Isa Yako Yega VPN Server neOpenVPN pane Ubuntu 10.04 Server

Isa Yako Yega VPN Server neOpenVPN pane Ubuntu 10.04 Server

KUTARISIRA

Mushure mechinguva musina kutumira ndinokuunzirai uyu mutungamiri we maitiro ekugadzira yako wega VPN pane Ubuntu Server, kungave kubatanidza nePC yekumba kana kushandisa iyo internet zvakachengeteka mune isina kuchengetedzeka Wi-Fi network

OpenVPN Iyo Software inoshanda sevatengi uye sevha zvinoenderana nemabatiro atinoigadzirisa, ini ndinojekesa kuti pane maviri mavhezheni eizvi:
* OpenVPN Nharaunda Software: Ndiyo vhezheni yatinozoshandisa uye iri 100% Open Sosi
* OpenVPN AccessServer: Ndiyo vhezheni yakabhadharwa, iwe yaunogona kushandisa mahara chete kusvika kuvashandisi vaviri, iwo ekuwedzera vashandisi akachipa kwazvo, zvakare ine zvinowedzera zvakaita sewebhu manejimendi pani, zviri nyore kwazvo kugadzirisa uye nezvimwe.

Nhanganyaya

OpenVPN chigadzirwa che software chakagadzirwa naJames Yonan muna 2001 uye chave chichivandudza kubva ipapo.

Hapana imwe mhinduro inopa musanganiswa wakadai webhizimusi-giredhi chengetedzo, chengetedzo, nyore-kwekushandisa, uye zvakapfuma maficha.

Iyo mhinduro yemultipuratifomu iyo yakarerutsa kwazvo kumisikidzwa kweVPNs, ichisiya nguva dzedzimwe mhinduro dzakaoma kumisikidza senge IPsec uye ichiita kuti iwanikwe nyore kune vanhu vasina ruzivo murudzi urwu rwetekinoroji.

Ngatitii tinofanirwa kutaura matavi akasiyana esangano. Pazasi isu tichaona mimwe mhinduro dzakapihwa mukupindura kune aya marudzi ezvido.

Munguva yakapfuura, kutaurirana kwaigadzirwa neposvo, runhare kana fakisi. Nhasi pane zvinhu zvinoita kuti zvive zvakakosha kuti zviitise mhinduro dzakaomesesa dzekubatanidza pakati pemahofisi emasangano pasi rese.

Izvi zvinhu ndezvi:

* Iko kumhanyisa kwemaitiro ebhizinesi uye kuwedzera kwayo kunotevera mukuda kwekuchinjika uye nekuchimbidzika kuchinjanisa ruzivo.
* Masangano mazhinji ane mapazi akati wandei munzvimbo dzakasiyana pamwe nevekure kure teleworkers kubva kumba, avo vanofanirwa kuchinjana ruzivo pasina kunonoka, sekunge vari pamwe panyama.
* Iko kudiwa kwemakomputa network kusangana nemhando yepamusoro yekuchengetedza inova nechokwadi chechokwadi, kuvimbika uye kuwanikwa.

mabviro: Wikipedia

Seva:

Ichi chinongedzo ndecheUbuntu 10.04 Server, ini ndinofungidzira kuti inoshanda mune dzimwe shanduro uye distros, isu tine ubuntu server yakatove yakaiswa uye ichishanda.
Isu tinoisa OpenVPN uye zvakare OpenSSL, sezvo chengetedzo yakavakirwa pa ssl.

sudo apt-tora-kuisa openvpn sudo apt-tora-kuisa setupsl

Isu tinogadzira iyo OpenVPN Daemon kuti Isatange Auto neiyo System
Isu tinotaura zvese nekuwedzera # pakutanga kwetambo yega yega.

