最近升级了软路由系统OpenWRT系统，luci-app-openvpn-server插件用起来有问题，导致openvpn服务搭建不起来，最后是直接用的luci-app-openvpn，手动改配置证书跑起的，这里记录一下

安装luci-app-openvpn

一般编译固件我都会勾上这个插件，或者在系统-软件包里安装也行

生成证书密钥文件

我这里因为装过luci-app-openvpn-server插件，所以已经自动生成了：

root@ImmortalWrt:/etc/openvpn/pki# ll
drwxr-xr-x    2 root     root          4096 Jul  4 09:47 ./
drwxr-xr-x    3 root     root          4096 Jul  6 10:22 ../
-rw-------    1 root     root          1744 Jul  4 09:47 ca.crt
-rw-------    1 root     root          5312 Jul  4 09:47 client1.crt
-rw-------    1 root     root          1704 Jul  4 09:47 client1.key
-rw-------    1 root     root           428 Jul  4 09:47 dh.pem
-rw-------    1 root     root          5329 Jul  4 09:47 server.crt
-rw-------    1 root     root          1704 Jul  4 09:47 server.key

主要就是这6个文件

配置服务端

我是直接手动修改配置文件/etc/config/openvpn，内容如下：

config openvpn 'myvpn'
	option proto 'tcp-server'
	option dev 'tun'
	option topology 'subnet'
	option server '10.8.0.0 255.255.255.0'
	option comp_lzo 'no'
  option ca '/etc/openvpn/pki/ca.crt'
	option cert '/etc/openvpn/pki/server.crt'
	option key '/etc/openvpn/pki/server.key'
	option dh '/etc/openvpn/pki/dh.pem'
	option persist_key '1'
	option persist_tun '1'
	option user 'nobody'
	option group 'nogroup'
	option max_clients '10'
	option keepalive '10 120'
	option verb '3'
	option status '/var/log/openvpn_status.log'
	option log '/tmp/openvpn.log'
	option port '1194'
	option ddns 'home.chengpei.top'
	option enabled '1'
	list push 'route 192.168.5.0 255.255.255.0'
	list push 'redirect-gateway def1 bypass-dhcp'
	list push 'dhcp-option DNS 192.168.5.1'

改完直接到页面上启动即可

生成OVPN文件

使用以下命令即可：

cat > /etc/openvpn/client1.ovpn <<'EOF'
client
dev tun
proto tcp-client
remote home.chengpei.top 1194

comp-lzo no
resolv-retry infinite
nobind
persist-key
persist-tun

remote-cert-tls server
verb 3

<ca>
EOF

cat /etc/openvpn/pki/ca.crt >> /etc/openvpn/client1.ovpn

cat >> /etc/openvpn/client1.ovpn <<'EOF'
</ca>

<cert>
EOF

cat /etc/openvpn/pki/client1.crt >> /etc/openvpn/client1.ovpn

cat >> /etc/openvpn/client1.ovpn <<'EOF'
</cert>

<key>
EOF

cat /etc/openvpn/pki/client1.key >> /etc/openvpn/client1.ovpn

cat >> /etc/openvpn/client1.ovpn <<'EOF'
</key>
EOF