Установка и настройка OpenVPN-сервера на Debian8

Июль 7th, 2016

Evgeniy Kamenev

1.Установка OpenVPN-сервера

# apt-get install openvpn openssl

1	# apt-get install openvpn openssl

# mkdir /etc/openvpn/easy-rsa/

1	# mkdir /etc/openvpn/easy-rsa/

# cp -r /usr/share/easy-rsa/* /etc/openvpn/easy-rsa/

1	# cp -r /usr/share/easy-rsa/* /etc/openvpn/easy-rsa/

# cd /etc/openvpn/easy-rsa/

1	# cd /etc/openvpn/easy-rsa/

2.Настройка переменных окружения

# nano  vars

1	# nano vars

export KEY_COUNTRY="UA"
export KEY_PROVINCE="Kharkov"
export KEY_CITY="Kharkov"
export KEY_ORG="IT"
export KEY_EMAIL="admin@mydomain.com"
export KEY_OU="IT-Department"

export KEY_COUNTRY="UA"

export KEY_PROVINCE="Kharkov"

export KEY_CITY="Kharkov"

export KEY_ORG="IT"

export KEY_EMAIL="admin@mydomain.com"

export KEY_OU="IT-Department"

Выполняем инициализацию переменных.

# source ./vars

1	# source ./vars

NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/keys

1	NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/keys

Удаляем старые ключи

# ./clean-all

1	# ./clean-all

3.Создание сертификатов и ключей

Создаём корневой сертификат и ключ:

# ./build-ca

1	# ./build-ca

Generating a 2048 bit RSA private key
....+++
.....................+++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [UA]:
State or Province Name (full name) [Kharkov]:
Locality Name (eg, city) [Kharkov]:
Organization Name (eg, company) [IT]:
Organizational Unit Name (eg, section) [IT-Department]:
Common Name (eg, your name or your server's hostname) [IT CA]:server
Name [EasyRSA]:
Email Address [admin@mydomain.com]:

Generating a 2048 bit RSA private key

....+++

.....................+++

writing new private key to 'ca.key'

-----

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [UA]:

State or Province Name (full name) [Kharkov]:

Locality Name (eg, city) [Kharkov]:

Organization Name (eg, company) [IT]:

Organizational Unit Name (eg, section) [IT-Department]:

Common Name (eg, your name or your server's hostname) [IT CA]:server

Name [EasyRSA]:

Email Address [admin@mydomain.com]:

Создаём сертификат и ключ для сервера:

# ./build-key-server server

1	# ./build-key-server server

Generating a 2048 bit RSA private key
................+++
...............+++
writing new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [UA]:
State or Province Name (full name) [Kharkov]:
Locality Name (eg, city) [Kharkov]:
Organization Name (eg, company) [IT]:
Organizational Unit Name (eg, section) [IT-Department]:
Common Name (eg, your name or your server's hostname) [server]:
Name [EasyRSA]:
Email Address [admin@mydomain.com]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'UA'
stateOrProvinceName   :PRINTABLE:'Kharkov'
localityName          :PRINTABLE:'Kharkov'
organizationName      :PRINTABLE:'IT'
organizationalUnitName:PRINTABLE:'IT-Department'
commonName            :PRINTABLE:'server'
name                  :PRINTABLE:'EasyRSA'
emailAddress          :IA5STRING:'admin@mydomain.com'
Certificate is to be certified until Jul  4 20:31:26 2026 GMT (3650 days)
Sign the certificate? [y/n]:y 



1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

Generating a 2048 bit RSA private key

................+++

...............+++

writing new private key to 'server.key'

-----

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [UA]:

State or Province Name (full name) [Kharkov]:

Locality Name (eg, city) [Kharkov]:

Organization Name (eg, company) [IT]:

Organizational Unit Name (eg, section) [IT-Department]:

Common Name (eg, your name or your server's hostname) [server]:

Name [EasyRSA]:

Email Address [admin@mydomain.com]:

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.0.cnf

Check that the request matches the signature

Signature ok

The Subject's Distinguished Name is as follows

countryName :PRINTABLE:'UA'

stateOrProvinceName :PRINTABLE:'Kharkov'

localityName :PRINTABLE:'Kharkov'

organizationName :PRINTABLE:'IT'

organizationalUnitName:PRINTABLE:'IT-Department'

commonName :PRINTABLE:'server'

name :PRINTABLE:'EasyRSA'

emailAddress :IA5STRING:'admin@mydomain.com'

