Hello, World!
红猫警长的地窝子

Centos 7 上部署 Ocserv Cisco AnyConnect 服务端

本文介绍了如何在 Centos 7 上部署 Ocserv 服务端,并使用锐速优化网速。

一直以来都在使用Shadowsocks,速度快、基本不受某墙干扰,电脑、安卓、ios都有客户端,路由器也能刷入实现家里多部终端使用。

但是最近入手了Blackberry Passport,不要问我什么还入这不跟不上时代的手机,其实原因仅仅是因为“喜欢”,哪怕应用少,摆在那里我也觉得是一件艺术品。试玩之后发现我所在的敏感地区不能正常使用黑莓的应用商店和BBM,在家里虽然可以通过路由器爬墙使用,但外出就有些不便,黑莓OS10上又无法使用Shadowsocks,所以在自己的VPS上折腾了下OpenConnect Server(ocserv)。

部署环境

  • VPS :Vultr
  • 部署环境:Centos 7.2
  • Ocserv版本:0.10.8

安装须知

为了省事,这里选择Travis Lee提供的一键安装脚本,安装前先看看须知:

  • 支持自动判断防火墙,请确保 Firewalld 或者 iptables 其中一个是 active 状态;
  • 默认采用用户名密码验证,本安装脚本编译的 ocserv 也支持 pam 验证,只需要修改配置文件即可;
  • 默认配置文件在 /usr/local/etc/ocserv/ 目录,可自行更改脚本里的参数;
  • 安装时会提示你输入端口、用户名、密码等信息,也可直接回车采用默认值,密码是随机生成的;
  • 安装脚本会关闭 SELINUX;
  • 自带路由表,只有路由表里的 IP 才会走 VPN,如果你有需要添加的路由表可自行添加,最多支持 200 条;
  • 如果你有证书机构颁发的证书,可以把证书放到脚本的同目录下,确保文件名和脚本里的匹配,安装脚本会使用你的证书,客户端连接时不会提示证书错误;
  • 配置文件修改为每个账号允许 10 个连接,全局 1024 个连接,可修改脚本前面的变量。1024 个连接大约需要 2048 个 IP,所以虚拟接口的 IP 配置了 8 个 C 段。

安装 Ocserv

首先打开终端登陆,执行以下命令

wget https://raw.githubusercontent.com/travislee8964/Ocserv-install-script-for-CentOS-RHEL-7/master/ocserv-install-script-for-centos7.sh

