Projet

Général

Profil

OpenVPN » Historique » Version 15

Laurent GUERBY, 15/02/2013 13:32

1 3 Laurent GUERBY
{{>toc}}
2 3 Laurent GUERBY
3 1 Laurent GUERBY
h1. OpenVPN
4 1 Laurent GUERBY
5 13 Laurent GUERBY
h2. Port sharing
6 12 Laurent GUERBY
7 12 Laurent GUERBY
Apache and nginx
8 12 Laurent GUERBY
http://www.davidwesterfield.net/2012/08/openvpn-sharing-a-tcp-port-with-ssl-on-nginx-and-apache-yeah-its-possible/
9 12 Laurent GUERBY
10 12 Laurent GUERBY
port-share 127.0.0.1 4443
11 12 Laurent GUERBY
12 14 Laurent GUERBY
http://www.greenie.net/ipv6/openvpn.html
13 14 Laurent GUERBY
https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23
14 14 Laurent GUERBY
15 15 Laurent GUERBY
h2. Certificats
16 15 Laurent GUERBY
17 15 Laurent GUERBY
Via mherrb : la page de man 'ssl(8)' d'OpenBSD explique bien comment faire un certificat auto-signé qui marchera pour OpenVPN: 
18 15 Laurent GUERBY
http://www.openbsd.org/cgi-bin/man.cgi?query=ssl&apropos=0&sektion=0&manpath=OpenBSD+Current&arch=i386&format=html
19 15 Laurent GUERBY
20 9 Laurent GUERBY
h2. Server
21 1 Laurent GUERBY
22 9 Laurent GUERBY
<pre>
23 9 Laurent GUERBY
# cat /etc/default/openvpn
24 9 Laurent GUERBY
...
25 9 Laurent GUERBY
AUTOSTART="ttnn-tap ttnn-tap6 ttnn-tap-tcp ttnn-tap-tcp6"
26 9 Laurent GUERBY
...
27 9 Laurent GUERBY
# cat /etc/openvpn/ttnn-tap.conf 
28 9 Laurent GUERBY
dev tap0udp
29 9 Laurent GUERBY
port 11195
30 9 Laurent GUERBY
proto udp
31 9 Laurent GUERBY
32 9 Laurent GUERBY
ca ttnn/ca.crt
33 9 Laurent GUERBY
cert ttnn/h1.crt
34 9 Laurent GUERBY
key ttnn/h1.key  # This file should be kept secret
35 9 Laurent GUERBY
dh ttnn/dh1024.pem
36 9 Laurent GUERBY
37 9 Laurent GUERBY
mode server
38 9 Laurent GUERBY
tls-server
39 9 Laurent GUERBY
40 9 Laurent GUERBY
persist-key
41 9 Laurent GUERBY
persist-tun
42 9 Laurent GUERBY
43 9 Laurent GUERBY
client-config-dir ccd
44 9 Laurent GUERBY
45 9 Laurent GUERBY
client-to-client
46 9 Laurent GUERBY
comp-lzo yes
47 9 Laurent GUERBY
keepalive 10 60
48 9 Laurent GUERBY
49 9 Laurent GUERBY
verb 3
50 9 Laurent GUERBY
log-append  log/openvpn-tap.log
51 9 Laurent GUERBY
status status/openvpn-tap.txt
52 9 Laurent GUERBY
53 9 Laurent GUERBY
# cat /etc/openvpn/ttnn-tap6.conf 
54 9 Laurent GUERBY
dev tap6udp
55 9 Laurent GUERBY
port 11196
56 9 Laurent GUERBY
proto udp6
57 9 Laurent GUERBY
58 9 Laurent GUERBY
ca ttnn/ca.crt
59 9 Laurent GUERBY
cert ttnn/h1.crt
60 9 Laurent GUERBY
key ttnn/h1.key  # This file should be kept secret
61 9 Laurent GUERBY
dh ttnn/dh1024.pem
62 9 Laurent GUERBY
63 9 Laurent GUERBY
mode server
64 9 Laurent GUERBY
tls-server
65 9 Laurent GUERBY
66 9 Laurent GUERBY
persist-key
67 9 Laurent GUERBY
persist-tun
68 9 Laurent GUERBY
69 9 Laurent GUERBY
client-config-dir ccd
70 9 Laurent GUERBY
71 9 Laurent GUERBY
client-to-client
72 9 Laurent GUERBY
comp-lzo yes
73 9 Laurent GUERBY
keepalive 10 60
