Faka i-Own VPN Server yakho nge-OpenVPN ku-Ubuntu 10.04 Server

Faka i-Own VPN Server yakho nge-OpenVPN ku-Ubuntu 10.04 Server

QAPHELA

Ngemuva kwesikhashana ngaphandle kokuthumela ngikulethela lo mhlahlandlela we ungayakha kanjani i-VPN yakho ku-Ubuntu Server, noma ukuxhuma i-pc yasekhaya noma ukusebenzisa i-inthanethi ngokuphepha kumanethiwekhi we-Wi-Fi angavikelekile.

I-OpenVPN YiSoftware esebenza njengeklayenti neseva ngokwendlela esiyilungiselela ngayo, ngicacisa ukuthi kunezinguqulo ezi-2 zalokhu:
* Isoftware Yomphakathi ye-OpenVPN: Yinguqulo esizoyisebenzisa futhi ingu-100% Umthombo Ovulekile
* Iseva Yokufinyelela ye-OpenVPN: Yinguqulo ekhokhelwayo, ongayisebenzisa mahhala kuze kufike kubasebenzisi abayi-2 kuphela, abasebenzisi abengeziwe bashibhile kakhulu, inezinwele ezifana nephaneli yokuphatha iwebhu, kulula kakhulu ukuyilungisa nokuningi.

Isingeniso

I-OpenVPN ingumkhiqizo wesoftware owenziwe nguJames Yonan e2001 futhi ubulokhu uthuthuka kusukela lapho.

Asikho esinye isixazululo esinikeza inhlanganisela enjalo yokuphepha kwebanga lebhizinisi, ukuphepha, ukusetshenziswa okulula, nezici ezicebile.

Yisixazululo se-multiplatform esenze lula kakhulu ukucushwa kwama-VPNs, sishiya izikhathi zezinye izixazululo ezinzima zokumisa njenge-IPsec nokwenza ukuthi kufinyeleleke kalula kubantu abangenalwazi kulolu hlobo lobuchwepheshe.

Ake sithi sidinga ukuxhumana namagatsha ahlukene enhlangano. Ngezansi sizobona ezinye izixazululo ezinikezwe ukuphendula lezi zinhlobo zezidingo.

Esikhathini esedlule, ukuxhumana kwakwenziwa ngeposi, ngocingo noma ngefeksi. Namuhla kunezici ezenza kudingeke ukuthi kusetshenziswe izixazululo eziyinkimbinkimbi zokuxhuma phakathi kwamahhovisi ezinhlangano emhlabeni wonke.

Lezi zinto yilezi:

* Ukusheshiswa kwezinqubo zebhizinisi kanye nokwenyuka kwalo okulandela isidingo sokushintshaniswa kolwazi okuguqukayo nokushesha.
* Izinhlangano eziningi zinamagatsha amaningi ezindaweni ezahlukahlukene kanye nabasebenza kude kude nasekhaya, abadinga ukushintshana ngolwazi ngaphandle kokulibala, kube sengathi bahlangene ngokomzimba.
* Isidingo samanethiwekhi ekhompyutha ukuhlangabezana nezindinganiso eziphakeme zokuphepha eziqinisekisa ubuqiniso, ubuqotho nokutholakala.

Umthombo: Wikipedia

Iseva:

Lo mhlahlandlela owe-Ubuntu 10.04 Server, ngicabanga ukuthi usebenza kwezinye izinhlobo nama-distros, sine-ubuntu server esivele ifakiwe futhi isebenza.
Sifaka i-OpenVPN kanye ne-OpenSSL, ngoba ukuphepha kusekelwe ku-ssl.

Sudo apt-get -y ukufaka i-openvpn sudo apt-get -y ukufaka i-openssl

Silungiselela i-OpenVPN Daemon ukuthi ingaqali ngokuzenzakalela ngohlelo
Siphawula konke ngokungeza u- # ekuqaleni komugqa ngamunye.