编辑下载下来的脚本文件

vi ocserv-install-script-for-centos7.sh

将其中 ocserv_version=”0.10.9″ 这一行的版本号改成 0.10.8,据说此版本较稳定。

然后执行脚本

sh ocserv-install-script-for-centos7.sh

安装过程中会提示你输入端口、用户名和密码等,自己按需填写。

安装完成后编辑配置文件

vi /usr/local/etc/ocserv/ocserv.conf

因为锐速只能加速TCP协议,所以将udp端口这一行注释掉

#udp-port = 10443

配置文件中使用了路由表黑名单,如果使用白名单,将包含 route = 的条目全部注释掉,例如

#route = 10.10.10.0/255.255.255.0 #route = 192.168.0.0/255.255.0.0

然后使用no-route添加白名单

no-route = 1.0.0.0/255.192.0.0 no-route = 1.64.0.0/255.224.0.0 no-route = 1.112.0.0/255.248.0.0 no-route = 1.176.0.0/255.240.0.0 no-route = 1.192.0.0/255.240.0.0 no-route = 14.0.0.0/255.224.0.0 no-route = 14.96.0.0/255.224.0.0 no-route = 14.128.0.0/255.224.0.0 no-route = 14.192.0.0/255.224.0.0 no-route = 27.0.0.0/255.192.0.0 no-route = 27.96.0.0/255.224.0.0 no-route = 27.128.0.0/255.224.0.0 no-route = 27.176.0.0/255.240.0.0 no-route = 27.192.0.0/255.224.0.0 no-route = 27.224.0.0/255.252.0.0 no-route = 36.0.0.0/255.192.0.0 no-route = 36.96.0.0/255.224.0.0 no-route = 36.128.0.0/255.192.0.0 no-route = 36.192.0.0/255.224.0.0 no-route = 36.240.0.0/255.240.0.0 no-route = 39.0.0.0/255.255.0.0 no-route = 39.64.0.0/255.224.0.0 no-route = 39.96.0.0/255.240.0.0 no-route = 39.128.0.0/255.192.0.0 no-route = 40.72.0.0/255.254.0.0 no-route = 40.124.0.0/255.252.0.0 no-route = 42.0.0.0/255.248.0.0 no-route = 42.48.0.0/255.240.0.0 no-route = 42.80.0.0/255.240.0.0 no-route = 42.96.0.0/255.224.0.0 no-route = 42.128.0.0/255.128.0.0 no-route = 43.224.0.0/255.224.0.0 no-route = 45.3.32.0/255.255.224.0 no-route = 45.65.16.0/255.255.240.0 no-route = 45.78.80.0/255.255.240.0 no-route = 45.112.0.0/255.240.0.0 no-route = 45.248.0.0/255.248.0.0 no-route = 47.92.0.0/255.252.0.0 no-route = 47.96.0.0/255.224.0.0 no-route = 49.0.0.0/255.128.0.0 no-route = 49.128.0.0/255.224.0.0 no-route = 49.192.0.0/255.192.0.0 no-route = 52.80.0.0/255.252.0.0 no-route = 54.222.0.0/255.254.0.0 no-route = 58.0.0.0/255.128.0.0 no-route = 58.128.0.0/255.224.0.0 no-route = 58.192.0.0/255.224.0.0 no-route = 58.240.0.0/255.240.0.0 no-route = 59.32.0.0/255.224.0.0 no-route = 59.64.0.0/255.224.0.0 no-route = 59.96.0.0/255.240.0.0 no-route = 59.144.0.0/255.240.0.0 no-route = 59.160.0.0/255.224.0.0 no-route = 59.192.0.0/255.192.0.0 no-route = 60.0.0.0/255.224.0.0 no-route = 60.48.0.0/255.240.0.0 no-route = 60.160.0.0/255.224.0.0 no-route = 60.192.0.0/255.192.0.0 no-route = 61.0.0.0/255.192.0.0 no-route = 61.80.0.0/255.248.0.0 no-route = 61.128.0.0/255.192.0.0 no-route = 61.224.0.0/255.224.0.0 no-route = 91.234.36.0/255.255.255.0 no-route = 101.0.0.0/255.128.0.0 no-route = 101.128.0.0/255.224.0.0 no-route = 101.192.0.0/255.240.0.0 no-route = 101.224.0.0/255.224.0.0 no-route = 103.0.0.0/255.0.0.0 no-route = 104.167.16.0/255.255.240.0 no-route = 104.207.32.0/255.255.224.0 no-route = 106.0.0.0/255.128.0.0 no-route = 106.224.0.0/255.240.0.0 no-route = 110.0.0.0/255.128.0.0 no-route = 110.144.0.0/255.240.0.0 no-route = 110.160.0.0/255.224.0.0 no-route = 110.192.0.0/255.192.0.0 no-route = 111.0.0.0/255.192.0.0 no-route = 111.64.0.0/255.224.0.0 no-route = 111.112.0.0/255.240.0.0 no-route = 111.128.0.0/255.192.0.0 no-route = 111.192.0.0/255.224.0.0 no-route = 111.224.0.0/255.240.0.0 no-route = 112.0.0.0/255.128.0.0 no-route = 112.128.0.0/255.240.0.0 no-route = 112.192.0.0/255.252.0.0 no-route = 112.224.0.0/255.224.0.0 no-route = 113.0.0.0/255.128.0.0 no-route = 113.128.0.0/255.240.0.0 no-route = 113.192.0.0/255.192.0.0 no-route = 114.16.0.0/255.240.0.0 no-route = 114.48.0.0/255.240.0.0 no-route = 114.64.0.0/255.192.0.0 no-route = 114.128.0.0/255.240.0.0 no-route = 114.192.0.0/255.192.0.0 no-route = 115.0.0.0/255.0.0.0 no-route = 116.0.0.0/255.0.0.0 no-route = 117.0.0.0/255.128.0.0 no-route = 117.128.0.0/255.192.0.0 no-route = 118.16.0.0/255.240.0.0 no-route = 118.64.0.0/255.192.0.0 no-route = 118.128.0.0/255.128.0.0 no-route = 119.0.0.0/255.128.0.0 no-route = 119.128.0.0/255.192.0.0 no-route = 119.224.0.0/255.224.0.0 no-route = 120.0.0.0/255.192.0.0 no-route = 120.64.0.0/255.224.0.0 no-route = 120.128.0.0/255.240.0.0 no-route = 120.192.0.0/255.192.0.0 no-route = 121.0.0.0/255.128.0.0 no-route = 121.192.0.0/255.192.0.0 no-route = 122.0.0.0/254.0.0.0 no-route = 124.0.0.0/255.0.0.0 no-route = 125.0.0.0/255.128.0.0 no-route = 125.160.0.0/255.224.0.0 no-route = 125.192.0.0/255.192.0.0 no-route = 137.59.59.0/255.255.255.0 no-route = 137.59.88.0/255.255.252.0 no-route = 139.0.0.0/255.224.0.0 no-route = 139.128.0.0/255.128.0.0 no-route = 140.64.0.0/255.240.0.0 no-route = 140.128.0.0/255.240.0.0 no-route = 140.192.0.0/255.192.0.0 no-route = 144.0.0.0/255.248.0.0 no-route = 144.12.0.0/255.255.0.0 no-route = 144.48.0.0/255.248.0.0 no-route = 144.123.0.0/255.255.0.0 no-route = 144.255.0.0/255.255.0.0 no-route = 146.196.0.0/255.255.128.0 no-route = 150.0.0.0/255.255.0.0 no-route = 150.96.0.0/255.224.0.0 no-route = 150.128.0.0/255.240.0.0 no-route = 150.192.0.0/255.192.0.0 no-route = 152.104.128.0/255.255.128.0 no-route = 153.0.0.0/255.192.0.0 no-route = 153.96.0.0/255.224.0.0 no-route = 157.0.0.0/255.255.0.0 no-route = 157.18.0.0/255.255.0.0 no-route = 157.61.0.0/255.255.0.0 no-route = 157.112.0.0/255.240.0.0 no-route = 157.144.0.0/255.240.0.0 no-route = 157.255.0.0/255.255.0.0 no-route = 159.226.0.0/255.255.0.0 no-route = 160.19.208.0/255.255.240.0 no-route = 160.20.48.0/255.255.252.0 no-route = 160.202.0.0/255.255.0.0 no-route = 160.238.64.0/255.255.252.0 no-route = 161.207.0.0/255.255.0.0 no-route = 162.105.0.0/255.255.0.0 no-route = 163.0.0.0/255.192.0.0 no-route = 163.96.0.0/255.224.0.0 no-route = 163.128.0.0/255.192.0.0 no-route = 163.192.0.0/255.224.0.0 no-route = 166.111.0.0/255.255.0.0 no-route = 167.139.0.0/255.255.0.0 no-route = 167.189.0.0/255.255.0.0 no-route = 167.220.244.0/255.255.252.0 no-route = 168.160.0.0/255.255.0.0 no-route = 170.179.0.0/255.255.0.0 no-route = 171.0.0.0/255.128.0.0 no-route = 171.192.0.0/255.224.0.0 no-route = 175.0.0.0/255.128.0.0 no-route = 175.128.0.0/255.192.0.0 no-route = 180.64.0.0/255.192.0.0 no-route = 180.128.0.0/255.128.0.0 no-route = 182.0.0.0/255.0.0.0 no-route = 183.0.0.0/255.192.0.0 no-route = 183.64.0.0/255.224.0.0 no-route = 183.128.0.0/255.128.0.0 no-route = 192.124.154.0/255.255.255.0 no-route = 192.140.128.0/255.255.128.0 no-route = 202.0.0.0/255.128.0.0 no-route = 202.128.0.0/255.192.0.0 no-route = 202.192.0.0/255.224.0.0 no-route = 203.0.0.0/255.0.0.0 no-route = 210.0.0.0/255.192.0.0 no-route = 210.64.0.0/255.224.0.0 no-route = 210.160.0.0/255.224.0.0 no-route = 210.192.0.0/255.224.0.0 no-route = 211.64.0.0/255.248.0.0 no-route = 211.80.0.0/255.240.0.0 no-route = 211.96.0.0/255.248.0.0 no-route = 211.136.0.0/255.248.0.0 no-route = 211.144.0.0/255.240.0.0 no-route = 211.160.0.0/255.248.0.0 no-route = 218.0.0.0/255.128.0.0 no-route = 218.160.0.0/255.224.0.0 no-route = 218.192.0.0/255.192.0.0 no-route = 219.64.0.0/255.224.0.0 no-route = 219.128.0.0/255.224.0.0 no-route = 219.192.0.0/255.192.0.0 no-route = 220.96.0.0/255.224.0.0 no-route = 220.128.0.0/255.128.0.0 no-route = 221.0.0.0/255.224.0.0 no-route = 221.96.0.0/255.224.0.0 no-route = 221.128.0.0/255.128.0.0 no-route = 222.0.0.0/255.0.0.0 no-route = 223.0.0.0/255.224.0.0 no-route = 223.64.0.0/255.192.0.0 no-route = 223.128.0.0/255.128.0.0

