropriately.
# (2) (Advanced) Create a script to dynamically
# modify the firewall in response to access
# from different clients. See man
# page for more info on learn-address script.
#
# 假设你想为不同的客户端组启用不同的防火墙访问策略。有两种方法：
# (1) 运行多个 OpenVPN 守护进程，每个组一个，并为每个组/守护进程适当地配置 TUN/TAP 接口的防火墙。
# (2)（高级）创建一个脚本，根据不同客户端的访问动态修改防火墙。有关 learn-address 脚本的更多信息，请参阅手册页。
;learn-address ./script
# If enabled, this directive will configure
# all clients to redirect their default
# network gateway through the VPN, causing
# all IP traffic such as web browsing and
# DNS lookups to go through the VPN
# (The OpenVPN server machine may need to NAT
# or bridge the TUN/TAP interface to the internet
# in order for this to work properly).
#
# 如果启用，此指令将配置所有客户端将其默认网关重定向到 VPN，使所有 IP 流量（如网页浏览和 DNS 查询）都通过 VPN（OpenVPN 服务器机器可能需要对 TUN/TAP 接口进行 NAT 或桥接到互联网才能正常工作）。
;push "redirect-gateway def1 bypass-dhcp"
# Certain Windows-specific network settings
# can be pushed to clients, such as DNS
# or WINS server addresses. CAVEAT:
# http://openvpn.net/faq.html#dhcpcaveats
# The addresses below refer to the public
# DNS servers provided by opendns.com.
#
# 某些 Windows 特定的网络设置可以推送到客户端，如 DNS 或 WINS 服务器地址。
# 注意事项：http://openvpn.net/faq.html#dhcpcaveats。
# 以下地址是 opendns.com 提供的公共 DNS 服务器。
;push "dhcp-option DNS 208.67.222.222"
;push "dhcp-option DNS 208.67.220.220"
