Hoʻonohonoho kikowaena VPN ma Linux: PPTP a i ʻole OpenVPN?

I kēia mau lā, ʻoi aku ka kaulana o ka ʻenehana VPN. Hoʻohana nā mea hoʻohana maʻamau i ka VPN e komo palekana i ka Pūnaewele. Kōkua ia i ka hele ʻana i nā pūnaewele a me nā lawelawe i hoʻopaʻa ʻia a pale aku i ka hana ʻino o waho. Ke hoʻopili nei ʻoe i kahi kikowaena VPN, aia kahi alahele palekana ma waena o kāu kamepiula a me ke kikowaena ʻaʻole hiki ke kiʻi ʻia mai waho, no laila e lilo ka server VPN i kāu wahi e komo ai i ka Pūnaewele. Nui nā lawelawe VPN ma laila, manuahi a uku ʻia, akā inā ʻaʻole lākou e hana iā ʻoe no kekahi kumu, hiki iā ʻoe ke hoʻonohonoho mau i kāu kikowaena VPN.

No ka holo ʻana i kāu VPN oun, pono ʻoe e hoʻolimalima i kahi kikowaena VPS . Aia nā polokalamu like ʻole e hiki ai iā ʻoe ke hana i kahi pilina VPN. He ʻokoʻa ia mai kekahi i kekahi ma o nā ʻōnaehana hana i kākoʻo ʻia a me nā algorithms i hoʻohana ʻia. E nānā mākou i ʻelua mau ala kūʻokoʻa e hoʻonohonoho i kahi kikowaena VPN. ʻO ka mea mua e pili ana i ka protocol PPTP i manaʻo ʻia he kahiko a ʻaʻole palekana akā maʻalahi loa ke hoʻonohonoho. Hoʻohana kekahi i ka polokalamu OpenVPN hou a palekana akā koi ʻia ka hoʻokomo ʻana i kahi noi mea kūʻai aku ʻaoʻao ʻekolu a me kahi kaʻina hoʻonohonoho piha.

I kā mākou hoʻāʻo ʻana, e hoʻohana mākou i kahi kikowaena virtual i hoʻohana ʻia e ka Ubuntu Server 18.04. E hoʻopau ʻia kahi pā ahi ma ke kikowaena no ka mea e pono ana kāna hoʻonohonoho ʻana i kahi ʻatikala kaʻawale. E wehewehe mākou i ke kaʻina hana hoʻonohonoho ma Windows 10.

e hoomakaukau ai

ʻAʻohe mea VPN āu e koho ai, e hoʻonohonoho ʻia ka ʻike pūnaewele e nā ala hoʻohui o ka ʻōnaehana hana. No ka wehe ʻana i ka ʻike pūnaewele ma o kahi kikowaena lawelawe waho, pono ʻoe e ʻae i ka hoʻouna ʻana i ka packet ma waena o nā mea hoʻopili a hoʻonohonoho i ka unuhi ʻōlelo helu pūnaewele.

No ka hoʻā ʻana i ka hoʻouna ʻana i ka packet, wehe i ka faila "/etc/sysctl.conf" a hoʻololi i ka waiwai o ka parameter "net.ipv4.ip_forward" i 1.

No ka hoʻohana ʻana i nā loli me ka ʻole e hoʻomaka hou i ke kamepiula, e holo i ke kauoha

sudo sysctl -p /etc/sysctl.conf

Hoʻonohonoho ʻia ka unuhi ʻana o ka helu wahi pūnaewele e nā ʻano o iptables . ʻO ka mea mua, e nānā i ka inoa o kāu interface pūnaewele waho e holo ana i ke kauoha "ip link show" - e pono ʻoe iā ia ma ka hana aʻe. ʻO ko mākou inoa ʻo "ens3".

E hoʻā i ka unuhi ʻana i ka helu wahi pūnaewele ma kāu interface waho no nā node pūnaewele kūloko.

sudo iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE

E hoʻomaopopo pono ʻoe e kuhikuhi i ka inoa maoli o kāu kikowaena kikowaena, hiki ke ʻokoʻa mai kā mākou.

