Ntọala nkesa VPN na Linux: PPTP ma ọ bụ OpenVPN?

Ugbu a, teknụzụ VPN na-aghọwanye ewu ewu. Ndị ọrụ nkịtị na-eji VPN nweta ịntanetị n'enweghị nsogbu. Ọ na-enyekwara aka ịgagharị na webụsaịtị na ọrụ egbochiri mpaghara wee chebe megide omume ọjọọ mpụga enwere ike. Mgbe ị na-ejikọ na sava VPN, enwere ọwara dị mma n'etiti kọmpụta gị na nkesa nke enweghị ike ịnweta ya na mpụga, yabụ sava VPN na-aghọ ebe ịntanetị gị. Enwere ọtụtụ ọrụ VPN n'ebe ahụ, ma n'efu na nke akwụ ụgwọ, mana ọ bụrụ na ha anaghị arụ ọrụ maka gị maka ihe ụfọdụ, ị nwere ike ịhazi ihe nkesa VPN gị mgbe niile.

Iji mee ka VPN gị rụọ ọrụ, ị kwesịrị ịgbazite sava VPS . E nwere ngwanrọ dị iche iche nke na-enye gị ohere ịmepụta njikọ VPN. Ọ dị iche na ibe ya site na sistemụ arụmọrụ akwadoro na algọridim ejiri. Anyị ga-eleba anya n'ụzọ abụọ nwere onwe ha iji guzobe sava VPN. Nke mbụ dabere na usoro PPTP nke a na-ewere dị ka ihe ochie na nchekwa mana ọ dị mfe ịhazi. Nke ọzọ na-eji ngwanrọ ọgbara ọhụrụ na nchekwa OpenVPN mana ọ chọrọ ịwụnye ngwa onye ahịa nke atọ na usoro ntọala zuru oke.

Na gburugburu ule anyị, anyị ga-eji sava mebere nke Ubuntu Server 18.04 kwadoro. A ga-agbanyụ ọkụ firewall na ihe nkesa n'ihi na nhazi ya kwesịrị inwe isiokwu dị iche. Anyị ga-akọwa usoro ntọlite ​​​​na Windows 10.

Nkwadebe

N'agbanyeghị ihe nkesa VPN ị họọrọ, a ga-edozi ohere ịntanetị site na agbakwunyere sistemụ arụmọrụ. Iji mepee ohere ịntanetị site na interface ọrụ mpụga, ị ga-ahapụrịrị mbugharị ngwugwu n'etiti oghere ma hazie ntụgharị asụsụ netwọkụ.

Iji gbanye mbugharị ngwugwu, mepee faịlụ "/etc/sysctl.conf" wee gbanwee uru paramita "net.ipv4.ip_forward" ka ọ bụrụ 1.

Ka itinye mgbanwe na-enweghị ịmalitegharị kọmputa, mee iwu ahụ

sudo sysctl -p /etc/sysctl.conf

A na-ahazi ntụgharị adreesị netwọk site na iji iptables . Nke mbụ, lelee aha njikọ netwọk mpụga gị nke na-agba iwu "ip link show" - ị ga-achọ ya na nzọụkwụ na-esote. Aha anyị bụ "ens3".

Kwado ntụgharị asụsụ adreesị netwọkụ na ihu mpụga gị maka ọnụ netwọk mpaghara niile.

sudo iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE

Rịba ama na ịkwesịrị ịkọwapụta ezigbo aha ihe nkesa gị, ọ nwere ike ịdị iche na nke anyị.

Dịka ọ dị na mbụ, a na-emegharị iwu niile iptables mepụtara mgbe sava ahụ malitegharịrị. Iji gbochie nke ahụ, jiri ngwa "iptables-persistent" . Wụnye ngwugwu a:

sudo apt install iptables-persistent

N'oge ụfọdụ n'oge nrụnye, ị ga-ahụ windo nhazi nke ga-egosi gị ịchekwa iwu iptables dị ugbu a. Ebe ọ bụ na akọwapụtala iwu ndị ahụ, naanị kwado ma pịa "Ee" ugboro abụọ. Kemgbe ugbu a, a ga-etinye iwu ndị ahụ na akpaghị aka mgbe sava ahụ malitegharịrị.

Ihe nkesa PPTP

Nhazi nkesa

Wụnye ngwugwu:

sudo apt install pptpd

Mgbe nrụnye ahụ gwụchara, mepee faịlụ "/etc/pptpd.conf" na nchịkọta ederede ọ bụla wee dezie ya dịka nke a:

option /etc/ppp/pptpd-options #path to the settings file
logwtmp #client connections logging mechanism
connections 100 #number of simultaneous connections
localip 172.16.0.1 #the address that will serve as a client gateway
remoteip 172.16.0.2-200 #range of addresses

Mgbe nke ahụ gasịrị, dezie faịlụ "/etc/ppp/pptpd-options" . A na-ahazi ọtụtụ paramita dịka ndabara.

