OpenVPN с двухуровневой иерархией ЦС

#!/usr/bin/env bash
yum install epel-release -y ; yum install htop nano bash-completion-extras openvpn easy-rsa -y
export EASYRSA_VARS_FILE="/etc/openvpn/vars"

cat << EOF > $EASYRSA_VARS_FILE
export EASYRSA_PKI="/etc/openvpn/pki"
export KEY_COUNTRY="RU"
export KEY_PROVINCE="Moscow"
export KEY_CITY="Moscow"
export KEY_ORG="Home"
export KEY_EMAIL="blackhole@alexgluck.ru"
export KEY_CN="${STAND}${VPN_DOMAIN:-vpn.alexgluck.ru}"
export KEY_OU="bedroom"
export KEY_NAME="${VPN_DOMAIN:-vpn.alexgluck.ru}"
export KEY_ALTNAMES="openvpn.${VPN_DOMAIN:-vpn.alexgluck.ru}"
EOF

# shellcheck disable=SC1090
source "$EASYRSA_VARS_FILE"
/usr/share/easy-rsa/3/easyrsa --batch init-pki
/usr/share/easy-rsa/3/easyrsa --batch build-ca nopass
/usr/share/easy-rsa/3/easyrsa gen-dh
/usr/share/easy-rsa/3/easyrsa --batch gen-req --req-cn="$KEY_NAME" "$KEY_NAME" nopass
/usr/share/easy-rsa/3/easyrsa --batch sign-req server "$KEY_NAME"
openvpn --genkey --secret "$EASYRSA_PKI"/ta.key

cat << EOF > /etc/openvpn/server/"${VPN_PROTO:-udp}".conf
local ${VPN_BIND:-0.0.0.0}
port ${VPN_PORT:-1194}
proto ${VPN_PROTO:-udp}
dev tun
ca $EASYRSA_PKI/ca.crt
cert $EASYRSA_PKI/issued/${KEY_NAME}.crt
key $EASYRSA_PKI/private/${KEY_NAME}.key
dh $EASYRSA_PKI/dh.pem
tls-auth $EASYRSA_PKI/ta.key 0
topology subnet
server ${VPN_SUBNET:-10.254.250.0} 255.255.255.0
ifconfig-pool-persist ipp-${VPN_PROTO:-udp}.txt
keepalive 10 120
persist-key
persist-tun
# log-append /var/log/openvpn/openvpn-${VPN_PROTO:-udp}.log
verb 3
mode server
tls-server
comp-lzo yes
cipher BF-CBC
EOF

echo net.ipv4.ip_forward=1 >> /etc/sysctl.conf
sysctl -p

mkdir -p /var/log/openvpn
firewall-cmd --permanent --add-port=${VPN_PORT:-1194}/${VPN_PROTO:-udp}
firewall-cmd --direct --permanent --add-rule ipv4 nat POSTROUTING 0 -s ${VPN_SUBNET:-10.254.250.0}/24 -j MASQUERADE
firewall-cmd --direct --permanent --add-rule ipv4 filter FORWARD 0 -s ${VPN_SUBNET:-10.254.250.0}/24 -j ACCEPT
firewall-cmd --reload

cat << EOF > "$EASYRSA_PKI"/ovpn.template
client
resolv-retry 15
nobind
remote ${KEY_NAME} ${VPN_PORT:-1194}
proto ${VPN_PROTO:-udp}
dev tun
comp-lzo yes
tls-client
key-direction 1
keepalive 10 120
persist-key
persist-tun
auth-nocache
remote-cert-tls server
verb 3
cipher BF-CBC
EOF

cat << EOF > /etc/openvpn/create_new_client.sh
#!/bin/bash
export EASYRSA_VARS_FILE="/etc/openvpn/vars"
source "${EASYRSA_VARS_FILE}"
# каталог в котором будет создан файл *.ovpn
OUTPUT_DIR=/etc/openvpn/client/
BASE_CONFIG=${EASYRSA_PKI}/ovpn.template

/usr/share/easy-rsa/3/easyrsa --batch gen-req --req-cn="\${1}" \${1} nopass
/usr/share/easy-rsa/3/easyrsa --batch sign-req client \${1}

cat \${BASE_CONFIG} \
<(echo ) \
<(echo -e '<ca>') \
\${EASYRSA_PKI}/ca.crt \
<(echo -e '</ca>\n<cert>') \
\${EASYRSA_PKI}/issued/\${1}.crt \
<(echo -e '</cert>\n<key>') \
\${EASYRSA_PKI}/private/\${1}.key \
<(echo -e '</key>\n<tls-auth>') \
\${EASYRSA_PKI}/ta.key \
<(echo -e '</tls-auth>') \
> \${OUTPUT_DIR}/\${1}.ovpn
EOF

chmod 740 /etc/openvpn/create_new_client.sh
systemctl enable --now openvpn-server@${VPN_PROTO:-udp}

1. Автор убери копирование скриптов easyrsa в /etc/openvpn.
2. Убери копирование dh,ta,ca,server сертификатов и ключа (при обновлении этих файлов придётся делать лишние движения, которые не нужны).
3. Храни pki каталог отдельно от openvpn.
4. Опиши нормальную настройку фаервола, таблица форвард может иметь свои правила.