Ikani Yanu Yokha VPN Server ndi OpenVPN pa Ubuntu 10.04 Server

Ikani Yanu Yokha VPN Server ndi OpenVPN pa Ubuntu 10.04 Server

CHIYAMBI

Patapita kanthawi osatumiza ndikubweretserani bukuli la momwe mungakhalire VPN yanu pa Ubuntu Server, mwina kulumikizana ndi PC yakunyumba kapena kugwiritsa ntchito intaneti mosatetezeka ma netiweki a Wi-Fi.

OpenVPN Ndi Pulogalamu yomwe imagwira ntchito ngati kasitomala ndi seva kutengera momwe timayikonzera, ndikufotokozera kuti pali mitundu iwiri ya izi:
* Mapulogalamu a Community OpenVPN: Ndi mtundu womwe tidzagwiritse ntchito ndipo ndi 100% Open Source
* Seva Yofikira ya OpenVPN: Ndi mtundu wolipidwa, womwe mungagwiritse ntchito kwaulere kwa anthu awiri okha, owonjezerawo ndiotsika mtengo kwambiri, ulinso ndizowonjezera monga gulu loyang'anira ukonde, ndizosavuta kukhazikitsa ndi zina zambiri.

Mau oyamba

OpenVPN ndi pulogalamu yopangidwa ndi James Yonan ku 2001 ndipo yakhala ikuyenda bwino kuyambira pamenepo.

Palibe yankho lina lomwe limaphatikiza kuphatikiza kwamabizinesi, chitetezo, kugwiritsa ntchito mosavuta, komanso zinthu zolemera.

Ndi njira yothetsera mavuto yomwe yasintha kwambiri kusintha kwa ma VPN, kusiya nthawi zamayankho ena ovuta kukonza monga IPsec ndikupangitsa kuti anthu osadziwa zambiri athe kugwiritsa ntchito ukadaulo uwu.

Tiyerekeze kuti tikufunika kulumikizana ndi nthambi zosiyanasiyana za bungwe. Pansipa tiwona mayankho omwe aperekedwa chifukwa cha zosowazi.

M'mbuyomu, kulumikizana kumapangidwa ndi makalata, foni kapena fakisi. Lero pali zinthu zina zomwe zimapangitsa kuti pakhale njira zothetsera kulumikizana kwapamwamba pakati pamaofesi amabungwe padziko lonse lapansi.

Izi ndi izi:

* Kuchulukitsa kwa njira zamabizinesi ndi zotsatira zake kukuwonjezeka pakufunika kosinthana kwa chidziwitso mosavuta.
* Mabungwe ambiri amakhala ndi nthambi zingapo m'malo osiyanasiyana komanso ogwira ntchito kutali kwawoko kuchokera kunyumba, omwe amafunika kusinthana zidziwitso mosachedwa, ngati kuti anali ogwirizana.
* Kufunika kwamaintaneti kuti akwaniritse miyezo yayikulu yachitetezo yomwe imatsimikizira kutsimikizika, kukhulupirika komanso kupezeka.

Chitsime: Wikipedia

Seva:

Bukuli ndi la Ubuntu 10.04 Server, ndikuganiza kuti limagwira ntchito mumitundu ina ndi ma distros, tili ndi seva ya ubuntu yomwe idakhazikitsidwa kale ndikugwira ntchito.
Timakhazikitsa OpenVPN komanso OpenSSL, popeza chitetezo chimakhazikitsidwa ndi ssl.

sudo apt-get -y kukhazikitsa openvpn sudo apt-get -y kukhazikitsa openssl

Timasintha Openemon ya Daemon ya OpenVPN kuti Isayambe Mokha ndi System
Timayankha zonse powonjezera # koyambirira kwa mzere uliwonse.