74 9 Laurent GUERBY
75 9 Laurent GUERBY
verb 3
76 9 Laurent GUERBY
log-append  log/openvpn-tap6.log
77 9 Laurent GUERBY
status status/openvpn-tap6.txt
78 9 Laurent GUERBY
79 9 Laurent GUERBY
# cat /etc/openvpn/ttnn-tap-tcp.conf 
80 9 Laurent GUERBY
dev tap0tcp
81 9 Laurent GUERBY
port 443
82 9 Laurent GUERBY
proto tcp-server
83 9 Laurent GUERBY
84 9 Laurent GUERBY
ca ttnn/ca.crt
85 9 Laurent GUERBY
cert ttnn/h1.crt
86 9 Laurent GUERBY
key ttnn/h1.key  # This file should be kept secret
87 9 Laurent GUERBY
dh ttnn/dh1024.pem
88 9 Laurent GUERBY
89 9 Laurent GUERBY
mode server
90 9 Laurent GUERBY
tls-server
91 9 Laurent GUERBY
92 9 Laurent GUERBY
persist-key
93 9 Laurent GUERBY
persist-tun
94 9 Laurent GUERBY
95 9 Laurent GUERBY
client-config-dir ccd
96 9 Laurent GUERBY
97 9 Laurent GUERBY
client-to-client
98 9 Laurent GUERBY
comp-lzo yes
99 9 Laurent GUERBY
keepalive 10 60
100 9 Laurent GUERBY
101 9 Laurent GUERBY
verb 3
102 9 Laurent GUERBY
log-append  log/openvpn-tap-tcp.log
103 9 Laurent GUERBY
status status/openvpn-tap-tcp.txt
104 9 Laurent GUERBY
105 9 Laurent GUERBY
# keys generated with id ip-X-Y-Z-T, files:
106 9 Laurent GUERBY
# ip-91-224-149-165.crt
107 9 Laurent GUERBY
# ip-91-224-149-165.csr
108 9 Laurent GUERBY
# ip-91-224-149-165.key
109 9 Laurent GUERBY
110 9 Laurent GUERBY
# cat /etc/openvpn/ccd/ip-91-224-149-165
111 9 Laurent GUERBY
ifconfig-push 91.224.149.165 255.255.255.0
112 9 Laurent GUERBY
push "route-gateway 91.224.149.254"
113 9 Laurent GUERBY
push "redirect-gateway def1"
114 9 Laurent GUERBY
push "dhcp-option DNS 8.8.8.8"
115 9 Laurent GUERBY
116 9 Laurent GUERBY
# bridge
117 9 Laurent GUERBY
brctl addbr br0
118 9 Laurent GUERBY
brctl addif br0 eth0
119 9 Laurent GUERBY
ip link set br0 up
120 9 Laurent GUERBY
ip link set br0 address 52:54:10:00:00:11 #force MAC to avoid MAC changes
121 9 Laurent GUERBY
122 1 Laurent GUERBY
openvpn --mktun --dev tap0udp
123 1 Laurent GUERBY
openvpn --mktun --dev tap0tcp
124 1 Laurent GUERBY
openvpn --mktun --dev tap6udp
125 1 Laurent GUERBY
126 1 Laurent GUERBY
brctl addif br0 tap0udp
127 1 Laurent GUERBY
ip link set tap0udp up
128 1 Laurent GUERBY
129 1 Laurent GUERBY
brctl addif br0 tap0tcp
130 1 Laurent GUERBY
ip link set tap0tcp up
131 1 Laurent GUERBY
132 1 Laurent GUERBY
brctl addif br0 tap6udp
133 1 Laurent GUERBY
ip link set tap6udp up
134 1 Laurent GUERBY
135 1 Laurent GUERBY
</pre>
136 1 Laurent GUERBY
137 1 Laurent GUERBY
Pour ignorer les push IP et route du serveur coté client openvpn il suffit de mettre "tls-client" a la place de "client" l'option --client est un raccourci pour --tls-client  --pull et --pull est ce qui accepte les directives serveur.
138 10 Laurent GUERBY
139 10 Laurent GUERBY
h2. Client
140 10 Laurent GUERBY
141 10 Laurent GUERBY
142 10 Laurent GUERBY
<pre>
143 10 Laurent GUERBY
# cat /etc/openvpn/ttnn.conf
144 10 Laurent GUERBY