Certificate is to be certified until Jul 4 20:31:26 2026 GMT (3650 days)

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated

Создаем ключ и сертификат для клиента user1

# ./build-key user1

1	# ./build-key user1

Generating a 2048 bit RSA private key
................................................................+++
...................................+++
writing new private key to 'user1.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [UA]:
State or Province Name (full name) [Kharkov]:
Locality Name (eg, city) [Kharkov]:
Organization Name (eg, company) [IT]:
Organizational Unit Name (eg, section) [IT-Department]:
Common Name (eg, your name or your server's hostname) [user1]:
Name [EasyRSA]:
Email Address [admin@mydomain.com]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'UA'
stateOrProvinceName   :PRINTABLE:'Kharkov'
localityName          :PRINTABLE:'Kharkov'
organizationName      :PRINTABLE:'IT'
organizationalUnitName:PRINTABLE:'IT-Department'
commonName            :PRINTABLE:'user1'
name                  :PRINTABLE:'EasyRSA'
emailAddress          :IA5STRING:'admin@mydomain.com'
Certificate is to be certified until Jul  4 20:32:23 2026 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

Generating a 2048 bit RSA private key

................................................................+++

...................................+++

writing new private key to 'user1.key'

-----

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [UA]:

State or Province Name (full name) [Kharkov]:

Locality Name (eg, city) [Kharkov]:

Organization Name (eg, company) [IT]:

Organizational Unit Name (eg, section) [IT-Department]:

Common Name (eg, your name or your server's hostname) [user1]:

Name [EasyRSA]:

Email Address [admin@mydomain.com]:

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.0.cnf

Check that the request matches the signature

Signature ok

The Subject's Distinguished Name is as follows

countryName :PRINTABLE:'UA'

stateOrProvinceName :PRINTABLE:'Kharkov'

localityName :PRINTABLE:'Kharkov'

organizationName :PRINTABLE:'IT'

organizationalUnitName:PRINTABLE:'IT-Department'

commonName :PRINTABLE:'user1'

name :PRINTABLE:'EasyRSA'

emailAddress :IA5STRING:'admin@mydomain.com'

Certificate is to be certified until Jul 4 20:32:23 2026 GMT (3650 days)

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated

Аналогично создадим ключ для второго клиента user2

# ./build-key user2

1	# ./build-key user2

Generating a 2048 bit RSA private key
...................+++
.............................+++
writing new private key to 'user2.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [UA]:
State or Province Name (full name) [Kharkov]:
Locality Name (eg, city) [Kharkov]:
Organization Name (eg, company) [IT]:
Organizational Unit Name (eg, section) [IT-Department]:
Common Name (eg, your name or your server's hostname) [user2]:
Name [EasyRSA]:
Email Address [admin@mydomain.com]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'UA'
stateOrProvinceName   :PRINTABLE:'Kharkov'
localityName          :PRINTABLE:'Kharkov'
organizationName      :PRINTABLE:'IT'
organizationalUnitName:PRINTABLE:'IT-Department'
commonName            :PRINTABLE:'user2'
name                  :PRINTABLE:'EasyRSA'
emailAddress          :IA5STRING:'admin@mydomain.com'
Certificate is to be certified until Jul  4 20:33:19 2026 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

Generating a 2048 bit RSA private key

...................+++

.............................+++

writing new private key to 'user2.key'

-----

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [UA]:

State or Province Name (full name) [Kharkov]:

Locality Name (eg, city) [Kharkov]:

Organization Name (eg, company) [IT]:

Organizational Unit Name (eg, section) [IT-Department]:

Common Name (eg, your name or your server's hostname) [user2]:

Name [EasyRSA]:

Email Address [admin@mydomain.com]:

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.0.cnf

Check that the request matches the signature

Signature ok

The Subject's Distinguished Name is as follows

countryName :PRINTABLE:'UA'

stateOrProvinceName :PRINTABLE:'Kharkov'

localityName :PRINTABLE:'Kharkov'

organizationName :PRINTABLE:'IT'

organizationalUnitName:PRINTABLE:'IT-Department'

commonName :PRINTABLE:'user2'

name :PRINTABLE:'EasyRSA'

emailAddress :IA5STRING:'admin@mydomain.com'