#name of the service for new client records
name pptpd

#restrict obsolete authentication methods
refuse-pap
refuse-chap
refuse-mschap

#allow a more secure authentication method
require-mschap-v2

#enable encryption
require-mppe-128

#specify dns servers for clients (use any available servers)
ms-dns 8.8.8.8
ms-dns 8.8.4.4

proxyarp
nodefaultroute
lock
nobsdcomp
novj
novjccomp
nologfd

N'ọkwa ọzọ, ị ga-achọ ịmepụta ndekọ maka njikọ ndị ahịa. Ka anyị kwuo na ịchọrọ ịgbakwunye onye ọrụ "vpnuser" na paswọọdụ "1" ma kwe ka adreesị na-agbanwe agbanwe nye ya. Mepee faịlụ "/etc/ppp/chap-secrets" wee tinye ahịrị na-esonụ na paramita onye ọrụ na njedebe nke faịlụ ahụ:

vpnuser pptpd 1 *

Uru "pptpd" bụ aha ọrụ anyị depụtara na faịlụ "pptpd-options" . Kama "*" ị nwere ike ịkọwapụta adreesị IP edobere. N'ihi ya, faịlụ "chap-secrets" kwesịrị ịdị ka nke a:

Iji tinye ntọala ahụ, tọgharịa ọrụ pptpd ma tinye ya na nbudata onwe onye.

sudo systemctl restart pptpd
sudo systemctl enable pptpd

Nhazi nkesa agwụla.

Nhazi onye ahịa

Mepee "Malite" - "Ntọala" - "Netwọk na Ịntanetị" - "VPN" wee pịa "Tinye njikọ VPN"

Tinye paramita njikọ na windo mepere emepe wee pịa "Chekwa"

• Onye na-eweta VPN: "Windows (wuru n'ime)"
• Aha njikọ: "vpn_connect" (ị nwere ike ịhọrọ aha ọ bụla)
• Aha sava ma ọ bụ adreesị: (kpọpụta adreesị IP mpụga nke ihe nkesa ahụ)
• Ụdị VPN: "akpaaka"
• Ụdị ozi nbanye: "Aha njirimara na paswọọdụ"
• Aha njirimara: vpnuser (aha akọwapụtara na faịlụ "chap-nzuzo" dị na sava ahụ)
• Paswọọdụ: 1 (dị ka ọ dị na faịlụ "isi-nzuzo")

Mgbe ị chekwara paramita, ị ga-ahụ njikọ VPN ọhụrụ na windo ahụ. Pịa aka ekpe na njikọ ahụ wee họrọ "Jikọọ" . Ọ bụrụ na njikọ ahụ aga nke ọma, ị ga-ahụ ọnọdụ "Jikọrọ" .

Na Nhọrọ ndị a, ị ga-ahụ adreesị dị n'ime nke onye ahịa na sava ahụ. "Adreesị ebe a na-aga" na-egosi adreesị sava dị n'èzí.

Mgbe ejikọtara ya, adreesị IP dị n'ime nke sava ahụ, 172.16.0.1 n'ọnọdụ anyị, na-aghọ ọnụ ụzọ ndabara maka ngwugwu niile na-apụ apụ.

Iji ọrụ ọ bụla n'ịntanetị ị nwere ike ijide n'aka na adreesị IP mpụga nke kọmputa bụ ugbu a ka adreesị IP nke ihe nkesa VPN gị.

Ntọala OpenVPN

Nhazi nkesa

Ka anyị kwalite ọkwa ikike nke onye ọrụ ugbu a n'ihi na maka nhazi ọzọ anyị ga-achọ ịnweta mgbọrọgwụ.

sudo -s

Wụnye ngwugwu niile dị mkpa. Anyị ga-achọ ngwugwu "Easy-RSA" iji jikwaa igodo nzuzo.

apt install openvpn easy-rsa iptables-persistent

Kwe ka njikọ mbata na ọdụ ụgbọ mmiri 1194 site na protocol UDP wee tinye iwu iptables.

sudo iptables -I INPUT -p udp --dport 1194 -j ACCEPT

sudo netfilter-persistent save

Mepụta ndekọ nwere faịlụ ndị e depụtaghachiri na ngwungwu “Easy-RSA” wee banye na ya.

make-cadir ~/openvpn

cd ~/openvpn

Mepụta akụrụngwa igodo Ọhaneze (PKI).

