最近买了台便宜VPS使用，在这里记录一下配置流程。万一商家跑路了，就再找另外一家照着流程刷刷刷就好了。
我买的是OpenVZ的机器，便宜嘛。首先后台面板打开tun支持，然后可以直接登录了。
查看CentOS版本，修改主机名
cat /etc/redhat-release
hostnamectl –static set-hostname D2O-VPS
CentOS7默认没有ifconfig nslookup等工具，安装之
yum install -y bind-utils net-tools htop mlocate
updatedb
修改ssh端口
vi /etc/ssh/sshd_config
Port xx22
CentOS7默认使用firewalld作为防火墙，这玩意不懂怎么用，故把他停掉，继续使用原来熟悉的iptables
systemctl stop firewalld
systemctl mask firewalld
yum install -y iptables-services policycoreutils
systemctl enable iptables
打开ssh端口
vi /etc/sysconfig/iptables
-A INPUT -p tcp -m state –state NEW -m tcp –dport 22 -j ACCEPT
改为
-A INPUT -p tcp -m state –state NEW -m tcp –dport xx22 -j ACCEPT
打开常用服务端口允许所有内网IP访问
iptables -I INPUT -p tcp -m state –state NEW -m tcp –dport 1723 -j ACCEPT
iptables -I INPUT -p tcp -m state –state NEW -m tcp –dport 80 -j ACCEPT
iptables -I INPUT -p udp -m udp –dport 53 -j ACCEPT
iptables -I INPUT -p udp -m udp –dport 161 -j ACCEPT
iptables -I INPUT -s 198.18.0.0/16 -d 198.18.0.0/16 -j ACCEPT
iptables -I INPUT -p udp -m udp –dport 11990:12000 -j ACCEPT
打开转发
iptables -I FORWARD -j ACCEPT
开启ip伪装、端口重定向、mss fix
iptables -t nat -I POSTROUTING -o venet0 -j MASQUERADE
iptables -t mangle -I POSTROUTING -o venet0 -p tcp -m tcp –tcp-flags SYN,RST SYN -j TCPMSS –clamp-mss-to-pmtu
iptables -t nat -I PREROUTING -p udp -m udp –dport 5352 -j REDIRECT –to-ports 53
别忘了ip6tables
ip6tables -A INPUT -p ipv6-icmp -j ACCEPT
ip6tables -A INPUT -p tcp -m tcp –dport 8622 -j ACCEPT
ip6tables -A INPUT -p tcp -m tcp –dport 80 -j ACCEPT
ip6tables -A INPUT -p udp -m udp –dport 161 -j ACCEPT
ip6tables -A INPUT -p udp -m udp –dport 11990:12000 -j ACCEPT
ip6tables -A INPUT -j REJECT –reject-with icmp6-port-unreachable
保存iptables规则
service iptables save
service ip6tables save
开启内核转发、关闭rp_filter
vi /etc/sysctl.conf
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.all.rp_filter = 0
导入epel源，安装openvpn quagga net-snmp
rpm -Uvh http://dl.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-7-5.noarch.rpm
yum install -y openvpn quagga net-snmp
dnsmasq先yum安装，然后编译替换改过的dnsmasq。autovpn-for-openwrt这个项目修改过的dnsmasq可以执行自定义的脚本，具体的意义就不多说了。
#yum安装dnsmasq，安装编译器及各种依赖包
yum install -y gcc make automake patch dnsmasq
mkdir src
cd src
#下载源码及补丁、打补丁、编译、替换可执行文件
wget https://github.com/conupefox/autovpn-for-openwrt/blob/master/packages/dnsmasq-14.07-2.71-src-autovpn.tar.gz
wget http://www.thekelleys.org.uk/dnsmasq/dnsmasq-2.71.tar.gz
tar xvf dnsmasq-14.07-2.71-src-autovpn.tar.gz
tar xvf dnsmasq-2.71.tar.gz
cd dnsmasq-2.71
../dnsmasq/patches/autovpn.patch ./
patch -p1 \< autovpn.patch
make
mv /usr/sbin/dnsmasq /usr/sbin/dnsmasq.bak
cp src/dnsmasq /usr/sbin/dnsmasq
配置snmp
cd ~
mv /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.bak
vi /etc/snmp/snmpd.conf
com2sec notConfigUser default d2o
group notConfigGroup v1 notConfigUser
group notConfigGroup v2c notConfigUser
view systemview included .1.3.6.1.2.1.1
view systemview included .1.3.6.1.2.1.25.1.1
access notConfigGroup “” any noauth exact all none none
view all included .1 80
syslocation HongKong
syscontact D2O
dontLogTCPWrappersConnects yes
extend .1.3.6.1.4.1.2021.54 active_connects /bin/cat /proc/sys/net/netfilter/nf_conntrack_count
extend .1.3.6.1.4.1.2021.55 Route /bin/sh /etc/snmp/route_prefixes.sh
systemctl enable snmpd
Ubuntu 15.04下使用OpenVPN客户端：//m.ajphoenix.com/linux/14780.html
在Ubuntu 15.04上配置OpenVPN服务器和客户端：//m.ajphoenix.com/linux/13129.html
想玩路由器吗？使用Quagga将你的CentOS变成OSPF路由器：//m.ajphoenix.com/linux/10340.html
ubuntu下pptp利用dnsmasq指定域名访问：//m.ajphoenix.com/linux/15123.html
ubuntu14.04自带的DNS服务器dnsmasq：//m.ajphoenix.com/linux/14667.html