- Installs
- 193
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/chaterm/terminal-skills --skill vpn- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads vpn automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
VPN 配置与管理
概述
OpenVPN、WireGuard、IPSec VPN 配置与管理技能。
WireGuard
安装
# Debian/Ubuntu
apt install wireguard
# CentOS/RHEL
yum install epel-release elrepo-release
yum install kmod-wireguard wireguard-tools
# 验证安装
wg --version
生成密钥
# 生成私钥
wg genkey > privatekey
# 从私钥生成公钥
wg pubkey < privatekey > publickey
# 一步生成
wg genkey | tee privatekey | wg pubkey > publickey
# 生成预共享密钥（可选，增强安全）
wg genpsk > presharedkey
服务端配置
# /etc/wireguard/wg0.conf
[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = <server_private_key>
# 启用 IP 转发
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
[Peer]
PublicKey = <client_public_key>
AllowedIPs = 10.0.0.2/32
客户端配置
# /etc/wireguard/wg0.conf
[Interface]
Address = 10.0.0.2/24
PrivateKey = <client_private_key>
DNS = 8.8.8.8
[Peer]
PublicKey = <server_public_key>
Endpoint = server.example.com:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
管理命令
# 启动
wg-quick up wg0
systemctl start wg-quick@wg0
# 停止
wg-quick down wg0
systemctl stop wg-quick@wg0
# 开机启动
systemctl enable wg-quick@wg0
# 查看状态
wg show
wg show wg0
# 添加 peer
wg set wg0 peer <public_key> allowed-ips 10.0.0.3/32
OpenVPN
安装
# Debian/Ubuntu
apt install openvpn easy-rsa
# CentOS/RHEL
yum install epel-release
yum install openvpn easy-rsa
初始化 PKI
# 创建 CA 目录
make-cadir ~/openvpn-ca
cd ~/openvpn-ca
# 初始化 PKI
./easyrsa init-pki
# 创建 CA
./easyrsa build-ca nopass
# 生成服务器证书
./easyrsa gen-req server nopass
./easyrsa sign-req server server
# 生成 DH 参数
./easyrsa gen-dh
# 生成 TLS 密钥
openvpn --genkey secret ta.key
# 生成客户端证书
./easyrsa gen-req client1 nopass
./easyrsa sign-req client client1
服务端配置
# /etc/openvpn/server.conf
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
tls-auth ta.key 0
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
cipher AES-256-GCM
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 3
客户端配置
# client.ovpn
client
dev tun
proto udp
remote server.example.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
tls-auth ta.key 1
cipher AES-256-GCM
auth SHA256
verb 3
管理命令
# 启动服务
systemctl start openvpn@server
systemctl enable openvpn@server
# 查看状态
systemctl status openvpn@server
# 查看连接
cat /var/log/openvpn-status.log
# 吊销证书
cd ~/openvpn-ca
./easyrsa revoke client1
./easyrsa gen-crl
IPSec (strongSwan)
安装
# Debian/Ubuntu
apt install strongswan strongswan-pki
# CentOS/RHEL
yum install strongswan
生成证书
# 生成 CA
ipsec pki --gen --type rsa --size 4096 --outform pem > ca-key.pem
ipsec pki --self --ca --lifetime 3650 \
--in ca-key.pem --type rsa \
--dn "CN=VPN CA" \
--outform pem > ca-cert.pem
# 生成服务器证书
ipsec pki --gen --type rsa --size 4096 --outform pem > server-key.pem
ipsec pki --pub --in server-key.pem --type rsa | \
ipsec pki --issue --lifetime 1825 \
--cacert ca-cert.pem --cakey ca-key.pem \
--dn "CN=vpn.example.com" \
--san vpn.example.com \
--flag serverAuth --flag ikeIntermediate \
--outform pem > server-cert.pem
服务端配置
# /etc/ipsec.conf
config setup
charondebug="ike 2, knl 2, cfg 2"
uniqueids=no
conn ikev2-vpn
auto=add
compress=no
type=tunnel
keyexchange=ikev2
fragmentation=yes
forceencaps=yes
dpdaction=clear
dpddelay=300s
rekey=no
left=%any
leftid=@vpn.example.com
leftcert=server-cert.pem
leftsendcert=always