Sudo nano / etc / default / openvpn

futhi susa iskripthi sokuqalisa, ukusivimbela ukuthi siqale uma ulungiselela

sudo update-rc.d -f /etc/init.d/openvpn khipha

Manje sakha ifayela openvpn.conf ku / etc / openvpn /

sudo nano /etc/openvpn/server.conf

futhi sibeka lokhu kulungiselelwa

dev tun proto tcp port 1194 ca /etc/openvpn/keys/ca.crt cert /etc/openvpn/keys/server.crt key /etc/openvpn/keys/server.key dh /etc/openvpn/keys/dh2048.pem Iseva yeqembu lomsebenzisi akekho iqembu 10.6.0.0 255.255.255.0 ifconfig-pool-persist /etc/openvpn/clients.txt isimo /etc/openvpn/status.txt Qhubeka-ukhiye uphikelela-tun push "uqondise kabusha isango def1" Phusha "umzila 192.168.0.0 .255.255.255.0 10 "i-keepalive 120 3 isenzo 3 comp-lzo max-amaklayenti XNUMX

njengoba ubona ukuthi kungenziwa ngezifiso, lesi yisibonelo esivivinyiwe

Uma ungafuni ukusebenzisa i-vpn ukuthola i-inthanethi evikelekile, okusho ukuthi, ungasebenzisi i-inthanethi ku-vpn, susa umugqa othi "redirect-gateway".

Enye idatha engashintshwa:
* ca, cert, key kanye ne-dh = yibhizinisi, izitifiketi, ukhiye kanye ne-Diffie Hellman yeseva, sizodala ngokuhamba kwesikhathi.
* iseva 10.6.0.0 255.255.255.0 = uhla lwe-ip oluzosetshenziswa i-vpn, lusebenzise olunye kodwa, lungasebenzisi okufanayo nenethiwekhi yangempela.
* ifconfig-pool-persist ipp.txt = gcina ukuthi ngubani onikezwe ip ngayinye ku-vpn
* Proto and port = protocol netheku, ungasebenzisa i-tcp ne-utp, ku-utp ayinginikanga imiphumela emihle, itheku ungaliguqula.
* duplicate-cn = Ivumela isitifiketi esifanayo nokhiye ukuthi usetshenziswe kumakhasimende amaningi ngasikhathi sinye, ngincoma ukungawusebenzi.
* up /etc/openvpn/openvpn.up = ngumbhalo olayisha i-openvpn ekuqaleni, usetshenziselwa i-ROUTING ne-FORWARDING, sizoyakha ngokuhamba kwesikhathi.
* iklayenti-kuya-iklayenti = ukuvikela abasebenzisi be-vpn ekubonaneni, kuya ngokuthi icala liwusizo.
* comp-lzo = compression, cindezela yonke i-VPN traffic.
* isenzo 3 = sandisa noma sinciphisa imininingwane yephutha kuseva.
* Ama-max-amaklayenti 30 = inani eliphezulu labasebenzisi ngasikhathi sinye abaxhumeke kuseva, lingakhuphuka noma lehle.
* Push route = ikuvumela ukuthi ubone noma ube kunethiwekhi engemva kweseva ye-vpn, qaphela ukuthi unike iklayenti iklayenti amandla.
* Push «redirect = aphoqa iklayenti ukuthi lisebenzise i-VPN njengesango.

manje sakha iskripthi ukuze sikwazi ukumisa nokuqala iseva ye-vpn.

sudo nano /etc/init.d/vpnserver

futhi sinamathisela le khodi, sishintsha uhla lwe-ip ngokuya ngokucushwa kwesinyathelo sangaphambilini

#! / bin / sh # vpnserver_start () {echo "VPN Server [OK]" echo 1> / proc / sys / net / ipv4 / ip_forward /etc/init.d/networking restart> / dev / null / sbin / iptables -t nat -A POSTROUTING -s 10.6.0.0/24 -o eth0 -j MASQUERADE / usr / sbin / openvpn --config /etc/openvpn/server.conf 2 >> /etc/openvpn/error.txt 1 >> /etc/openvpn/normal.txt &} vpnserver_stop () {echo "VPN Server [NO]" / usr / bin / killall "openvpn" iptables -F iptables -X /etc/init.d/networking restart> / dev / null} vpnserver_restart () {vpnserver_stop sleep 1 vpnserver_start} # case "$ 1" in 'start') vpnserver_start ;; 'stop') vpnserver_stop ;; 'restart') vpnserver_restart ;; *) vpnserver_start ;; ukuthi uC

manje siyabela izimvume ezisebenzisekayo

sudo chmod + x /etc/init.d/vpnserver

futhi nokuthi yini ongayilungiselela ukuqala ngokuzenzakalela ngohlelo

sudo update-rc.d vpnserver okuzenzakalelayo

Yebo, sesivele siyilungisile i-OpenVPN, manje kufanele sisebenzise imodyuli ye-TUN ku-kernel, ngale migqa, siyayilayisha futhi yilokho kuphela

