Differences

This shows you the differences between two versions of the page.

--- пакет_openvpn [2019/10/18 16:17]
val [Настройка с использованием клиентских сертификатов]
+++ пакет_openvpn [2024/06/14 07:00]
val
@@ Line 8: / Line 8: @@
 <code>
 # apt install openvpn
-# cd /etc/openvpn/
 </code>
-==== FreeBSD ====
-<code>
-# pkg install openvpn
-# cat /etc/rc.conf
-</code><code>
-...
-openvpn_enable=yes
-</code><code>
-# mkdir /usr/local/etc/openvpn/
-# cd /usr/local/etc/openvpn/
-</code>
 ==== CentOS 7 ====
@@ Line 39: / Line 25: @@
 === Настройка сервера ===
 <code>
-gate# cat openvpn.conf
+# cp ca.* /etc/ssl/certs/
+# cp gate.crt /etc/ssl/certs/
+# cp gate.key /etc/ssl/private/
+gate# cat /etc/openvpn/openvpn1.conf
 </code><code>
 dev tun
@@ Line 47: / Line 37: @@
 server 192.168.200+X.0 255.255.255.0
 push "route 192.168.100+X.0 255.255.255.0"
-dh /root/dh1024.pem
-ca /root/ca.crt
+#push "route 192.168.X.0 255.255.255.0"
-crl-verify /root/ca.crl
+#push "dhcp-option DNS 192.168.X.10"
-cert /root/gate.crt
+#push "block-outside-dns"
-key /root/gate.key
+#push "dhcp-option DOMAIN corpX.un"
-status /var/log/openvpn-status.log
+dh /etc/openvpn/dh2048.pem
+ca /etc/ssl/certs/ca.crt
+crl-verify /etc/ssl/certs/ca.crl
+cert /etc/ssl/certs/gate.crt
+key /etc/ssl/private/gate.key
+status /var/log/openvpn1-status.log
 </code>
-=== Настройка клиента ===
+=== Тестирование конфигурации ===
+<code>
+# openvpn --config /etc/openvpn/openvpn1.conf
+# timeout 5 openvpn --port 65500 --config /etc/openvpn/openvpn1.conf; test $? -eq 124 && echo OK
+</code>
+=== Включение и запуск ===
+<code>
+# systemctl enable openvpn@openvpn1
+# systemctl start openvpn@openvpn1
+</code>
+==== Настройка клиента ====
+=== Windows ===
   * [[https://mail.bmstu.ru/~postmaster/openvpn-install-2.4.0-I601.exe]]
+  * [[https://openvpn.net/community-downloads/|OpenVPN community downloads]]
   * Начиная с Windows 7 необходимо запускать OpenVPN с правами администратора
   * [[Пакет OpenSSL#Создание пользовательского сертификата, подписанного CA]]
 <code>
+Start OpenVPN GUI
 C:\>notepad C:\Users\student\OpenVPN\config\user1.ovpn
 </code><code>
@@ Line 72: / Line 91: @@
 cert user1.crt
 key user1.key
+</code>
+=== Linux ===
+<code>
+debian:~# apt install openvpn resolvconf wget
+debian:~# openvpn --script-security 2 --up /etc/openvpn/update-resolv-conf --down /etc/openvpn/update-resolv-conf --config user1.ovpn
 </code>
@@ Line 79: / Line 106: @@
 <code>
-gate# cat openvpn.conf
+gate# cat /etc/openvpn/openvpn1.conf
 </code><code>
 ...
 client-config-dir ccd
+#route 192.168.100+Y.0 255.255.255.0
 ...
 </code><code>
-gate# cat ccd/userN
+gate# cat /etc/openvpn/ccd/userN
 </code><code>
 ifconfig-push 192.168.200+X.4*N+2 192.168.200+X.4*N+1
+#iroute 192.168.100+Y.0 255.255.255.0
 </code>
-==== Использование PAM аутентификации вместо клиентских сертификатов ====
+==== Использование PAM аутентификации ====
   * [[https://www.linuxsysadmintutorials.com/setup-pam-authentication-with-openvpns-auth-pam-module|Setup PAM authentication with OpenVPN's auth-pam module]]
   * [[https://github.com/OpenVPN/openvpn/tree/master/src/plugins/auth-pam|openvpn/src/plugins/auth-pam/]]
+  * [[https://openvpn.net/community-resources/using-alternative-authentication-methods/|OpenVPN Using alternative authentication methods]]
+  * [[Пакет OpenSSL#Создание самоподписанного сертификата]]
 <code>
-gate# cat /etc/pam.d/login
+gate# less /etc/pam.d/login
-gate# cat openvpn.conf
+gate# cat /etc/openvpn/openvpn1.conf
 </code><code>
 ...
-plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so login
+#### crl-verify ...
-client-cert-not-required
+ca /etc/ssl/certs/server.crt
+cert /etc/ssl/certs/server.crt
+...
+plugin /usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so login
+verify-client-cert none
 username-as-common-name
-...
+#duplicate-cn  #несколько подключений под одной учетной записью
 </code><code>
-C:\>notepad C:\Program Files\OpenVPN\config\client.ovpn
+cmd run as admin C:\>notepad C:\Program Files\OpenVPN\config\client.ovpn
 </code><code>
-dev tun
+...
-client
-remote 172.16.1.X
-ca ca.crt
 auth-user-pass
+<ca>
+-----BEGIN CERTIFICATE-----
+...
+-----END CERTIFICATE-----
+</ca>
 </code>
 ==== Использование RADIUS аутентификации и учета ====
@@ Line 119: / Line 157: @@
 ===== Настройка peer2peer конфигурации =====
+  * В новых версиях (с Debian12) теперь так: [[https://wiki.gentoo.org/wiki/OpenVPN/fingerprint-authentication|OpenVPN/fingerprint-authentication]]
 ==== Debian/Ubuntu/FreeBSD ====
 <code>
+gate.corpX.un# cd /etc/openvpn/
 gate.corpX.un# openvpn --genkey --secret static.key
-gate.corpX.un# scp static.key gate.corpY.un:
+gate.corpX.un# scp static.key gate.corpY.un:/etc/openvpn/
 gate.corpX.un# cat connect_to_Y.conf
@@ Line 135: / Line 177: @@
 ifconfig 192.168.X+Y.X 192.168.X+Y.Y
 route 192.168.100+Y.0 255.255.255.0
-secret /root/static.key
+secret /etc/openvpn/static.key
 </code>
@@ Line 149: / Line 191: @@
 </code>
-===== Запуск сервиса =====
-==== Debian/Ubuntu ====
-<code>
-# service openvpn@openvpn start
-</code>
 ===== Мониторинг сервиса =====
 <code>
-gate# cat /var/log/openvpn-status.log
+gate# cat /var/log/openvpn1-status.log
 gate# tail -f /var/log/syslog
-gate# cat openvpn.conf
+gate# cat /etc/openvpn/openvpn1.conf
 </code><code>
 ...
 management localhost 7505
+# management 0.0.0.0 7505
 ...
 </code><code>
@@ Line 171: / Line 208: @@
 </code><code>
 status
+kill user1
 </code>

Методические материалы Лохтурова Вячеслава

User Tools

Site Tools

Differences

Page Tools