Certificate is to be certified until Jul 4 20:33:19 2026 GMT (3650 days)

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated

Cоздаем ключ Диффи-Хелмана (Diffie Hellman)

# ./build-dh

1	# ./build-dh

Создаем общий для клиентов и сервера TLS-ключ:

# openvpn --genkey --secret keys/ta.key

1	# openvpn --genkey --secret keys/ta.key

Команды для проверки созданных сертификатов

# openssl verify -CAfile /etc/openvpn/easy-rsa/keys/ca.crt /etc/openvpn/easy-rsa/keys/server.crt

1	# openssl verify -CAfile /etc/openvpn/easy-rsa/keys/ca.crt /etc/openvpn/easy-rsa/keys/server.crt

/etc/openvpn/easy-rsa/keys/server.crt: OK

1	/etc/openvpn/easy-rsa/keys/server.crt: OK

# openssl verify -CAfile /etc/openvpn/easy-rsa/keys/ca.crt /etc/openvpn/easy-rsa/keys/user1.crt

1	# openssl verify -CAfile /etc/openvpn/easy-rsa/keys/ca.crt /etc/openvpn/easy-rsa/keys/user1.crt

/etc/openvpn/easy-rsa/keys/user1.crt: OK

1	/etc/openvpn/easy-rsa/keys/user1.crt: OK

# openssl verify -CAfile /etc/openvpn/easy-rsa/keys/ca.crt  /etc/openvpn/easy-rsa/keys/user2.crt

1	# openssl verify -CAfile /etc/openvpn/easy-rsa/keys/ca.crt /etc/openvpn/easy-rsa/keys/user2.crt

/etc/openvpn/easy-rsa/keys/user2.crt: OK

1	/etc/openvpn/easy-rsa/keys/user2.crt: OK

Ключи/сертификаты, которые использует сервер

ca.crt
server.crt
server.key
dh2048.pem
ta.key

ca.crt

server.crt

server.key

dh2048.pem

ta.key

Ключи/сертификаты, которые использует клиент(например, user1)

user1.crt
user1.key
ca.crt
ta.key

user1.crt

user1.key

ca.crt

ta.key

4.Настройка OpenVPN-сервера
Создаем отдельный каталог для хранения ключей/сертификатов необходимых серверу

# mkdir /etc/openvpn/keys

1	# mkdir /etc/openvpn/keys

Копируем все необходимые серверу ключи/сертификаты в этот каталог

# cp /etc/openvpn/easy-rsa/keys/{ca.crt,server.crt,server.key,dh2048.pem,ta.key} /etc/openvpn/keys/

1	# cp /etc/openvpn/easy-rsa/keys/{ca.crt,server.crt,server.key,dh2048.pem,ta.key} /etc/openvpn/keys/

Настройка конфигурационного файла OpenVPN-сервера

# cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/

1	# cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/

# gzip -d  /etc/openvpn/server.conf.gz

1	# gzip -d /etc/openvpn/server.conf.gz

# nano /etc/openvpn/server.conf

1	# nano /etc/openvpn/server.conf

#  Внешний IP-адрес OpenVPN-сервера, на котором слушать запросы
local 136.243.XXX.YYY

# Порт для подключений к OpenVPN-серверу.Открываем его в iptables
port 1194

# Вид протокола (tcp или udp)
proto tcp

# Устройство
dev tun

# Явное указание, что данный хост является TLS сервером
tls-server

# Расположение сертификатов и ключей
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key
dh /etc/openvpn/keys/dh2048.pem

# Виртуальная сеть, которая будет установлена между клиентом и сервером
server 10.10.10.0 255.255.255.0

# Файл, в который будет записываться соответствие имени клиента и IP-адреса, который ему выделил VPN-сервер
ifconfig-pool-persist ipp.txt

# Разрешаем клиентам обмениваться пакетами(по умолчанию клиент видит только сервер)
client-to-client

# Расскомментировать,если используется один ключ/сертификат или одно имя клиента(common name) на несколько клиентов
;duplicate-cn