# Uncomment this directive to allow different
# clients to be able to "see" each other.
# By default, clients will only see the server.
# To force clients to only see the server, you
# will also need to appropriately firewall the
# server's TUN/TAP interface.
#
# 取消注释此指令以允许不同的客户端能够相互"看到"。
# 默认情况下，客户端只能看到服务器。要强制客户端只能看到服务器，你还需要适当地配置服务器 TUN/TAP 接口的防火墙。
;client-to-client
# Uncomment this directive if multiple clients
# might connect with the same certificate/key
# files or common names. This is recommended
# only for testing purposes. For production use,
# each client should have its own certificate/key
# pair.
#
# 如果多个客户端可能使用相同的证书/密钥文件或通用名称连接，请取消注释此指令。
# 这仅建议用于测试目的。在生产环境中，每个客户端应有自己的证书/密钥对。
#
# IF YOU HAVE NOT GENERATED INDIVIDUAL
# CERTIFICATE/KEY PAIRS FOR EACH CLIENT,
# EACH HAVING ITS OWN UNIQUE "COMMON NAME",
# UNCOMMENT THIS LINE.
#
# 如果你没有为每个客户端生成单独的证书/密钥对，且每个客户端都有自己唯一的"通用名称"，请取消注释此行。
;duplicate-cn
# The keepalive directive causes ping-like
# messages to be sent back and forth over
# the link so that each side knows when
# the other side has gone down.
# Ping every 10 seconds, assume that remote
# peer is down if no ping received during
# a 120 second time period.
#
# keepalive 指令会导致类似 ping 的消息在链路上来回发送，以便双方知道对方何时断开。
# 每 10 秒 ping 一次，如果在 120 秒内没有收到 ping，则认为远程对等方已断开。
keepalive 10 120
# For extra security beyond that provided
# by SSL/TLS, create an "HMAC firewall"
# to help block DoS attacks and UDP port flooding.
#
# 为了获得 SSL/TLS 之外的额外安全性，创建一个 "HMAC 防火墙" 以帮助阻止 DoS 攻击和 UDP 端口泛洪。
#
# Generate with:
# openvpn --genkey tls-auth ta.key
#
# 使用以下命令生成：
# openvpn --genkey tls-auth ta.key
#
# The server and each client must have
# a copy of this key.
# The second parameter should be '0'
# on the server and '1' on the clients.
#
# 服务器和每个客户端都必须有此密钥的副本。第二个参数在服务器上应为 '0'，在客户端上应为 '1'。
;tls-auth ta.key 0 # This file is secret # 此文件是机密的
# The maximum number of concurrently connected
# clients we want to allow.
#
# 我们允许的最大并发连接客户端数量。
;max-clients 100
# It's a good idea to reduce the OpenVPN
# daemon's privileges after initialization.
#
# 在初始化后降低 OpenVPN 守护进程的权限是个好主意。
#
# You can uncomment this on non-Windows
# systems after creating a dedicated user.
#
# 在创建专用用户后，你可以在非 Windows 系统上取消注释此项。
;user openvpn
;group openvpn
# The persist options will try to avoid
# accessing certain resources on restart
# that may no longer be accessible because
# of the privilege downgrade.
#
# persist 选项将尝试避免在重启时访问某些资源，这些资源可能由于权限降级而不再可访问。
persist-key
persist-tun
# Output a short status file showing
# current connections, truncated
# and rewritten every minute.
#
# 输出一个简短的状态文件，显示当前连接，每分钟截断并重写。
status /var/log/openvpn/openvpn-status.log
# By default, log messages will go to the syslog (or
# on Windows, if running as a service, they will go to
# the "\Program Files\OpenVPN\log" directory).
# Use log or log-append to override this default.
# "log" will truncate the log file on OpenVPN startup,
# while "log-append" will append to it. Use one
# or the other (but not both).
#
# 默认情况下，日志消息将发送到 syslog
# （或在 Windows 上，如果作为服务运行，将发送到 "\Program Files\OpenVPN\log" 目录）。
# 使用 log 或 log-append 覆盖此默认设置。
# - "log" 将在 OpenVPN 启动时截断日志文件
# - "log-append" 将追加到日志文件。
# 使用其中一个（但不能同时使用两个）。
;log /var/log/openvpn/openvpn.log
;log-append /var/log/openvpn/openvpn.log
# Set the appropriate level of log
# file verbosity.
# 设置适当的日志文件详细程度级别。
#
# 0 is silent, except for fatal errors
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
#
# 0 表示静默，除了致命错误；
# 4 对于一般使用是合理的；
# 5 和 6 可以帮助调试连接问题；
# 9 表示极其详细
verb 3
# Silence repeating messages. At most 20
# sequential messages of the same message
# category will be output to the log.
#
# 静默重复消息。同一消息类别最多 20 条连续消息将输出到日志。
;mute 20
# Notify the client that when the server restarts so it
# can automatically reconnect.
#
# 通知客户端服务器重启，以便客户端可以自动重新连接。
explicit-exit-notify 1
客户端
##############################################
# Sample client-side OpenVPN 2.6 config file #
# for connecting to multi-client server. #
# #
# This configuration can be used by multiple #
# clients, however each client should have #
# its own cert and key files. #
# #
# On Windows, you might want to rename this #
# file so it has a .ovpn extension #
##############################################
##############################################
# OpenVPN 2.6 客户端示例配置文件，用于连接多客户端服务器。
#
# 此配置可供多个客户端使用，但每个客户端应有自己的证书和密钥文件。
#
# 在 Windows 上，你可能需要将此文件重命名为 .ovpn 扩展名。
##############################################
# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
#
# 指定我们是客户端，并且将从服务器拉取某些配置文件指令。
client
# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
#
# 使用与服务器相同的设置。
# 在大多数系统上，除非你部分或完全禁用 TUN/TAP 接口的防火墙，否则 VPN 将无法正常工作。
;dev tap
dev tun
# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one. On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