sudo nano / etc / default / openvpn

chotsaninso pulogalamu yoyambira, kuti isayambe ngati mutasintha

sudo update-rc.d -f /etc/init.d/openvpn chotsani

Tsopano timapanga fayilo openvpn.conf mu / etc / openvpn /

sudo nano /etc/openvpn/server.conf

ndipo tidayika kasinthidwe kameneka

dev tun proto tcp doko 1194 ca /etc/openvpn/keys/ca.crt cert /etc/openvpn/keys/server.crt key /etc/openvpn/keys/server.key dh /etc/openvpn/keys/dh2048.pem wosagwiritsa ntchito gulu la gulu la gulu 10.6.0.0 255.255.255.0 ifconfig-pool-persist /etc/openvpn/clients.txt udindo /etc/openvpn/status.txt chitsitsimutso chotsatira-pitilizani "kuyambitsanso njira yolowera def1" kukankha "njira 192.168.0.0 .255.255.255.0 10 "osunga 120 3 vesi 3 ophatikiza-lzo max-makasitomala XNUMX

monga mukuwonera kuti imatha kusinthidwa, ichi ndi chitsanzo chomwe chidayesedwa

Ngati simukufuna kugwiritsa ntchito vpn pa intaneti yotetezeka, ndiye kuti, musasakire intaneti pa vpn, chotsani mzere "redirect-gateway".

Zina zomwe zingasinthidwe:
* ca, cert, kiyi ndi dh = ndi bungwe, ziphaso, kiyi ndi Diffie Hellman wa seva, tidzapanga pambuyo pake.
* seva 10.6.0.0 255.255.255.0 = ndiye ip yomwe vpn idzagwiritse ntchito, kugwiritsa ntchito ina koma, osagwiritsa ntchito chimodzimodzi ndi netiweki yeniyeni
* ifconfig-pool-persist ipp.txt = sungani omwe adapatsidwa ip iliyonse mu vpn
* proto ndi port = protocol ndi doko, mutha kugwiritsa ntchito tcp ndi utp, mu utp sanandipatse zotsatira zabwino, doko lingasinthidwe.
* duplicate-cn = imalola satifiketi yomweyo ndi kiyi kuti zigwiritsidwe ntchito m'makasitomala angapo nthawi imodzi, ndikupangira kuti musayiyike.
* up /etc/openvpn/openvpn.up = ndicholemba chomwe chimanyamula openvpn poyambira, chimagwiritsidwa ntchito POPHUNZIRA NDI KUYAMBIRA, tidzalenga mtsogolo.
* kasitomala-kwa-kasitomala = ndikuteteza ogwiritsa ntchito vpn kuti asawonane, kutengera momwe zingathandizire.
* comp-lzo = kupanikizika, imapanikiza magalimoto onse a VPN.
* vesi 3 = kumawonjezera kapena kumachepetsa zolakwika pa seva.
* max-makasitomala 30 = kuchuluka kwa ogwiritsa ntchito nthawi imodzi yolumikizidwa ndi seva, itha kukulitsidwa kapena kutsika.
* push route = imakulolani kuti muwone kapena mukhale pa netiweki kuseri kwa vpn seva, samalani kuti musatsegule kasitomala-kwa-kasitomala.
* Kankhani «redirect = kukakamiza kasitomala kuti agwiritse ntchito VPN ngati njira.

tsopano timapanga script kuti ikonze ndikusintha seva ya vpn.

sudo nano /etc/init.d/vpnserver

ndipo timayika khodi iyi, sintha ip ip kutengera makonda a sitepe yapita

#! / bin / sh # vpnserver_start () {echo "VPN Server [Chabwino]" echo 1> / proc / sys / net / ipv4 / ip_forward /etc/init.d/networking restart> / dev / null / sbin / iptables -t nat -KUYANG'ANIRA -s 10.6.0.0/24 -o eth0 -j MASQUERADE / usr / sbin / openvpn --config /etc/openvpn/server.conf 2 >> /etc/openvpn/error.txt 1 >> /etc/openvpn/normal.txt &} vpnserver_stop () {echo "VPN Server [NO]" / usr / bin / killall "openvpn" iptables -F iptables -X /etc/init.d/networking restart> / dev / null} vpnserver_restart () {vpnserver_stop kugona 1 vpnserver_start} # case "$ 1" mu 'start') vpnserver_start ;; 'siyani') vpnserver_stop ;; 'restart') vpnserver_restart ;; *) vpnserver_start ;; kuti C

tsopano timapereka zilolezo zothandizirako

sudo chmod + x /etc/init.d/vpnserver

komanso zomwe muyenera kusintha kuti muyambe auto ndi dongosolo

sudo update-rc.d vpnserver zosintha

Chabwino, tidakonza kale OpenVPN, tsopano tiyenera kuyambitsa gawo la TUN mu kernel, ndi mizere iyi, timayikweza ndipo ndi zomwezo

sudo modprobe tun sudo echo "tun" >> / etc / modules

Monga momwe muwonera, kasinthidwe kameneka sikanali kovuta kwambiri, koma tsopano ikubwera pang'onopang'ono kwambiri:

* Pangani 2048bit Diffie Hellman
* Pangani Certification Authority.
* Pangani Zikalata ndi makiyi a seva.
* Pangani satifiketi ndi makiyi a aliyense wosuta.

Timatsanzira zitsanzo zosavuta kuti tipeze bungwe, ziphaso, mafungulo ndi kubisa, zomwe zimagwiritsa ntchito OpenVPN,

sudo cp -R / usr / share / doc / openvpn / zitsanzo / zosavuta-rsa / / etc / openvpn /

tsopano muyenera kulowetsa chikwatu komwe zofunikira zomwe tidakopera ndikupanga zikwatu

sudo cp -R / usr / share / doc / openvpn / zitsanzo / zosavuta-rsa / / etc / openvpn / cd /etc/openvpn/easy-rsa/2.0 sudo mkdir makiyi

Tiyenera kusintha fayilo ya vars yomwe ili mu /etc/openvpn/easy-rsa/2.0

sudo nano /etc/openvpn/easy-rsa/2.0/vars

ndipo timasintha mfundozi

kutumiza KEY_DIR = "$ EASY_RSA / makiyi"

ndi

kutumiza KEY_DIR = "/ etc / openvpn / easy-rsa / 2.0 / keys"

ndikupanga inde kapena inde mu /etc/openvpn/easy-rsa/2.0/keys
tikupitiliza, timasinthanso magawo a Diffie Hellman a 2048bits

kutumiza KEY_SIZE = 1024

ndi

kutumiza KEY_SIZE = 2048

tikusowa zomwe gulu lomwe likupereka

kutumiza kunja KEY_COUNTRY = "US" kutumiza KEY_PROVINCE = "CA" kutumiza KEY_CITY = "SanFrancisco" kutumiza KEY_ORG = "Fort-Funston" kutumiza KEY_EMAIL = "me@myhost.mydomain"

sinthani mtengo uliwonse mdziko lanu, chigawo, mzinda, kampani ndi makalata
Chitsanzo

kutumiza kunja KEY_COUNTRY = "AR" kutumiza KEY_PROVINCE = "SF" kutumiza KEY_CITY = "Armstrong" kutumiza KEY_ORG = "LAGA-Systems" kutumiza KEY_EMAIL = "info@lagasystems.com.ar"

Monga mukuwonera AR = Argentina, SF = Santa Fe (chigawo changa) ndi enawo akumvetsetsana.
Tsopano ndife okonzeka kuyamba, tsatirani izi ku kalatayo, chifukwa cholakwitsa chimodzi ndipo zonse zawonongeka.

timapereka

gwero ./vars

Ndipo akatifunsa kuti tiyeretse ngati pali zinthu zina, ziphaso ndi makiyi, timachita mosangalala

./clean-all

tsopano timapanga Diffie Hellman chitetezo cha 2048bits

./build-dh

tsopano timapanga olowa nawo chitsimikizo chidzawafunsa zomwezo monga ma fayilo a vars omwe ndikupangira kuti amalize aliyense, ngakhale alipo kale, zilibe kanthu

./build-ca

Tsopano titha kupanga ziphaso ndi mafungulo kaye pa seva, sinthani seva kukhala dzina lomwe mumakonda, ikufunsani zomwezo monga ma fayilo a vars, ndikulimbikitsani kumaliza chilichonse, ngakhale zili kale kumeneko, zilibe kanthu.