# Проверяем соединение каждые 10 секунд, если его нет то через 120 секунд переподключаем
keepalive 10 120

# На стороне сервера 0, на стороне клиента 1
tls-auth /etc/openvpn/keys/ta.key 0 
tls-timeout 120

# Используем сжатие
comp-lzo

# Максимальное количество клиентов
;max-clients 100

# Назначаем пользователя и группу для работы с OpenVPN
user nobody
group nogroup

# Не перечитывать ключи после получения SIGUSR1 или ping-restart
persist-key

# Не закрывать или переоткрывать TUN\TAP устройство, после получения SIGUSR1 или ping-restart
persist-tun

# Записывать статус сервера OpenVPN
status /var/log/openvpn/openvpn-status.log

# Логи
log         /var/log/openvpn/openvpn.log

# Уровень отладки
verb 3

;mute 20

# Внешний IP-адрес OpenVPN-сервера, на котором слушать запросы

local 136.243.XXX.YYY

# Порт для подключений к OpenVPN-серверу.Открываем его в iptables

port 1194

# Вид протокола (tcp или udp)

proto tcp

# Устройство

dev tun

# Явное указание, что данный хост является TLS сервером

tls-server

# Расположение сертификатов и ключей

ca /etc/openvpn/keys/ca.crt

cert /etc/openvpn/keys/server.crt

key /etc/openvpn/keys/server.key

dh /etc/openvpn/keys/dh2048.pem

# Виртуальная сеть, которая будет установлена между клиентом и сервером

server 10.10.10.0 255.255.255.0

# Файл, в который будет записываться соответствие имени клиента и IP-адреса, который ему выделил VPN-сервер

ifconfig-pool-persist ipp.txt

# Разрешаем клиентам обмениваться пакетами(по умолчанию клиент видит только сервер)

client-to-client

# Расскомментировать,если используется один ключ/сертификат или одно имя клиента(common name) на несколько клиентов

;duplicate-cn

# Проверяем соединение каждые 10 секунд, если его нет то через 120 секунд переподключаем

keepalive 10 120

# На стороне сервера 0, на стороне клиента 1

tls-auth /etc/openvpn/keys/ta.key 0

tls-timeout 120

# Используем сжатие

comp-lzo

# Максимальное количество клиентов

;max-clients 100

# Назначаем пользователя и группу для работы с OpenVPN

user nobody

group nogroup

# Не перечитывать ключи после получения SIGUSR1 или ping-restart

persist-key

# Не закрывать или переоткрывать TUN\TAP устройство, после получения SIGUSR1 или ping-restart

persist-tun

# Записывать статус сервера OpenVPN

status /var/log/openvpn/openvpn-status.log

# Логи

log /var/log/openvpn/openvpn.log

# Уровень отладки

verb 3

;mute 20

#  mkdir /var/log/openvpn && touch /var/log/openvpn/{openvpn.log,openvpn-status.log

1	# mkdir /var/log/openvpn && touch /var/log/openvpn/{openvpn.log,openvpn-status.log

# /etc/init.d/openvpn start

1	# /etc/init.d/openvpn start

[ ok ] Starting openvpn (via systemctl): openvpn.service.

1	[ ok ] Starting openvpn (via systemctl): openvpn.service.

Проверка корректности запуска OpenVPN-сервера

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.10.10.1  P-t-P:10.10.10.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00

inet addr:10.10.10.1 P-t-P:10.10.10.2 Mask:255.255.255.255

UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1

RX packets:0 errors:0 dropped:0 overruns:0 frame:0

TX packets:0 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:100

RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

# netstat -nlpt | grep 1194

1	# netstat -nlpt \| grep 1194

tcp        0      0 136.243.XXX.YYY:1194     0.0.0.0:*               LISTEN      1017/openvpn

1	tcp 0 0 136.243.XXX.YYY:1194 0.0.0.0:* LISTEN 1017/openvpn

# ps ax | grep [o]penvpn

1	# ps ax \| grep [o]penvpn

946 ?        Ss     0:00 /usr/sbin/openvpn --daemon ovpn-server --status /run/openvpn/server.status 10 --cd /etc/openvpn --config /etc/openvpn/server.conf

1	946 ? Ss 0:00 /usr/sbin/openvpn --daemon ovpn-server --status /run/openvpn/server.status 10 --cd /etc/openvpn --config /etc/openvpn/server.conf