#
# 如果你有多个 TAP-Win32 适配器，Windows 需要从网络连接面板中获取适配器名称。
# 在 XP SP2 上，你可能需要为 TAP 适配器禁用防火墙。
;dev-node MyTap
# Are we connecting to a TCP or
# UDP server? Use the same setting as
# on the server.
#
# 我们连接的是 TCP 还是 UDP 服务器？使用与服务器相同的设置。
;proto tcp
proto udp
# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
#
# 服务器的主机名/IP 和端口。
# 你可以有多个 remote 条目以在服务器之间进行负载均衡。
remote my-server-1 1194
;remote my-server-2 1194
# Choose a random host from the remote
# list for load-balancing. Otherwise
# try hosts in the order specified.
#
# 从 remote 列表中随机选择一个主机进行负载均衡。否则按指定顺序尝试主机。
;remote-random
# Keep trying indefinitely to resolve the
# host name of the OpenVPN server. Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
#
# 无限期地尝试解析 OpenVPN 服务器的主机名。
# 对于不是永久连接到互联网的机器（如笔记本电脑）非常有用。
resolv-retry infinite
# Most clients don't need to bind to
# a specific local port number.
#
# 大多数客户端不需要绑定到特定的本地端口号。
nobind
# Downgrade privileges after initialization (non-Windows only)
#
# 初始化后降低权限（仅限非 Windows）
;user openvpn
;group openvpn
# Try to preserve some state across restarts.
#
# 尝试在重启时保留一些状态。
persist-key
persist-tun
# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here. See the man page
# if your proxy server requires
# authentication.
#
# 如果你通过 HTTP 代理连接到实际的 OpenVPN 服务器，请在此处填写代理服务器/IP 和端口号。
# 如果你的代理服务器需要身份验证，请参阅手册页。
;http-proxy-retry # retry on connection failures # 连接失败时重试
;http-proxy [proxy server] [proxy port #]
# Wireless networks often produce a lot
# of duplicate packets. Set this flag
# to silence duplicate packet warnings.
#
# 无线网络经常产生大量重复数据包。设置此标志以静默重复数据包警告。
;mute-replay-warnings
# SSL/TLS parms.
# See the server config file for more
# description. It's best to use
# a separate .crt/.key file pair
# for each client. A single ca
# file can be used for all clients.
#
# SSL/TLS 参数。更多说明请参阅服务器配置文件。
# 最好为每个客户端使用单独的 .crt/.key 文件对。
# 所有客户端可以使用同一个 ca 文件。
ca ca.crt
cert client.crt
key client.key
# Verify server certificate by checking that the
# certificate has the correct key usage set.
# This is an important precaution to protect against
# a potential attack discussed here:
# http://openvpn.net/howto.html#mitm
#
# 通过检查证书是否设置了正确的密钥用途来验证服务器证书。
# 这是防止此处讨论的潜在攻击的重要预防措施：
# http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the keyUsage set to
# digitalSignature, keyEncipherment
# and the extendedKeyUsage to
# serverAuth
# EasyRSA can do this for you.
#
# 要使用此功能，你需要生成服务器证书时将 keyUsage 设置为
# digitalSignature, keyEncipherment
# 并将 extendedKeyUsage 设置为
# serverAuth
# EasyRSA 可以帮你完成此操作。
remote-cert-tls server
# Allow to connect to really old OpenVPN versions
# without AEAD support (OpenVPN 2.3.x or older)
# This adds AES-256-CBC as fallback cipher and
# keeps the modern ciphers as well.
#
# 允许连接到不支持 AEAD 的非常旧的 OpenVPN 版本（OpenVPN 2.3.x 或更早版本）。
# 这会添加 AES-256-CBC 作为备用加密算法，同时保留现代加密算法。
;data-ciphers AES-256-GCM:AES-128-GCM:?CHACHA20-POLY1305:AES-256-CBC
# If a tls-auth key is used on the server
# then every client must also have the key.
#
# 如果服务器使用了 tls-auth 密钥，那么每个客户端也必须有该密钥。
;tls-auth ta.key 1
# Set log file verbosity.
#
# 设置日志文件详细程度。
verb 3
# Silence repeating messages
#
# 静默重复消息
;mute 20