./easyrsa init-pki

Mepụta akwụkwọ mgbọrọgwụ ikike ikike (CA).

./easyrsa build-ca

N'oge usoro okike, a ga-akpali gị ịtọ ma cheta paswọọdụ. Ị ga-achọkwa ịza ajụjụ wee tinye ozi gbasara onye nwe igodo. Ị nwere ike hapụ ụkpụrụ ndabara enyere na brackets square. Pịa "Tinye" iji mechaa ntinye.

Mepụta igodo nzuzo yana arịrịọ asambodo. Dị ka arụmụka, kọwaa aha aka ike; N'ọnọdụ anyị, ọ bụ "vpn-server".

./easyrsa gen-req vpn-server nopass

Hapụ uru Aha nkịtị ka ọ bụrụ nke ndabara.

Banye arịrịọ akwụkwọ nkesa emepụtara.

./easyrsa sign-req server vpn-server

Na nzọụkwụ a, zaa "ee" iji kwado mbinye aka, wee tinye paswọọdụ emepụtara n'oge ọgbọ akwụkwọ mgbọrọgwụ.

Mepụta paramita Diffie-Hellman. A na-eji paramita ndị a maka mgbanwe igodo echekwara n'etiti sava na onye ahịa.

./easyrsa gen-dh

Ewepụtala faịlụ niile dị mkpa. Ka anyị mepụta nchekwa " igodo" na akwụkwọ ndekọ aha OpenVPN iji chekwaa igodo ma detuo faịlụ ndị emepụtara n'ebe ahụ.

mkdir /etc/openvpn/keys

sudo cp pki/ca.crt pki/issued/vpn-server.crt pki/private/vpn-server.key pki/dh.pem /etc/openvpn/keys

Hazie NAT site na iji iptables iwu. Mepụta faịlụ aha nat ma mepee ya maka edezi na /etc/openvpn/ ndekọ.

#!/bin/sh

# Reset firewall settings
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X

# (eth0 in our case, may vary)
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

# (eth0 in our case, may vary)
iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT

# Allow OpenVPN connections (eth0 in our case, may vary)
iptables -A INPUT -i eth0 -p udp --dport 1194 -j ACCEPT

iptables -A INPUT -i tun0 -j ACCEPT

# (eth0 in our case, may vary):
iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT

# (eth0 in our case, may vary)
iptables -A FORWARD -i eth0 -o tun0 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Enable masquerading for the local network (eth0 in our case, may vary)
iptables -t nat -A POSTROUTING -o eth0 -s 10.8.0.0/24 -j MASQUERADE

# Deny incoming connections from outside
iptables -A INPUT -i eth0 -j DROP

# Deny transit traffic from outside (eth0 in our case, may vary)
iptables -A FORWARD -i eth0 -o tun0 -j DROP

sudo netfilter-persistent save

Chekwaa faịlụ ma mee ka ọ rụọ ọrụ.

sudo chmod 755 /etc/openvpn/nat

Detuo template nhazi ihe nkesa.

cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf /etc/openvpn/

Mepee faịlụ "/etc/openvpn/server.conf" maka idezi, hụ na o nwere ahịrị ndị a, ma dezie ha ma ọ bụrụ na ọ dị mkpa:

#Port, protocol, and interface

port 1194

proto udp

dev tun

#Path to the encryption keys

ca /etc/openvpn/keys/ca.crt

cert /etc/openvpn/keys/vpn-server.crt

key /etc/openvpn/keys/vpn-server.key

dh /etc/openvpn/keys/dh.pem

#SHA256 Hashing Algorithm

auth SHA256

#Switching off additional encryption

#tls-auth ta.key 0

#Network parameters

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist /var/log/openvpn/ipp.txt

push "redirect-gateway def1 bypass-dhcp"

push "dhcp-option DNS 8.8.8.8"

push "dhcp-option DNS 8.8.4.4"

#Ping every 10 seconds to check the connection.

keepalive 10 120

#Set up AES-256 encryption for the tunnel.

cipher AES-256-GCM

#Demoting the service OpenVPN after launch

user nobody

group nogroup

#Switching on parameters saving after reboot

persist-key

persist-tun

#Set log verbosity

verb 3

#Redirecting logs

log-append /var/log/openvpn/openvpn.log

#Script the rule installation launch.

up /etc/openvpn/nat

Kwado mbugharị okporo ụzọ na ihe nkesa.

sudo sysctl -w net.ipv4.ip_forward=1

echo 'net.ipv4.ip_forward=1' | sudo tee -a /etc/sysctl.conf

Malite OpenVPN ka itinye nhazi ahụ.

systemctl restart openvpn@server

Nhazi ihe nkesa agwụla!