Ma ka paʻamau, hoʻonohonoho hou ʻia nā lula āpau i hana ʻia e iptables ma hope o ka hoʻomaka hou ʻana o ke kikowaena. I mea e pale aku ai i kēlā, e hoʻohana i ka pono hana "iptables-persisten" . E hoʻouka i ka pūʻolo aʻe:

sudo apt install iptables-persistent

I kekahi manawa i ke kaʻina hana hoʻonohonoho, e ʻike ʻoe i kahi puka makani hoʻonohonoho e hōʻike ana iā ʻoe e mālama i nā lula iptables o kēia manawa. ʻOiai ua wehewehe mua ʻia nā lula, e hōʻoia wale a kaomi iā "ʻAe" ʻelua. I kēia manawa e hoʻopili ʻia nā lula ma hope o ka hoʻomaka hou ʻana o ke kikowaena.

Mea lawelawe PPTP

Hoʻonohonoho kikowaena

E hoʻouka i ka ʻeke:

sudo apt install pptpd

Ma hope o ka pau ʻana o ke kau ʻana, e wehe i ka faila "/etc/pptpd.conf" ma kekahi mea hoʻoponopono kikokikona a hoʻoponopono iā ia penei:

option /etc/ppp/pptpd-options #path to the settings file
logwtmp #client connections logging mechanism
connections 100 #number of simultaneous connections
localip 172.16.0.1 #the address that will serve as a client gateway
remoteip 172.16.0.2-200 #range of addresses

Ma hope o kēlā, e hoʻoponopono i ka faila "/etc/ppp/pptpd-options" . Hoʻonohonoho ʻia ka hapa nui o nā palena ma ka paʻamau.

#name of the service for new client records
name pptpd

#restrict obsolete authentication methods
refuse-pap
refuse-chap
refuse-mschap

#allow a more secure authentication method
require-mschap-v2

#enable encryption
require-mppe-128

#specify dns servers for clients (use any available servers)
ms-dns 8.8.8.8
ms-dns 8.8.4.4

proxyarp
nodefaultroute
lock
nobsdcomp
novj
novjccomp
nologfd

Ma ke kahua aʻe, pono ʻoe e hana i kahi moʻolelo no nā pilina o ka mea kūʻai aku. E ʻōlelo kākou makemake ʻoe e hoʻohui i kahi mea hoʻohana "vpnuser" me ka ʻōlelo huna "1" a ʻae i ka helu ʻana i nā ʻōlelo hoʻololi nona. E wehe i ka faila "/etc/ppp/chap-secrets" a hoʻohui i ka laina aʻe me nā palena o ka mea hoʻohana ma ka hopena o ka faila:

vpnuser pptpd 1 *

ʻO ka waiwai "pptpd" ka inoa o ka lawelawe a mākou i kuhikuhi ai ma ka faila "pptpd-options" . Ma kahi o "*" hiki iā ʻoe ke kuhikuhi i kahi helu IP paʻa. I ka hopena, pono e like me kēia ka faila "chap-secrets" :

No ka hoʻopili ʻana i nā hoʻonohonoho e hoʻihoʻi i ka lawelawe pptpd a hoʻohui iā ia i ka autoloading.

sudo systemctl restart pptpd
sudo systemctl enable pptpd

Ua pau ka hoʻonohonoho kikowaena.

Hoʻonohonoho mea kūʻai aku

E wehe i ka "Start" - "Settings" - "Network & Internet" - "VPN" a kaomi iā "Add a VPN connection"

E hoʻokomo i nā palena pili ma ka puka makani i wehe ʻia a kaomi iā "Save".

• Mea hoʻolako VPN: “Windows (built-in)”
• Ka inoa pili: "vpn_connect" (hiki iā ʻoe ke koho i kekahi inoa)
• Ka inoa kikowaena a i ʻole ka helu wahi: (e wehewehe i ka helu IP waho o ke kikowaena)
• ʻAno VPN: “Auto”
• Ke ʻano o ka ʻike komo: "Inoa mea hoʻohana a me ka ʻōlelo huna"
• Inoa mea hoʻohana: vpnuser (inoa i kuhikuhi ʻia ma ka faila "chap-secrets" ma ke kikowaena)
• Hua huna: 1 (e like me ka waihona "chap-secrets")

Ma hope o ka mālama ʻana i nā palena, e ʻike ʻoe i ka pilina VPN hou ma ka puka makani. Kaomi hema i ka pilina a koho iā "Connect" . Inā pili pono, e ʻike ʻoe i ke kūlana "Connected".