sudo nano / etc / default / openvpn

bvisawo iyo yekutanga script, kudzivirira kuti itange kana iwe ukagadzira

sudo yekuvandudza-rc.d -f /etc/init.d/openvpn bvisa

Iye zvino tagadzira iyo faira openvpn.conf mu / etc / openvpn /

sudo nano /etc/openvpn/server.conf

uye isu takaisa iyi gadziriso

dev tun proto tcp port 1194 ca /etc/openvpn/keys/ca.crt cert /etc/openvpn/keys/server.crt key /etc/openvpn/keys/server.key dh /etc/openvpn/keys/dh2048.pem mushandisi hapana boka reboka reboka 10.6.0.0 255.255.255.0 ifconfig-dziva-pfuurira /etc/openvpn/clients.txt chinzvimbo /etc/openvpn/status.txt kuramba-kiyi kuramba-tun Push "redirect-gateway def1" Push "nzira 192.168.0.0 .255.255.255.0 10 "keepalive 120 3 chiito 3 comp-lzo max-vatengi XNUMX

sezvauri kuona ichigona kugadziriswa, uyu muenzaniso wakaedzwa

Kana iwe usiri kuda kushandisa vpn yeinternet yakachengeteka, ndiko kuti, usatsvage internet kubva kune vpn, bvisa mutsara "redirect-gateway".

Imwe dhata inogona kushandurwa:
* ca, cert, kiyi uye dh = ndizvo zvinhu, zvitupa, kiyi uye Diffie Hellman we server, isu tichavagadzira gare gare.
* server 10.6.0.0 255.255.255.0 = ndiyo ip ip iyo iyo vpn ichazoshandisa, shandisa imwe asi, isingashandisi zvakafanana neiyo chaiyo network.
* ifconfig-dziva-pfuurira ipp.txt = ponesa uyo akapihwa yega yega ip muvpn
* proto uye port = protocol uye chiteshi, unogona kushandisa tcp uye utp, mu utp haina kundipa mhedzisiro yakanaka, chiteshi ndechekuti unogona kuchichinja.
* duplicate-cn = inobvumidza chitupa chimwe chete uye kiyi kuti ishandiswe pane akati wandei vatengi panguva imwe chete, ini ndinokurudzira kusaimisa.
* up /etc/openvpn/openvpn.up = Chinyorwa chinotakura openvpn pakutanga, chinoshandiswa kuRouting uye FORWARDING, tichaigadzira gare gare.
* mutengi-kune-mutengi = ndeyekudzivirira vpn vashandisi kubva pakuonana, zvichienderana nenyaya yacho inobatsira.
* comp-lzo = kumanikidza, kumanikidza ese traffic yeVPN.
* chiito 3 = chinowedzera kana kudzikisira iyo yekukanganisa ruzivo pane server.
* max-vatengi 30 = yakanyanya kuwanda yevashandisi panguva imwe chete yakabatana neserura, inogona kuwedzerwa kana kuderedzwa
* Push nzira = inobvumidza iwe kuti uone kana kuve pane network paseri pevpn server, chenjera kuti usashandise mutengi-kune-mutengi.
* Push «redirect = kumanikidza mutengi kuti ashandise iyo VPN segedhi.

ikozvino isu tinogadzira iyo script yekuti igadzirise uye titange iyo vpn server.

sudo nano /etc/init.d/vpnserver

uye isu tinonama kodhi iyi, chinja ip range zvinoenderana nekugadziriswa kwedanho rapfuura

#! / bin / sh # vpnserver_start () {echo "VPN Server [OK]" echo 1> / proc / sys / net / ipv4 / ip_forward /etc/init.d/networking restart> / dev / null / sbin / iptables -t nat -A KUSVIRA -s 10.6.0.0/24 -o eth0 -j MASQUERADE / usr / sbin / openvpn --config /etc/openvpn/server.conf 2 >> /etc/openvpn/error.txt 1 >> /etc/openvpn/normal.txt &} vpnserver_stop () {echo "VPN Server [NO]" / usr / bin / killall "openvpn" iptables -F iptables -X /etc/init.d/networking restart> / dev / null} vpnserver_restart () {vpnserver_stop rara 1 vpnserver_start} # kesi "$ 1" mu 'kutanga') vpnserver_start ;; 'mira') vpnserver_stop ;; 'restart') vpnserver_restart ;; *) vpnserver_start ;; C uyo

ikozvino tinopa mvumo yekuitisa kwairi

sudo chmod + x /etc/init.d/vpnserver

zvakare uye chii chekumisikidza kuti auto itange nehurongwa

sudo yekuvandudza-rc.d vpnserver zvisizvo

Zvakanaka, isu takatogadzira OpenVPN, ikozvino isu tinofanirwa kumisikidza iyo TUN module mune kernel, nemitsara iyi, tinoitakura uye ndizvozvo

sudo modprobe tun sudo echo "tun" >> / etc / modules

Sezvauchaona, kumisikidzwa kwanga kusiri kuoma, asi iko zvino kwauya kunonoka:

* Gadzira 2048bit Diffie Hellman
* Gadzira Certification Chiremera.
* Gadzira Zvitupa uye makiyi evhavha.
* Gadzira zvitupa nemakiyi emumwe mushandisi.

Isu tinoteedzera iyo iri nyore-rsa mienzaniso yekuumba chinzvimbo, zvitupa, makiyi uye kunyorera, izvo zvinoshandisa OpenVPN,

sudo cp -R / usr / share / doc / openvpn / mienzaniso / nyore-rsa / / etc / openvpn /

ikozvino iwe unofanirwa kuisa dhairekitori uko zvinoshandiswa izvo zvatakateedzera zviri uye nekugadzira makiyi folda

sudo cp -R / usr / share / doc / openvpn / mienzaniso / nyore-rsa / / etc / openvpn / cd /etc/openvpn/easy-rsa/2.0 sudo mkdir makiyi

Isu tinongofanirwa kugadzirisa vars faira iri /etc/openvpn/easy-rsa/2.0

sudo nano /etc/openvpn/easy-rsa/2.0/vars

uye isu tinoshandura aya maitiro

kutumira kunze KEY_DIR = "$ EASY_RSA / makiyi"

kubudikidza

kutumira kunze KEY_DIR = "/ etc / openvpn / easy-rsa / 2.0 / keys"

ndeyekugadzira hongu kana hongu mu /etc/openvpn/easy-rsa/2.0/keys
isu tinoenderera, isu tinogadzirisawo ma parameter eDiffie Hellman e2048bits

kutumira kunze KEY_SIZE = 1024

kubudikidza

kutumira kunze KEY_SIZE = 2048

isu tiri kungoshaya iyo data yechinhu chiri kuburitsa chinhu

kutumira kunze KEY_COUNTRY = "US" kutumira KEY_PROVINCE = "CA" kutumira KEY_CITY = "SanFrancisco" kutumira kunze KEY_ORG = "Fort-Funston" kutumira KEY_EMAIL = "me@myhost.mydomain"

chinja imwe neimwe kukosha kune yako yenyika yako, dunhu, guta, kambani uye tsamba
Muenzaniso

kutumira kunze KEY_COUNTRY = "AR" kutumira KEY_PROVINCE = "SF" kutumira KEY_CITY = "Armstrong" kutumira KEY_ORG = "LAGA-Systems" kutumira KEY_EMAIL = "info@lagasystems.com.ar"

Sezvauri kuona AR = Argentina, SF = Santa Fe (dunhu rangu) uye vamwe vanonzwisisana.
Zvakanaka ikozvino isu tagadzirira kutanga, tevera nhanho idzi kune iyo tsamba, nekuti chikanganiso uye zvese zvaparara.

isu tevedzera

Kunobva ./vars

uye anotikumbira kuchenesa zvinhu, zvitupa nemakiyi, tinozviita nemufaro

./chena-se

ikozvino isu tinogadzira iyo Diffie Hellman chengetedzo ye2048bits

./vaka-dh

ikozvino isu tinogadzira chiremera mvumo ichavabvunza iwo iwo iwo iwo data senge mumavars mafaira, ini ndinokurudzira kupedzisa yega yega, kunyangwe ivo vatovepo, hazvina basa

./vaka-ca

Isu tave kukwanisa kugadzira zvitupa nemakiyi kutanga kuseva, chinja sevha kune iro zita raunoda, richakukumbira iyo yakafanana data seiri mumavars mafaira, ini ndinokurudzira kupedzisa yega yega, kunyangwe vari ndatovepo, hazvina basa.