保存配置文件,执行下面的代码重启Ocserv服务

systemctl restart ocserv.service

到这里就完成了Ocserv 的服务端部署工作,到手机上安装 Cisco AnyConnect 客户端,连接时如果提示证书不安全,记得要点信任,输入用户名和密码就能畅游网络了。

如果想给朋友们使用,也可以添加几个用户,使用下面的命令

ocpasswd -c /usr/local/etc/ocserv/ocpasswd 用户名

执行后会提示设置密码,按需输入即可。

安装锐速

这里也使用一键安装脚本,执行

wget --no-check-certificate -qO /tmp/appex.sh "https://raw.githubusercontent.com/0oVicero0/serverSpeeder_Install/master/appex.sh" && bash /tmp/appex.sh 'install'

安装过程中可能会提示选择版本,按提示选择即可。

至此,Ocserv 和 锐速都安装完成,因为注释掉了UDP端口,所以当连接到服务端时都走的TCP端口,这样锐速就能提供加速了。

最后来张情怀吧

 

参考:

Ocserv install script for CentOS&RHEL 7

ocserv-cn-no-route

lotServer Shell script

 

未经允许不得转载:Mr.Red » Centos 7 上部署 Ocserv Cisco AnyConnect 服务端

分享到:更多 ()

评论 8

  • 昵称 (必填)
  • 邮箱 (必填)
  • 网址
  1. #1

    找你这篇找了一下午,为了pp操碎了心

    xc1年前 (2017-10-21)回复
  2. #2

    请问怎么做不带路由表呢。全走VPN

    gooden12个月前 (11-28)回复
  3. #3

    最后一步出现错误
    Failed connect to soft.91yun.org:80; Operation now in progress
    下载bin运行文件失败,请检查
    有什么办法吗。。我是纯新手。。。

    lo10个月前 (01-06)回复
    • 应该是之前提供代码的91yun停止维护了,已经在文章中更新了最后一步安装锐速的代码,你可以试试

      Mr.Red10个月前 (01-07)回复
  4. #4

    您好,请教,我的手机连接成功之后,不能翻呢,跟没装一样,还有最后的锐速输入之后没反映,没出现安装等任何提示

    网亿10个月前 (01-11)回复
    • 检查防火墙是否放行了端口

      Mr.Red10个月前 (01-17)回复
  5. #5

    连接成功之后所有网都不能上了

    网亿10个月前 (01-11)回复