./build-key-server seva

Tili kale ndi ziphaso ndi mafungulo a seva, tsopano kasitomala, sinthani kasitomala dzina lililonse lomwe mungafune,
Idzapempha deta yofanana ndi ya ma vars. Ndikupangira kuti aliyense amalize, ngakhale alipo kale, zilibe kanthu.

./build-key kasitomala

Gawo ili liyenera kubwerezedwa kwa kasitomala aliyense kapena wogwiritsa ntchito amene akufuna kulumikizana ndi VPN, tili nazo zonse zoti tigwire, ayi, tifunika kukopera mafayilo omwe timapanga kupita komwe timakonza mu openvpn.conf
popeza lembani zikwatu ku / etc / openvpn /

sudo cp -R /etc/openvpn/easy-rsa/2.0/keys / etc / openvpn /

tsopano timawona kuti chilichonse chili m'malo mwake, timalowa chikwatu cha / etc / openvpn / keys

cd / etc / openvpn / makiyi

ndipo ndi ls timawona ngati mafayilo ali
tsopano timapanga fayilo imodzi, izi zimapangidwa ndi openvpn

sudo openvpn --genkey --secret ta.key

Mukungoyenera kukopera mafayilo ca.crt, client.crt, client.key, ngati mwapanga makasitomala ambiri, lembani crt ndi kiyi wa aliyense pendrive kapena njira zina, osagwiritsa ntchito imelo kuwatumizira, zili ngati kupereka chinsinsi cha nyumba yanu kwa mlendo.

Takonzeka, zonse zili pa seva, tsopano timayiyesa kuti tione ngati zonse zili zolondola

sudo /etc/init.d/vpnserver kuyamba

Ngati palibe zolakwika, tili ndi vpn yathu yomwe ikugwira ntchito, kasitomala yekha ndiye akusowa.

Makasitomala:

Bukuli ndi la Ubuntu 10.04 Desktop, ndikuganiza kuti limagwira ntchito mumitundu ina ndi ma distros, tili ndi ubuntu womwe udayikidwa kale ndikugwira ntchito.
Timakhazikitsa OpenVPN komanso OpenSSL, popeza chitetezo chimakhazikitsidwa ndi ssl
ndipo momwe tidzagwiritsira ntchito Ubuntu Network Manager, tiyenera kukhazikitsa mapulagini a OpenVPN

sudo apt-get -y kukhazikitsa openvpn sudo apt-get -y kukhazikitsa opensl sudo apt -y kukhazikitsa network-manager-openvpn

Tsopano tatha kukonza kasitomala wathu chitsanzo chosinthira:

Pokhala ndi cholembera mawu, gedit itha kukhala, ikani code iyi

kasitomala dev tun proto tcp akutali IP-OF-SERVER PORT resolution-yesaninso zopanda malire nobind #user nobody #group palibe wina wolimbikira-kiyi kulimbikira ca ca.crt kasitomala cert.crt kasitomala kasitomala.key comp-lzo tun-mtu 1500 keepalive 10 120 vesi 4

Amasintha data, IP-DEL-SERVER iyi ndi IP yapagulu kapena intaneti ya seva ndi PORT yomwe amapatsa seva, mafayilo ca.crt, client.crt ndi client.key ndi omwe tidapanga ndikukopera. m'mbuyomu kapena china chilichonse.

Ngati muli ndi IP yothandiza anthu, ndikupangira kugwiritsa ntchito ntchito ya DDNS (DyDNS, NO-IP, CDMon), ndipo musaiwale kutsegula ndikuwongolera doko 1194 kapena lomwe mwasankha pa seva.

Amasunga nambalayo ndi dzina lomwe akufuna koma ndi .conf yowonjezera komanso chikwatu chomwecho ma fayilo a ca.crt, client.crt ndi client.key

Tsopano tsegulani Ubuntu Network Manager ndipo mu tsamba la VPN pali batani la Import, yang'anani fayilo ya .conf yomwe tidasunga kale ndizomwezo.

Ndikukhulupirira kuti zikuthandizani, popeza kupanga openvpn ntchito ndidadutsa maupangiri onse ndi zolemba zomwe ndapeza.

Zikomo chifukwa cha ndemanga zanu, ngati pali zolakwika zilizonse zomwe zimachokera m'maganizo anu, hahaha