Sudo modprobe tun sudo echo "tun" >> / etc / modules

Njengoba uzobona, ukucushwa bekungekho nzima kangako, kepha manje kuza okuhamba kancane kakhulu:

* Dala 2048bit Diffie Hellman
* Dala Isiphathimandla Sezitifiketi.
* Dala izitifiketi nokhiye besiphakeli.
* Dala izitifiketi nokhiye womsebenzisi ngamunye.

Sikopisha izibonelo ezilula zokwenza ibhizinisi, izitifiketi, okhiye nokubethela, okusebenzisa i-OpenVPN,

Sudo cp -R / usr / share / doc / openvpn / example / easy-rsa / / etc / openvpn /

manje kufanele ufake ifolda lapho izinsiza esizikopishile zikhona futhi wakhe amafolda okhiye

sudo cp -R / usr / share / doc / openvpn / example / easy-rsa / / etc / openvpn / cd /etc/openvpn/easy-rsa/2.0 izinkinobho ze-sudo mkdir

Kumele sihlele kuphela ifayili le-vars eliku /etc/openvpn/easy-rsa/2.0

sudo nano /etc/openvpn/easy-rsa/2.0/vars

futhi siguqula lawa magugu

thekelisa KEY_DIR = "$ EASY_RSA / okhiye"

por

thekelisa KEY_DIR = "/ etc / openvpn / easy-rsa / 2.0 / keys"

ukukhiqiza yebo noma yebo ku /etc/openvpn/easy-rsa/2.0/keys
siyaqhubeka, sibuye siguqule nemingcele ye-Diffie Hellman yama-2048bits

ukuthekelisa KEY_SIZE = 1024

por

ukuthekelisa KEY_SIZE = 2048

siphuthelwa yimininingwane kuphela yebhizinisi elikhiphayo

thekelisa KEY_COUNTRY = "US" thekelisa KEY_PROVINCE = "CA" thekelisa KEY_CITY = "SanFrancisco" thekelisa KEY_ORG = "Fort-Funston" thekelisa KEY_EMAIL = "me@myhost.mydomain"

shintsha inani ngalinye lalelo lezwe lakho, isifundazwe, idolobha, inkampani ne-imeyili
Isibonelo

thekelisa KEY_COUNTRY = "AR" thekelisa KEY_PROVINCE = "SF" thekelisa KEY_CITY = "Armstrong" ukuthekelisa KEY_ORG = "LAGA-Systems" ukuthekelisa KEY_EMAIL = "info@lagasystems.com.ar"

Njengoba ubona i-AR = i-Argentina, i-SF = iSanta Fe (isifundazwe sami) nezinye ziyaqondana.
Manje sesikulungele ukuqala, silandele lezi zinyathelo encwadini, ngoba iphutha elilodwa futhi konke konakele.

sikhipha

umthombo ./vars

futhi usicela ukuthi sihlanze uma kungenzeka kube nezinhlangano, izitifiketi nokhiye, sikwenza ngenjabulo

./clean-all

manje senza ukuphepha kwe-Diffie Hellman kwama-2048bits

./build-dh

Manje sikhiqiza igunya lesitifiketi, lizobacela idatha efanayo neyamafayela e-vars, ngincoma ukuthi ngigcwalise ngayinye, yize isivele ikhona, akunandaba

./build-ca

Manje sesizokwazi ukukhiqiza izitifiketi nokhiye kuqala iseva, sishintshe iseva ibe yigama olithandayo, izocela idatha efanayo neyamafayela e-vars, ngincoma ukugcwalisa ngasinye, yize sezivele zikhona , akunandaba.