Ma nā Koho, e ʻike ʻoe i nā helu wahi kūloko o ka mea kūʻai aku a me ke kikowaena. Hōʻike ke kahua "Destination address" i ka helu wahi kikowaena waho.

Ke hoʻopili ʻia, ʻo ka helu wahi IP kūloko o ke kikowaena, ʻo 172.16.0.1 i ko mākou hihia, lilo ia i puka paʻamau no nā pākēkē āpau i waho.

Me ka hoʻohana ʻana i kekahi lawelawe pūnaewele hiki iā ʻoe ke hōʻoia i ka like ʻana o ka helu IP waho o ke kamepiula me ka IP address o kāu kikowaena VPN.

OpenVPN kikowaena pūnaewele

Hoʻonohonoho kikowaena

E paipai kākou i ka pae ʻae o ka mea hoʻohana i kēia manawa no ka mea no kā mākou hoʻonohonoho hou e pono ai mākou i ke aʻa.

sudo -s

E hoʻouka i nā ʻeke āpau e pono ai. Pono mākou i ka ʻeke "Easy-RSA" e hoʻokele i nā kī hoʻopāʻālua.

apt install openvpn easy-rsa iptables-persistent

E ʻae i nā pilina e komo mai ana ma ke awa 1194 ma o ka protocol UDP a hoʻopili i nā lula iptables.

sudo iptables -I INPUT -p udp --dport 1194 -j ACCEPT

sudo netfilter-persistent save

E hana i kahi papa kuhikuhi me nā faila i kope ʻia mai ka pūʻolo "Easy-RSA" a hoʻokele i loko.

make-cadir ~/openvpn

cd ~/openvpn

E hoʻomohala i nā ʻōnaehana kī lehulehu (PKI).

./easyrsa init-pki

E hana i ka palapala aʻa palapala Mana Mana (CA).

./easyrsa build-ca

I ka wā o ka hana ʻana, e koi ʻia ʻoe e hoʻonohonoho a hoʻomanaʻo i kahi ʻōlelo huna. Pono ʻoe e pane i nā nīnau a hoʻokomo i ka ʻike e pili ana i ka mea nona ke kī. Hiki iā ʻoe ke waiho i nā waiwai paʻamau i hāʻawi ʻia ma nā bracket square. E kaomi "Enter" e hoʻopau i ka hoʻokomo.

E hana i kahi kī pilikino a me kahi noi palapala. Ma ke ʻano he hoʻopaʻapaʻa, e kuhikuhi i kahi inoa kūʻokoʻa; i kā mākou hihia, ʻo ia ka "vpn-server".

./easyrsa gen-req vpn-server nopass

E waiho i ka waiwai maʻamau ma ke ʻano he paʻamau.

E hōʻailona i ka noi palapala kikowaena i hana ʻia.

./easyrsa sign-req server vpn-server

Ma kēia ʻanuʻu, e pane "ʻae" e hōʻoia i ka pūlima, a laila e hoʻokomo i ka ʻōlelo huna i hana ʻia i ka wā o ka hanauna palapala kumu.

E hana i nā ʻāpana Diffie-Hellman. Hoʻohana ʻia kēia mau ʻāpana no ka hoʻololi kī paʻa ma waena o ke kikowaena a me ka mea kūʻai aku.

./easyrsa gen-dh

Ua hana ʻia nā faila pono a pau. E hana mākou i kahi waihona "kī" ma ka papa kuhikuhi hana OpenVPN e mālama i nā kī a kope i nā faila i hana ʻia ma laila.

mkdir /etc/openvpn/keys

sudo cp pki/ca.crt pki/issued/vpn-server.crt pki/private/vpn-server.key pki/dh.pem /etc/openvpn/keys

E hoʻonohonoho i ka NAT me ka hoʻohana ʻana iptables rula. E hana i kahi faila i kapa ʻia nat a wehe ia no ka hooponopono ana ma ka /etc/openvpn/ papa kuhikuhi.