client
145 10 Laurent GUERBY
dev tap
146 10 Laurent GUERBY
147 10 Laurent GUERBY
### from outside with UDP available
148 10 Laurent GUERBY
#proto udp
149 10 Laurent GUERBY
#remote openvpn.tetaneutral.net 11195
150 10 Laurent GUERBY
151 10 Laurent GUERBY
### from outside with no UDP
152 10 Laurent GUERBY
proto tcp
153 10 Laurent GUERBY
remote openvpn.tetaneutral.net 443
154 10 Laurent GUERBY
# 91.224.149.211 443
155 10 Laurent GUERBY
156 10 Laurent GUERBY
# from outside using IPv6 over UDP
157 10 Laurent GUERBY
#proto udp6
158 10 Laurent GUERBY
#remote openvpn6.tetaneutral.net 11196
159 10 Laurent GUERBY
160 10 Laurent GUERBY
ca ttnn/ca.crt
161 10 Laurent GUERBY
cert ttnn/ip-91-224-149-165.crt
162 10 Laurent GUERBY
key ttnn/ip-91-224-149-165.key
163 10 Laurent GUERBY
164 10 Laurent GUERBY
persist-key
165 10 Laurent GUERBY
persist-tun
166 10 Laurent GUERBY
167 10 Laurent GUERBY
script-security 2
168 10 Laurent GUERBY
169 10 Laurent GUERBY
comp-lzo yes
170 10 Laurent GUERBY
keepalive 10 60
171 10 Laurent GUERBY
172 10 Laurent GUERBY
verb 3
173 10 Laurent GUERBY
log-append log/openvpn.log
174 10 Laurent GUERBY
</pre>
175 10 Laurent GUERBY
176 10 Laurent GUERBY
h2. point a point
177 10 Laurent GUERBY
178 10 Laurent GUERBY
<pre>
179 10 Laurent GUERBY
openvpn --genkey --secret tst.key
180 10 Laurent GUERBY
181 10 Laurent GUERBY
#server
182 10 Laurent GUERBY
openvpn --mktun --dev-type tap --dev taptst
183 10 Laurent GUERBY
ip link set taptst up
184 10 Laurent GUERBY
openvpn --dev-type tap --dev tapstg --comp-lzo yes --cipher none --proto udp --daemon --keepalive 10 30 --secret tst.key --port 1234
185 10 Laurent GUERBY
186 10 Laurent GUERBY
#client
187 10 Laurent GUERBY
openvpn --mktun --dev-type tap --dev taptst
188 10 Laurent GUERBY
ip link set taptst up
189 10 Laurent GUERBY
openvpn --dev-type tap --dev tapstg --comp-lzo yes --cipher none --proto udp --daemon --keepalive 10 30 --secret tst.key --remote A.B.C.D 1234
190 10 Laurent GUERBY
</pre>
191 3 Laurent GUERBY
192 5 Jocelyn Dealande
h2. Point-à-point avec routage d'un bloc d'IP.
193 5 Jocelyn Dealande
194 8 Jocelyn Dealande
[[Partage ADSL OpenVPN]]
195 5 Jocelyn Dealande
196 3 Laurent GUERBY
h2. Proxmox
197 3 Laurent GUERBY
198 3 Laurent GUERBY
http://www.nedproductions.biz/wiki/configuring-a-proxmox-ve-2.x-cluster-running-over-an-openvpn-intranet
199 4 Laurent GUERBY
http://blog.developpeur-neurasthenique.fr/auto-hebergement-configurer-un-cluster-proxmox-2-sans-multicast.html
200 11 Laurent GUERBY
201 11 Laurent GUERBY
h2. Links
202 11 Laurent GUERBY
203 11 Laurent GUERBY
https://community.openvpn.net/openvpn/changeset/150fb45047c5482858b32a669de4097e66dec1c7
204 1 Laurent GUERBY
"Allow 'lport 0' setup for random port binding"
205 13 Laurent GUERBY
206 13 Laurent GUERBY
https://vador.fdn.fr/wiki/travaux:vpn_misc:doc#configurer_sa_machine_pour_utiliser_l_offre_vpn_de_fdn