Настройка iptables

# apt-get install iptables-persistent

1	# apt-get install iptables-persistent

# iptables -A INPUT -p tcp --dport 1194 -j ACCEPT

1	# iptables -A INPUT -p tcp --dport 1194 -j ACCEPT

# service netfilter-persistent save && service netfilter-persistent restart

1	# service netfilter-persistent save && service netfilter-persistent restart

5.Настройка OpenVPN-клиента на Windows
Скачиваем и устанавливаем OpenVPN-клиент под Windows
https://openvpn.net/index.php/open-source/downloads.html
C:\Program Files(x86)\OpenVPN\config\client.ovpn-32-разрядная операц.система
C:\Program Files\OpenVPN\config\client.ovpn – 64-разрядная операц.система

client
dev tun
proto tcp
remote 136.243.XXX.YYY 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert user1.crt
key user1.key
tls-auth ta.key 1
keepalive 10 120
comp-lzo
verb 4
mute 10

client

dev tun

proto tcp

remote 136.243.XXX.YYY 1194

resolv-retry infinite

nobind

persist-key

persist-tun

ca ca.crt

cert user1.crt

key user1.key

tls-auth ta.key 1

keepalive 10 120

comp-lzo

verb 4

mute 10

При подключении клиента
Логи OpenVPN-сервера

Wed Jul  6 17:37:33 2016 user1/159.224.XXX.YYY:53635 MULTI: primary virtual IP for user1/159.224.XXX.YYY:53635: 10.10.10.6
Wed Jul  6 17:37:35 2016 user1/159.224.XXX.YYY:53635 PUSH: Received control message: 'PUSH_REQUEST'
Wed Jul  6 17:37:35 2016 user1/159.224.XXX.YYY:53635 send_push_reply(): safe_cap=940
Wed Jul  6 17:37:35 2016 user1/159.224.XXX.YYY:53635 SENT CONTROL [user1]: 'PUSH_REPLY,route 10.10.10.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.10.10.6 10.10.10.5' (status=1)

Wed Jul 6 17:37:33 2016 user1/159.224.XXX.YYY:53635 MULTI: primary virtual IP for user1/159.224.XXX.YYY:53635: 10.10.10.6

Wed Jul 6 17:37:35 2016 user1/159.224.XXX.YYY:53635 PUSH: Received control message: 'PUSH_REQUEST'

Wed Jul 6 17:37:35 2016 user1/159.224.XXX.YYY:53635 send_push_reply(): safe_cap=940

Wed Jul 6 17:37:35 2016 user1/159.224.XXX.YYY:53635 SENT CONTROL [user1]: 'PUSH_REPLY,route 10.10.10.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.10.10.6 10.10.10.5' (status=1)

В лог-файле статуса OpenVPN

# tail -f /var/log/openvpn/openvpn-status.log

1	# tail -f /var/log/openvpn/openvpn-status.log

OpenVPN CLIENT LIST
Updated,Wed Jul  6 17:39:06 2016
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
user1,159.224.XXX.YYY:53635,20746,8494,Wed Jul  6 17:37:30 2016
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
10.10.10.6,user1,159.224.XXX.YYY:53635,Wed Jul  6 17:37:33 2016
GLOBAL STATS
Max bcast/mcast queue length,0
END

OpenVPN CLIENT LIST

Updated,Wed Jul 6 17:39:06 2016

Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since

user1,159.224.XXX.YYY:53635,20746,8494,Wed Jul 6 17:37:30 2016

ROUTING TABLE

Virtual Address,Common Name,Real Address,Last Ref

10.10.10.6,user1,159.224.XXX.YYY:53635,Wed Jul 6 17:37:33 2016

GLOBAL STATS

Max bcast/mcast queue length,0

END

IP-адрес,который получил клиент записывается в файл /etc/openvpn/ipp.txt

# cat /etc/openvpn/ipp.txt

1	# cat /etc/openvpn/ipp.txt

user1,10.10.10.6

1	user1,10.10.10.6

Если необходимо выделить определенному клиенту конкретный IP-адрес
Добавляем в файл настройки OpenVPN-сервера server.conf

client-config-dir /etc/openvpn/ccd

1	client-config-dir /etc/openvpn/ccd

После чего создаем файл с именем клиента в каталоге /etc/openvpn/ccd
Например, common name при создании сертификата/ключа для клиента было user1

# nano /etc/openvpn/ccd/user1

1	# nano /etc/openvpn/ccd/user1

ifconfig-push 10.10.10.13 10.10.10.14

1	ifconfig-push 10.10.10.13 10.10.10.14

При назначении IP-адреса нужно иметь ввиду
А) все IP-адреса должны входить в сеть VPN-сервера 10.10.10.0/24
Б) должны иметь префикс /30
Список совместимых пар

