Since the China blocks a number of ports for the OpenVPN，we may consider a range of ports forwarding to the single 1194 UDP port. For details, please refer [1].
The performance OpenVPN used in mainland China could be found in [2].
2. For the server side, a stand configuration is used. In the following script, the server uses TCP 1194 port for connection.
local ip.add.re.ss
port 1194
proto tcp
dev tun
ca keys/ca.crt
cert keys/server.crt
key keys/server.key
dh keys/dh1024.pem
server 10.10.0.0 255.255.255.0
ifconfig-pool-persist ipptcp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status tcp-server-tcp.log
verb 3
log /var/log/openvpn-tcp.log
tls-auth keys/ta.key 0
link-mtu 1400
複製代碼
3. Client side uses the option "remote-random" to set a random port for connection. If the server accepts, then the connection is established otherwise another port number is employed. If the connection is lost then another connection using another port will be tried to establish.
client
dev tun
proto tcp-client
remote-random
remote ip.add.re.ss 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
tls-auth ta.key 1
ns-cert-type server
comp-lzo
verb 3
keepalive 10 120
route-method exe
route-delay 2
register-dns
link-mtu 1400
複製代碼
4. On rotuer's iptables side, we should add
# Allow packets from the new subnet to make it out to the Internet
iptables -A FORWARD -s 10.10.0.0/24 -j ACCEPT
# Change the source address on outgoing packets from the new subnet to be the VPS's IP address