./build-key-server server

Sesinezitifiketi nokhiye be-server, manje iklayenti, shintsha iklayenti liye kunoma yiliphi igama olithandayo,
Izobuza idatha efanayo neyamafayela we-vars. Ngincoma ukuthi ngigcwalise ngayinye, yize isivele ikhona, akunandaba.

./ iklayenti lekhibhodi

Lesi sinyathelo kufanele siphindwe kwiklayenti ngalinye noma umsebenzisi ofuna ukuxhuma ku-VPN, sesivele sinakho konke ukusebenza, cha, sidinga ukukopisha amafayela esiwakhiqiza siye endaweni esiyilungiselela ku- openvpn.conf
njengoba ukopisha ifolda yokhiye ku / etc / openvpn /

sudo cp -R /etc/openvpn/easy-rsa/2.0/keys / njll / openvpn /

manje sibheka ukuthi yonke into isendaweni yayo, sifaka ifolda / etc / openvpn / keys

cd / njll / openvpn / okhiye

futhi nge-ls sibona ukuthi ngabe amafayela akhona yini
manje sakha elinye ifayili, lokhu kwenziwa yi-openvpn

Sudo openvpn --genkey --secret ta.key

Udinga kuphela ukukopisha amafayela ca.crt, client.crt, client.key, uma udale amaklayenti amaningi akopisha i-crt nokhiye ngamunye wependrive noma ezinye izindlela, ungasebenzisi i-imeyili ukuwathumela, kufana nokuthi unikeza ukhiye wendlu kumuntu ongamazi.

Silungile, konke kuseva, manje siyiqala ukuze sivivinye ukuthi konke kulungile

sudo /etc/init.d/vpnserver qala

Uma kungekho amaphutha, sesivele sisebenzisa i-vpn yethu, iklayenti kuphela elilahlekile.

Iklayenti:

Lo mhlahlandlela owe-Ubuntu 10.04 Desktop, ngicabanga ukuthi usebenza kwezinye izinhlobo nama-distros, sine-ubuntu esivele ifakiwe futhi isebenza.
Sifaka i-OpenVPN kanye ne-OpenSSL, ngoba ukuphepha kusekelwe ku-ssl
futhi njengoba sizosebenzisa i-Ubuntu Network Manager, kufanele sifake ama-plugins we-OpenVPN

Sudo apt-get -y ukufaka i-openvpn sudo apt-get -y ukufaka i-openssl sudo apt-ukufaka inethiwekhi-umphathi-openvpn

Manje sesikwazi ukumisela iklayenti lethu isibonelo sokumisa:

Ngomhleli wombhalo, i-gedit ingaba, unamathisele le khodi

iklayenti dev tun proto tcp eyi-SERVER-IP PORT eyi-solv-try kabusha infinite nobind #user nobody #group nobody persist-key key-tun ca.crt client cert.crt key client.key comp-lzo tun-mtu 1500 keepalive 10 120 verb 4

Baguqula idatha, i-IP-DEL-SERVER lena yi-IP yomphakathi noma ye-inthanethi yeseva ne-PORT abazinikeze ngayo kuseva, amafayela ca.crt, amaklayenti.crt kanye neklayenti.key yilawo esiwakhiqizile futhi sawakopisha. ngaphambi kwependrive noma yini.

Uma une-Dynamic Public IP, ngincoma ukuthi usebenzise insiza ye-DDNS (DyDNS, NO-IP, CDMon), futhi ungakhohlwa ukuvula nokuqondisa kabusha itheku 1194 noma lelo olikhethele iseva.

Balondoloza ikhodi ngegama abalifunayo kodwa ngesandiso se-.conf nakwifolda efanayo neyefayela le-ca.crt, iklayenti.crt kanye neklayenti.

Manje vula i-Ubuntu Network Manager futhi kuthebhu ye-VPN kunenkinobho yokungenisa, funa ifayela le-.conf ebesiligcine ngaphambili futhi yilokho kuphela.

Ngiyethemba ukuthi iyakusiza, ngoba ukwenza i-openvpn work ngidlule kuyo yonke imihlahlandlela namabhukwana engiwatholile.

Ngiyabonga ngemibono yakho, uma kukhona IPHUTHA kungumphumela womcabango wakho, hahaha