./build-key-server server

Tatova nezvitupa uye makiyi eseva, ikozvino mutengi, chinja mutengi kune chero zita raunoda,
Ichazobvunza iyo yakafanana data seya ma vars mafaera. Ini ndinokurudzira kupedzisa yega yega, kunyangwe ivo vatovepo, hazvina basa.

./build-key mutengi

Iyi nhanho inofanirwa kudzokororwa kune mumwe nemumwe mutengi kana mushandisi uyo anoda kubatana neVPN, isu tatova nezvose zvekushanda, aiwa, tinofanirwa kuteedzera mafaera atinogadzira kunzvimbo yatinogadzira mu openvpn.conf
sezvo teedzera makiyi folda ku / etc / openvpn /

sudo cp -R /etc/openvpn/easy-rsa/2.0/keys / etc / openvpn /

ikozvino isu tarisa kuti zvese zviri munzvimbo, tinopinda iyo / etc / openvpn / keys folda

cd / nezvimwe / openvpn / makiyi

uye ne ls tinoongorora kana mafaera aripo
ikozvino isu tinogadzira imwezve faira, izvi zvinogadzirwa ne openvpn

sudo openvpn --genkey --secret ta.key

Iwe unongoda kuteedzera mafaera ca.crt, client.crt, client.key, kana iwe ukagadzira vatengi vakawanda kuteedzera crt uye kiyi yeimwe neimwe pendrive kana imwe nzira, usashandise email kuvatumira, zvakafanana nekupa yako kiyi yeimba kumutorwa.

Yakagadzirira, zvese zviri pane server, ikozvino tinozvitanga kuyedza kuti zvese zviri chokwadi

sudo /etc/init.d/vpnserver kutanga

Kana pasina zvikanganiso, isu tatova nevpn yedu inoshanda, chete mutengi ndiye anoshaikwa.

Mutengi:

Iri gwaro nderweUbuntu 10.04 Desktop, ini ndinofungidzira kuti inoshanda mune dzimwe shanduro uye distros, isu tine ubuntu yatove kuiswa uye kushanda.
Isu tinoisa OpenVPN uye zvakare OpenSSL, sezvo chengetedzo yakavakirwa pa ssl
uye sezvo isu tichizoshandisa iyo Ubuntu Network Manager, isu tinofanirwa kuisa ma plugins eOpenVPN

sudo apt-tora-kuisa openvpn sudo apt-tora -kuisa kuvhura ssudo aptitude -yokuisa network-maneja-openvpn

Iye zvino tava kukwanisa kumisikidza vedu vatengi muenzaniso wekumisikidza:

Nedhairekitori, gedit inogona kuve, unama iyi kodhi

mutengi dev tun proto tcp iri kure IP-OF-SERVER PORT resolution-edza zvisingaite nobind #user hapana munhu #group hapana anopfuurira-kiyi kuramba-tun ca.crt cert mutengi.crt kiyi mutengi.key comp-lzo tun-mtu 1500 chengetedza 10 120 chiito 4

Ivo vanoshandura iyo data, IP-DEL-SERVER iyi yeruzhinji kana internet IP ye server uye PORT iyo yavakapa pane server, mafaera ca.crt, client.crt uye client.key ndiwo atakagadzira nekuteedzera. pamberi pendrive kana chero.

Kana iwe uine yakasimba yeruzhinji IP, ini ndinokurudzira kushandisa iyo DDNS sevhisi (DyDNS, NO-IP, CDMon), uye usakanganwa kuvhura uye kuendesa doko 1194 kana iyo yawakasarudzira sevha.

Ivo vanochengeta kodhi ine zita ravanoda asi iine .conf yekuwedzera uye mune yakafanana dhairekitori se ca.crt, client.crt uye client.key mafaera.

Iye zvino vhura iyo Ubuntu Network Manager uye muVPN tebhu pane bhatani rekunze, tsvaga iyo .conf faira ratakachengeta kare uye ndizvozvo chete.

Ndinovimba zvinokubatsira, nekuti kuita openvpn basa ndakafamba nemanongedzo ese uye emanyorero andakawana.

Ndatenda neKomendi dzako, Kana paine chero CHIKanganiso CHAKABUDA mupfungwa dzako, hahaha