Nhazi onye ahịa

Gaa na weebụsaịtị gọọmentị nke OpenVPN “ https://openvpn.net ”, gaa na ngalaba “OBODO”.

Pịgharịa gaa na ala ma budata installer maka ụdị sistemụ arụmọrụ gị. N'ọnọdụ anyị, ọ bụ Windows 11 ARM64.

Wụnye ngwa na-ahapụ paramita niile na ndabara.

N'oge ọzọ, ị ga-achọ ịkwadebe faịlụ ndị a na ihe nkesa ma nyefee ya na kọmputa ndị ahịa:

• igodo ọha na nke nzuzo;
• oyiri igodo etiti asambodo;
• template faịlụ config.

Jikọọ na ihe nkesa ahụ, bulie ohere gị, wee gaa na ndekọ aha emepụtara anyị "~/openvpn".

sudo -s

cd ~/openvpn

Mepụta igodo nzuzo yana arịrịọ akwụkwọ maka onye ahịa. Dị ka arụmụka, kọwaa aha aka ike; n'ọnọdụ anyị, ọ bụ "client1".

./easyrsa gen-req client1 nopass

Tinye paswọọdụ anyị debere mgbe ị na-eke akwụkwọ mgbọrọgwụ wee hapụ uru Aha a na-ahụkarị ka ndabere.

Banye arịrịọ akwụkwọ ikike ndị ahịa emepụtara.

./easyrsa sign-req client client1

Na nzọụkwụ a, zaa "ee" iji kwado mbinye aka, wee tinye paswọọdụ emepụtara n'oge ọgbọ akwụkwọ mgbọrọgwụ.

Maka ịdị mma, ka anyị mepụta folda aha ya bụ 'client1' na ndekọ ụlọ wee detuo faịlụ niile echere maka ibufe na kọmputa onye ahịa n'ime ya.

mkdir ~/client1

cp pki/issued/client1.crt pki/private/client1.key pki/ca.crt ~/client1/

Detuo ndebiri faịlụ nhazi nke onye ahịa gaa na otu ndekọ ahụ. Gbanwee ndọtị faịlụ ahụ ka ọ bụrụ ".ovpn" mgbe ị na-edegharị ya.

cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf ~/client1/client.ovpn

Gbanwee onye nwe ndekọ ahụ na faịlụ niile "~/client1/" ka o wee nwee ike kesaa ha nye onye ahịa. Ka anyị mee ka onye nwe ya bụrụ "mihail" n'ọnọdụ anyị.

chown -R mihail:mihail ~/client1

Gaa na kọmputa onye ahịa wee detuo ihe dị na folda "~/client1/" . Ị nwere ike ime nke ahụ site n'enyemaka nke ngwa "PSCP" , nke na-aga na Putty.

PSCP -r mihail@[IP_сервера]:/home/mihail/client1 c:\client1

I nwere ike ịchekwa faịlụ isi "ca.crt" , "client1.crt" , "client1.key" ebe ọ bụla ịchọrọ. N'ọnọdụ anyị, ha dị na folda a "c:\Program Files\OpenVPN\keys" , anyị na-etinye faịlụ nhazi "client.ovpn" n'ime ndekọ "c:\Program Files\OpenVPN\config".

Ugbu a, ka anyị malite ịhazi onye ahịa ahụ. Mepee faịlụ "c:\Program Files\OpenVPN\config\client.ovpn" na nchịkọta ederede wee dezie ahịrị ndị a:

#announce that this is the client

client

#interface and protocol just like on the server

dev tun

proto udp

#IP address of the server and port

remote ip_address 1194

#saving parameters after reload

persist-key

persist-tun

#key paths

ca “c:\\Program Files\\OpenVPN\\keys\\ca.cert”

cert “c:\\Program Files\\OpenVPN\\keys\\client1.crt”

key “c:\\Program Files\\OpenVPN\\keys\\client1.key”

#enable server verification

remote-cert-tls server

#disable extra encryption

#tls-auth ta.key 1

cipher AES-256-CBC

auth-nocache

verb 3

Hapụ ndị ọzọ emetụghị aka.

Chekwaa faịlụ ahụ wee malite ngwa onye ahịa "OpenVPN GUI".

Pịa aka nri na akara ngosi ngwa dị na taskbar wee họrọ "Jikọọ" . Ọ bụrụ na njikọ ahụ aga nke ọma, akara ngosi ahụ ga-agbanwe akwụkwọ ndụ akwụkwọ ndụ.

Jiri ọrụ ịntanetị ọ bụla iji jide n'aka na adreesị IP ọha gị agbanweela na ọ bụzi otu adreesị IP nke ihe nkesa ahụ.