允许来自公司内网和特定服务器

配置OpenConnect服务器的步骤如下：

安装OpenConnect

sudo apt-get update
sudo apt-get install openssh libssh2
sudo apt-get install openconnect

生成密钥对

umask 400
ssh-keygen -t dsa -f openssh-server.pem

生成证书签名请求（CSR）

cp openssh-server.pem ~/.ssh/id_dsa.pub
chmod 600 ~/.ssh/id_dsa.pub
ssh-keygen -s <证书颁发机构>.cer > openssh-server.csr

获取证书

提交CSR给证书颁发机构,下载回来的证书：

sudo mv openssh-server.csr /tmp/
openssl req -x509 -newkey dsa:openssh-server.pem -out /tmp/openssh-server.pem.cert.pem -days 365 -nodes

安装证书

sudo mv openssh-server.pem.cert.pem /etc/ssh/keys/openssh-server.pem.cert.pem
sudo chmod 640 /etc/ssh/keys/openssh-server.pem.cert.pem

创建OpenConnect配置文件

sudo nano /etc/openconnect/ssh-server.conf

配置服务器选项

UseLocalUser=yes
ListenPort=8443
LocalAddress=192.168.1.100
LocalNetworkPrefix=22
AllowLocalPortForwarding=yes
LocalPortForwardingRules=LocalPortForwardingRule:1,N%,192.168.1./24
UserLocalForwarding=yes
DelegateAuth=yes
AuthorizedKeysFile .ssh/authorized_keys
PasswordAuthentication yes
PubkeyAuthentication yes
KeyDenyUsers Acid

配置访问控制列表

sudo nano /etc/openconnect/acl.conf

AllowConnect 10.../8
AllowConnect 172.16../12
DenyConnect *

用户配置文件

sudo nano /etc/openconnect/users/user1.conf

Username user1
LocalUser user1
LocalPortForwardingEnabled yes
LocalPortForwardingRules LocalPortForwardingRule:1,N%,192.168.1./24
Authentications Pubkey,Password
PrivateKeyFile .ssh/user1.pem

生成客户端配置文件

sudo nano /var/lib/openconnect/clients/user1.pem

Host *
   User user1
   HostName 192.168.1.100
   Port 8443
   User user1
   ForwardAgent yes
   LocalForwarding yes
   CertificateVerification off
   Rekey yes
   RemotePortForwarding yes

启动OpenConnect

sudo systemctl start openconnect
sudo systemctl enable openconnect

测试连接

ssh -p 8443 user1@external-server.example.com

通过以上步骤，您可以配置并设置OpenConnect服务器，确保外部流量安全地转发到内部服务器，确保密钥和证书配置正确,并定期更新软件和证书以维护安全。