Методические материалы Лохтурова Вячеслава

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Пакет OpenVPN ======

  * [[http://openvpn.net/index.php/open-source/documentation/howto.html|OpenVPN HOWTO]]

===== Установка сервиса =====

==== Debian/Ubuntu ====
<code>
# apt install openvpn
</code>


==== CentOS 7 ====

[[http://serveradmin.ru/nastroyka-openvpn-na-centos-7/|Установка openvpn на CentOS 7]]

===== Настройка client/server конфигурации =====

==== Настройка с использованием клиентских сертификатов ====

  * [[Пакет OpenSSL#Создание параметра DH]]
  * [[Пакет OpenSSL#Создание центра сертификации]] 
  * [[Пакет OpenSSL#Создание сертификата сервиса, подписанного CA]]

=== Настройка сервера ===
<code>
# cp ca.* /etc/ssl/certs/
# cp gate.crt /etc/ssl/certs/
# cp gate.key /etc/ssl/private/

gate# cat /etc/openvpn/openvpn1.conf
</code><code>
dev tun
# port 1194
# proto udp
keepalive 10 120
server 192.168.200+X.0 255.255.255.0
push "route 192.168.100+X.0 255.255.255.0"

#push "route 192.168.X.0 255.255.255.0"
#push "dhcp-option DNS 192.168.X.10"
#push "block-outside-dns"
#push "dhcp-option DOMAIN corpX.un"

dh /etc/openvpn/dh2048.pem

ca /etc/ssl/certs/ca.crt
crl-verify /etc/ssl/certs/ca.crl
cert /etc/ssl/certs/gate.crt
key /etc/ssl/private/gate.key

status /var/log/openvpn1-status.log
</code>

=== Тестирование конфигурации ===

<code>
# openvpn --config /etc/openvpn/openvpn1.conf

# timeout 5 openvpn --config /etc/openvpn/openvpn1.conf --management 127.0.0.1 65501 --port 65500; test $? -eq 124 && echo OK
</code>

=== Включение и запуск ===

<code>
# systemctl enable openvpn@openvpn1

# systemctl start openvpn@openvpn1
</code>

==== Настройка клиента ====

=== Windows ===

  * [[https://mail.bmstu.ru/~postmaster/openvpn-install-2.4.0-I601.exe]]
  * [[https://openvpn.net/community-downloads/|OpenVPN community downloads]]
  * Начиная с Windows 7 необходимо запускать OpenVPN с правами администратора
  * [[Пакет OpenSSL#Создание пользовательского сертификата, подписанного CA]]

  * !!! [[https://serverfault.com/questions/607601/include-certificates-in-ovpn-file|include certificates in .OVPN file]]

<code>
Start OpenVPN GUI

C:\>notepad C:\Users\student\OpenVPN\config\user1.ovpn
</code><code>
dev tun
# port 1194
# proto udp
client
remote 172.16.1.X
ca ca.crt
cert user1.crt
key user1.key
</code>

=== Linux ===

<code>
debian:~# apt install openvpn resolvconf wget

debian:~# openvpn --script-security 2 --up /etc/openvpn/update-resolv-conf --down /etc/openvpn/update-resolv-conf --config user1.ovpn
</code>

==== Индивидуальная настройка параметров клиентов ====

  * [[https://serverfault.com/questions/1048592/openvpn-routing-from-server-to-client|OpenVPN routing from server to client]]

  * базируется на атрибуте CN

<code>
gate# cat /etc/openvpn/openvpn1.conf
</code><code>
...
client-config-dir ccd
#route 192.168.100+Y.0 255.255.255.0
...
</code><code>
gate# cat /etc/openvpn/ccd/userN
</code><code>
ifconfig-push 192.168.200+X.4*N+2 192.168.200+X.4*N+1
#iroute 192.168.100+Y.0 255.255.255.0
</code>

==== Использование PAM аутентификации ====

  * [[https://www.linuxsysadmintutorials.com/setup-pam-authentication-with-openvpns-auth-pam-module|Setup PAM authentication with OpenVPN's auth-pam module]]
  * [[https://github.com/OpenVPN/openvpn/tree/master/src/plugins/auth-pam|openvpn/src/plugins/auth-pam/]]
  * [[https://openvpn.net/community-resources/using-alternative-authentication-methods/|OpenVPN Using alternative authentication methods]]

  * [[Пакет OpenSSL#Создание самоподписанного сертификата]]
<code>
gate# less /etc/pam.d/login

gate# cat /etc/openvpn/openvpn1.conf
</code><code>
...
#### crl-verify ...

ca /etc/ssl/certs/server.crt
cert /etc/ssl/certs/server.crt
...
plugin /usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so login
verify-client-cert none
username-as-common-name
#duplicate-cn  #несколько подключений под одной учетной записью
</code><code>
cmd run as admin C:\>notepad C:\Program Files\OpenVPN\config\client.ovpn
</code><code>
...
auth-user-pass
#static-challenge "Enter TOTP Authenticator Code" 1
<ca>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</ca>
</code>
==== Использование RADIUS аутентификации и учета ====

  * [[https://stackoverflow.com/questions/71159790/authenticate-openvpn-users-via-radius-freeradius]]

===== Настройка peer2peer конфигурации =====

  * В новых версиях (с Debian12) теперь так: [[https://wiki.gentoo.org/wiki/OpenVPN/fingerprint-authentication|OpenVPN/fingerprint-authentication]]

==== Debian/Ubuntu/FreeBSD ====
<code>
gate.corpX.un# cd /etc/openvpn/

gate.corpX.un# openvpn --genkey --secret static.key

gate.corpX.un# scp static.key gate.corpY.un:/etc/openvpn/

gate.corpX.un# cat connect_to_Y.conf
</code><code>
dev tun
remote 172.16.1.Y
port 1195
# proto udp
keepalive 10 120
ifconfig 192.168.X+Y.X 192.168.X+Y.Y
route 192.168.100+Y.0 255.255.255.0
secret /etc/openvpn/static.key
</code>

==== FreeBSD ====
<code>
# cd /usr/local/etc/rc.d/
# ln -s openvpn connect_to_Y

# cat /etc/rc.conf
</code><code>
...
connect_to_Y_enable=yes
</code>


===== Мониторинг сервиса =====
<code>
gate# cat /var/log/openvpn1-status.log

gate# tail -f /var/log/syslog

gate# cat /etc/openvpn/openvpn1.conf
</code><code>
...
management localhost 7505
# management 0.0.0.0 7505
...
</code><code>
gate# telnet localhost 7505
</code><code>
status

kill user1
</code>
Методические материалы Лохтурова Вячеслава

User Tools

Site Tools

Page Tools