#!/bin/sh

# Reset firewall settings
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X

# (eth0 in our case, may vary)
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

# (eth0 in our case, may vary)
iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT

# Allow OpenVPN connections (eth0 in our case, may vary)
iptables -A INPUT -i eth0 -p udp --dport 1194 -j ACCEPT

iptables -A INPUT -i tun0 -j ACCEPT

# (eth0 in our case, may vary):
iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT

# (eth0 in our case, may vary)
iptables -A FORWARD -i eth0 -o tun0 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Enable masquerading for the local network (eth0 in our case, may vary)
iptables -t nat -A POSTROUTING -o eth0 -s 10.8.0.0/24 -j MASQUERADE

# Deny incoming connections from outside
iptables -A INPUT -i eth0 -j DROP

# Deny transit traffic from outside (eth0 in our case, may vary)
iptables -A FORWARD -i eth0 -o tun0 -j DROP

sudo netfilter-persistent save

E mālama i ka faila a hiki ke hoʻokō.

sudo chmod 755 /etc/openvpn/nat

E kope i ka la'ana ho'onohonoho kikowaena.

cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf /etc/openvpn/

E wehe i ka faila "/etc/openvpn/server.conf" no ka hoʻoponopono ʻana, e hōʻoia i loaʻa iā ia nā laina aʻe, a hoʻoponopono iā lākou inā pono:

#Port, protocol, and interface

port 1194

proto udp

dev tun

#Path to the encryption keys

ca /etc/openvpn/keys/ca.crt

cert /etc/openvpn/keys/vpn-server.crt

key /etc/openvpn/keys/vpn-server.key

dh /etc/openvpn/keys/dh.pem

#SHA256 Hashing Algorithm

auth SHA256

#Switching off additional encryption

#tls-auth ta.key 0

#Network parameters

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist /var/log/openvpn/ipp.txt

push "redirect-gateway def1 bypass-dhcp"

push "dhcp-option DNS 8.8.8.8"

push "dhcp-option DNS 8.8.4.4"

#Ping every 10 seconds to check the connection.

keepalive 10 120

#Set up AES-256 encryption for the tunnel.

cipher AES-256-GCM

#Demoting the service OpenVPN after launch

user nobody

group nogroup

#Switching on parameters saving after reboot

persist-key

persist-tun

#Set log verbosity

verb 3

#Redirecting logs

log-append /var/log/openvpn/openvpn.log

#Script the rule installation launch.

up /etc/openvpn/nat

E ʻae i ka hoʻouna ʻana i nā kaʻa ma ke kikowaena.

sudo sysctl -w net.ipv4.ip_forward=1

echo 'net.ipv4.ip_forward=1' | sudo tee -a /etc/sysctl.conf

E hoʻomaka i ka OpenVPN e hoʻopili i ka hoʻonohonoho.

systemctl restart openvpn@server

Ua pau ka hoʻonohonoho kikowaena!

Hoʻonohonoho mea kūʻai aku

E hele i ka pūnaewele kūhelu o OpenVPN " https://openvpn.net ", e hele i ka ʻāpana "COMUNITY".

E kaomi i lalo a hoʻoiho i ka mea hoʻonoho no kāu mana ʻōnaehana hana. I kā mākou hihia, ʻo Windows 11 ARM64.

E hoʻouka i ka palapala noi e waiho ana i nā ʻāpana āpau ma ke ʻano paʻamau.

I ka pae aʻe, pono ʻoe e hoʻomākaukau i kēia faila ma ke kikowaena a hoʻoili iā lākou i ka kamepiula o ka mea kūʻai aku:

• kī aupuni a pilikino;
• kope o ke kī kikowaena hōʻoia;
• config file template.

