最近升级了软路由系统OpenWRT系统，luci-app-openvpn-server插件用起来有问题，导致openvpn服务搭建不起来，最后是直接用的luci-app-openvpn，手动改配置证书跑起的，这里记录一下

安装luci-app-openvpn

一般编译固件我都会勾上这个插件，或者在系统-软件包里安装也行

生成证书密钥文件

我这里刷完系统后已经自动生成了：

root@ImmortalWrt:/etc/openvpn/pki# ll
drwxr-xr-x    2 root     root          4096 Jul  4 09:47 ./
drwxr-xr-x    3 root     root          4096 Jul  6 10:22 ../
-rw-------    1 root     root          1744 Jul  4 09:47 ca.crt
-rw-------    1 root     root          5312 Jul  4 09:47 client1.crt
-rw-------    1 root     root          1704 Jul  4 09:47 client1.key
-rw-------    1 root     root           428 Jul  4 09:47 dh.pem
-rw-------    1 root     root          5329 Jul  4 09:47 server.crt
-rw-------    1 root     root          1704 Jul  4 09:47 server.key

主要就是这6个文件

配置服务端

我是直接手动修改配置文件/etc/config/openvpn，内容如下：

config openvpn 'myvpn'
        option proto 'tcp-server'
        option dev 'tun'
        option topology 'subnet'
        option server '10.8.0.0 255.255.255.0'
        option comp_lzo 'adaptive'
        option ca '/etc/openvpn/pki/ca.crt'
        option cert '/etc/openvpn/pki/server.crt'
        option key '/etc/openvpn/pki/server.key'
        option dh '/etc/openvpn/pki/dh.pem'
        option persist_key '1'
        option persist_tun '1'
        option user 'nobody'
        option group 'nogroup'
        option max_clients '10'
        option keepalive '10 120'
        option verb '3'
        option status '/var/log/openvpn_status.log'
        option log '/tmp/openvpn.log'
        option port '1194'
        list push 'route 192.168.5.0 255.255.255.0'
        list push 'comp-lzo adaptive'
        list push 'redirect-gateway def1 bypass-dhcp'
        list push 'dhcp-option DNS 192.168.5.1'
        option ddns 'home.chengpei.top'
        option enabled '1'

改完直接到页面上启动即可

生成OVPN文件

使用以下命令即可：

cat > /etc/openvpn/client1.ovpn <<'EOF'
client
dev tun
proto tcp-client
remote home.chengpei.top 1194

resolv-retry infinite
nobind
persist-key
persist-tun

remote-cert-tls server
verb 3

<ca>
EOF

cat /etc/openvpn/pki/ca.crt >> /etc/openvpn/client1.ovpn

cat >> /etc/openvpn/client1.ovpn <<'EOF'
</ca>

<cert>
EOF

cat /etc/openvpn/pki/client1.crt >> /etc/openvpn/client1.ovpn

cat >> /etc/openvpn/client1.ovpn <<'EOF'
</cert>

<key>
EOF

cat /etc/openvpn/pki/client1.key >> /etc/openvpn/client1.ovpn

cat >> /etc/openvpn/client1.ovpn <<'EOF'
</key>
EOF