leftsubnet=0.0.0.0/0
right=%any
rightid=%any
rightauth=eap-mschapv2
rightsourceip=10.10.10.0/24
rightdns=8.8.8.8,8.8.4.4
rightsendcert=never
eap_identity=%identity
用户配置
# /etc/ipsec.secrets
: RSA "server-key.pem"
user1 : EAP "password1"
user2 : EAP "password2"
管理命令
# 启动
systemctl start strongswan
systemctl enable strongswan
# 重载配置
ipsec reload
ipsec rereadall
# 查看状态
ipsec statusall
ipsec status
# 查看 SA
ipsec listall
常见场景
场景 1：WireGuard 站点到站点
# 站点 A 配置
[Interface]
Address = 10.0.0.1/24
PrivateKey = <site_a_private>
ListenPort = 51820
[Peer]
PublicKey = <site_b_public>
Endpoint = site-b.example.com:51820
AllowedIPs = 10.0.0.2/32, 192.168.2.0/24
# 站点 B 配置
[Interface]
Address = 10.0.0.2/24
PrivateKey = <site_b_private>
ListenPort = 51820
[Peer]
PublicKey = <site_a_public>
Endpoint = site-a.example.com:51820
AllowedIPs = 10.0.0.1/32, 192.168.1.0/24
场景 2：分流配置
# WireGuard 仅代理特定网段
[Peer]
PublicKey = <server_public_key>
Endpoint = server.example.com:51820
AllowedIPs = 10.0.0.0/24, 192.168.100.0/24
场景 3：多用户管理脚本
#!/bin/bash
# add-wg-client.sh
CLIENT_NAME=$1
SERVER_PUBLIC_KEY="<server_public_key>"
SERVER_ENDPOINT="vpn.example.com:51820"
# 生成密钥
wg genkey | tee ${CLIENT_NAME}_private | wg pubkey > ${CLIENT_NAME}_public
# 生成客户端配置
cat > ${CLIENT_NAME}.conf << EOF
[Interface]
PrivateKey = $(cat ${CLIENT_NAME}_private)
Address = 10.0.0.${2}/24
DNS = 8.8.8.8
[Peer]
PublicKey = ${SERVER_PUBLIC_KEY}
Endpoint = ${SERVER_ENDPOINT}
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
EOF
echo "添加到服务器："
echo "[Peer]"
echo "PublicKey = $(cat ${CLIENT_NAME}_public)"
echo "AllowedIPs = 10.0.0.${2}/32"
故障排查
| 问题 | 排查方法 |
|---|---|
| 连接失败 | 检查防火墙、端口、密钥配置 |
| 握手失败 | 检查公钥配置、时间同步 |
| 无法访问内网 | 检查 AllowedIPs、路由、IP 转发 |
| 性能差 | 检查 MTU、加密算法 |
# WireGuard 调试
wg show
dmesg | grep wireguard
tcpdump -i any port 51820
# OpenVPN 调试
tail -f /var/log/openvpn.log
tcpdump -i any port 1194
# IPSec 调试
ipsec statusall
journalctl -u strongswan -f
# 检查 IP 转发
cat /proc/sys/net/ipv4/ip_forward
sysctl net.ipv4.ip_forward=1
FAQ
What does the vpn skill do?
VPN 配置与管理
How do I install vpn?
Run npx skills add https://github.com/chaterm/terminal-skills --skill vpn in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/vpn/ (personal) or .claude/skills/vpn/ (project).
Which AI agents can use vpn?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is vpn safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains vpn?
It is published by chaterm in chaterm/terminal-skills. It has 193 recorded installs.
More from chaterm/terminal-skills
system-admin
chaterm/terminal-skills
Linux system administration and monitoring
Popular other skills
hyperframes-cli
heygen-com/hyperframes
The HyperFrames CLI by job - scaffold, check, look at frames, edit the timeline, preview, render locally or in the cloud, publish, project history - plus reading its JSON and recovering from build or render failures.
triage
mattpocock/skills
Move issues and external PRs through a state machine of triage roles, categorise, verify, grill if needed, and write agent-ready briefs.
ask-matt
mattpocock/skills
Ask which skill or flow fits your situation. A router over the skills in this repo.
to-questionnaire
mattpocock/skills
Turn a decision you can't fully answer into a questionnaire for someone else to fill in.
loop-me
mattpocock/skills
Grill me about specs for the workflows I want to build, within this workspace.