Hoʻohui i ke kikowaena, hoʻokiʻekiʻe i nā pono, a hoʻokele i kā mākou papa kuhikuhi i hana ʻia "~/openvpn".

sudo -s

cd ~/openvpn

E hana i kahi kī pilikino a me kahi noi palapala no ka mea kūʻai aku. Ma ke ʻano he hoʻopaʻapaʻa, e kuhikuhi i kahi inoa kūʻokoʻa; i kā mākou hihia, ʻo ia ka "client1".

./easyrsa gen-req client1 nopass

E hoʻokomo i ka ʻōlelo huna a mākou i hoʻonoho ai i ka wā e hana ai i ka palapala kumu a waiho i ka inoa inoa maʻamau ma ke ʻano he paʻamau.

E hōʻailona i ka noi palapala mea kūʻai aku.

./easyrsa sign-req client client1

Ma kēia ʻanuʻu, e pane "ʻae" e hōʻoia i ka pūlima, a laila e hoʻokomo i ka ʻōlelo huna i hana ʻia i ka wā o ka hanauna palapala kumu.

No ka maʻalahi, e hana mākou i kahi waihona i kapa ʻia ʻo 'client1' ma ka papa kuhikuhi home a kope i nā faila a pau i manaʻo ʻia no ka hoʻoili ʻana i ka kamepiula mea kūʻai aku i loko.

mkdir ~/client1

cp pki/issued/client1.crt pki/private/client1.key pki/ca.crt ~/client1/

E kope i ka template faila hoʻonohonoho client i ka papa kuhikuhi like. E hoʻololi i ka hoʻonui faila i ".ovpn" i ke kope ʻana.

cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf ~/client1/client.ovpn

E hoʻololi i ka mea nona ka papa kuhikuhi a me nā faila āpau "~/client1/" i hiki ke hāʻawi iā lākou i ka mea kūʻai aku. E hoʻolilo iā "mihail" i mea nona i kā mākou hihia.

chown -R mihail:mihail ~/client1

E hele i ke kamepiula o ka mea kūʻai aku a kope i ka ʻike o ka waihona "~/client1/" . Hiki iā ʻoe ke hana i kēlā me ke kōkua o ka pono hana "PSCP" , e hele pū ana me Putty.

PSCP -r mihail@[IP_сервера]:/home/mihail/client1 c:\client1

Hiki iā ʻoe ke mālama i nā faila koʻikoʻi "ca.crt" , "client1.crt" , "client1.key" ma nā wahi āpau āu e makemake ai. I ko mākou hihia, aia lākou i loko o kēia waihona "c:\Program Files\OpenVPN\keys" , a hoʻololi mākou i ka faila config "client.ovpn" i loko o ka papa kuhikuhi "c:\Program Files\OpenVPN\config".

I kēia manawa, e hoʻomaka kākou i ka hoʻonohonoho ʻana i ka mea kūʻai aku. E wehe i ka faila “c:\Program Files\OpenVPN\config\client.ovpn” i loko o kahi mea hoʻoponopono kikokikona a hoʻoponopono i nā laina aʻe:

#announce that this is the client

client

#interface and protocol just like on the server

dev tun

proto udp

#IP address of the server and port

remote ip_address 1194

#saving parameters after reload

persist-key

persist-tun

#key paths

ca “c:\\Program Files\\OpenVPN\\keys\\ca.cert”

cert “c:\\Program Files\\OpenVPN\\keys\\client1.crt”

key “c:\\Program Files\\OpenVPN\\keys\\client1.key”

#enable server verification

remote-cert-tls server

#disable extra encryption

#tls-auth ta.key 1

cipher AES-256-CBC

auth-nocache

verb 3

E waiho i ke koena me ka ʻole.

E mālama i ka faila a hoʻomaka i ka polokalamu mea kūʻai aku "OpenVPN GUI".

Kaomi ʻākau ma ka ikona polokalamu ma ka papa hana a koho iā "Connect" . Inā holomua ka pilina e ʻōmaʻomaʻo ka ikona.

E hoʻohana i kekahi lawelawe pūnaewele e hōʻoia i ka loli ʻana o kāu helu IP lehulehu a ua like kēia manawa me ka helu IP o ke kikowaena.