[  1,  2] [  5,  6] [  9, 10] [ 13, 14] [ 17, 18]
[ 21, 22] [ 25, 26] [ 29, 30] [ 33, 34] [ 37, 38]
[ 41, 42] [ 45, 46] [ 49, 50] [ 53, 54] [ 57, 58]
[ 61, 62] [ 65, 66] [ 69, 70] [ 73, 74] [ 77, 78]
[ 81, 82] [ 85, 86] [ 89, 90] [ 93, 94] [ 97, 98]
[101,102] [105,106] [109,110] [113,114] [117,118]
[121,122] [125,126] [129,130] [133,134] [137,138]
[141,142] [145,146] [149,150] [153,154] [157,158]
[161,162] [165,166] [169,170] [173,174] [177,178]
[181,182] [185,186] [189,190] [193,194] [197,198]
[201,202] [205,206] [209,210] [213,214] [217,218]
[221,222] [225,226] [229,230] [233,234] [237,238]
[241,242] [245,246] [249,250] [253,254]

[ 1, 2] [ 5, 6] [ 9, 10] [ 13, 14] [ 17, 18]

[ 21, 22] [ 25, 26] [ 29, 30] [ 33, 34] [ 37, 38]

[ 41, 42] [ 45, 46] [ 49, 50] [ 53, 54] [ 57, 58]

[ 61, 62] [ 65, 66] [ 69, 70] [ 73, 74] [ 77, 78]

[ 81, 82] [ 85, 86] [ 89, 90] [ 93, 94] [ 97, 98]

[101,102] [105,106] [109,110] [113,114] [117,118]

[121,122] [125,126] [129,130] [133,134] [137,138]

[141,142] [145,146] [149,150] [153,154] [157,158]

[161,162] [165,166] [169,170] [173,174] [177,178]

[181,182] [185,186] [189,190] [193,194] [197,198]

[201,202] [205,206] [209,210] [213,214] [217,218]

[221,222] [225,226] [229,230] [233,234] [237,238]

[241,242] [245,246] [249,250] [253,254]

Клиенты могут иметь доступ друг к другу (включена опция на сервере client-to-client)

Для того, чтобы клиенты в качестве шлюза по умолчанию использовали OpenVPN-сервер и выходили в Интернет через OpenVPN-сервер
1.Включаем маршрутизацию на OpenVPN-сервере

# nano /etc/sysctl.conf

1	# nano /etc/sysctl.conf

net.ipv4.ip_forward = 1

1	net.ipv4.ip_forward = 1

# sysctl  -p

1	# sysctl -p

2.Добавляем строки в конф.файл OpenVPN-сервера server.conf

push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

push "redirect-gateway def1 bypass-dhcp"

push "dhcp-option DNS 8.8.8.8"

push "dhcp-option DNS 8.8.4.4"

3.Настраиваем NAT

# iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -j MASQUERADE

1	# iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -j MASQUERADE

# iptables  -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

1	# iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

# iptables  -A FORWARD -s 10.10.10.0/24 -i tun0 -j ACCEPT

1	# iptables -A FORWARD -s 10.10.10.0/24 -i tun0 -j ACCEPT

# service netfilter-persistent save && service netfilter-persistent restart

1	# service netfilter-persistent save && service netfilter-persistent restart

# /etc/init.d/openvpn restart

1	# /etc/init.d/openvpn restart

[ ok ] Restarting openvpn (via systemctl): openvpn.service.

1	[ ok ] Restarting openvpn (via systemctl): openvpn.service.

После переподключения клиента в логе OpenVPN-сервера

SENT CONTROL [user1]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.10.10.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.10.10.6 10.10.10.5' (status=1)

1	SENT CONTROL [user1]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.10.10.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.10.10.6 10.10.10.5' (status=1)

Теперь Windows клиент будет выходить в интернет через OpenVPN-сервер, а не через своего провайдера
(проверяем через route print, tracert google.com, myip в браузере)

Опубликовано в рубрике Debian/Ubuntu, Other

Метки: Openvpn, vpn

Комментирование и размещение ссылок запрещено.

Комментарии закрыты.

Установка и настройка OpenVPN-сервера на Debian8

Страницы

Свежие записи

Архивы

Рубрики

Админ-панель