Projet

Général

Profil

OpenVPN » Historique » Version 12

Laurent GUERBY, 18/08/2012 12:35

1 3 Laurent GUERBY
{{>toc}}
2 3 Laurent GUERBY
3 1 Laurent GUERBY
h1. OpenVPN
4 1 Laurent GUERBY
5 12 Laurent GUERBY
H2. Port sharing
6 12 Laurent GUERBY
7 12 Laurent GUERBY
Apache and nginx
8 12 Laurent GUERBY
http://www.davidwesterfield.net/2012/08/openvpn-sharing-a-tcp-port-with-ssl-on-nginx-and-apache-yeah-its-possible/
9 12 Laurent GUERBY
10 12 Laurent GUERBY
port-share 127.0.0.1 4443
11 12 Laurent GUERBY
12 9 Laurent GUERBY
h2. Server
13 1 Laurent GUERBY
14 9 Laurent GUERBY
<pre>
15 9 Laurent GUERBY
# cat /etc/default/openvpn
16 9 Laurent GUERBY
...
17 9 Laurent GUERBY
AUTOSTART="ttnn-tap ttnn-tap6 ttnn-tap-tcp ttnn-tap-tcp6"
18 9 Laurent GUERBY
...
19 9 Laurent GUERBY
# cat /etc/openvpn/ttnn-tap.conf 
20 9 Laurent GUERBY
dev tap0udp
21 9 Laurent GUERBY
port 11195
22 9 Laurent GUERBY
proto udp
23 9 Laurent GUERBY
24 9 Laurent GUERBY
ca ttnn/ca.crt
25 9 Laurent GUERBY
cert ttnn/h1.crt
26 9 Laurent GUERBY
key ttnn/h1.key  # This file should be kept secret
27 9 Laurent GUERBY
dh ttnn/dh1024.pem
28 9 Laurent GUERBY
29 9 Laurent GUERBY
mode server
30 9 Laurent GUERBY
tls-server
31 9 Laurent GUERBY
32 9 Laurent GUERBY
persist-key
33 9 Laurent GUERBY
persist-tun
34 9 Laurent GUERBY
35 9 Laurent GUERBY
client-config-dir ccd
36 9 Laurent GUERBY
37 9 Laurent GUERBY
client-to-client
38 9 Laurent GUERBY
comp-lzo yes
39 9 Laurent GUERBY
keepalive 10 60
40 9 Laurent GUERBY
41 9 Laurent GUERBY
verb 3
42 9 Laurent GUERBY
log-append  log/openvpn-tap.log
43 9 Laurent GUERBY
status status/openvpn-tap.txt
44 9 Laurent GUERBY
45 9 Laurent GUERBY
# cat /etc/openvpn/ttnn-tap6.conf 
46 9 Laurent GUERBY
dev tap6udp
47 9 Laurent GUERBY
port 11196
48 9 Laurent GUERBY
proto udp6
49 9 Laurent GUERBY
50 9 Laurent GUERBY
ca ttnn/ca.crt
51 9 Laurent GUERBY
cert ttnn/h1.crt
52 9 Laurent GUERBY
key ttnn/h1.key  # This file should be kept secret
53 9 Laurent GUERBY
dh ttnn/dh1024.pem
54 9 Laurent GUERBY
55 9 Laurent GUERBY
mode server
56 9 Laurent GUERBY
tls-server
57 9 Laurent GUERBY
58 9 Laurent GUERBY
persist-key
59 9 Laurent GUERBY
persist-tun
60 9 Laurent GUERBY
61 9 Laurent GUERBY
client-config-dir ccd
62 9 Laurent GUERBY
63 9 Laurent GUERBY
client-to-client
64 9 Laurent GUERBY
comp-lzo yes
65 9 Laurent GUERBY
keepalive 10 60
66 9 Laurent GUERBY
67 9 Laurent GUERBY
verb 3
68 9 Laurent GUERBY
log-append  log/openvpn-tap6.log
69 9 Laurent GUERBY
status status/openvpn-tap6.txt
70 9 Laurent GUERBY
71 9 Laurent GUERBY
# cat /etc/openvpn/ttnn-tap-tcp.conf 
72 9 Laurent GUERBY
dev tap0tcp
73 9 Laurent GUERBY
port 443
74 9 Laurent GUERBY
proto tcp-server
75 9 Laurent GUERBY
76 9 Laurent GUERBY
ca ttnn/ca.crt
77 9 Laurent GUERBY
cert ttnn/h1.crt
78 9 Laurent GUERBY
key ttnn/h1.key  # This file should be kept secret
79 9 Laurent GUERBY
dh ttnn/dh1024.pem
80 9 Laurent GUERBY
81 9 Laurent GUERBY
mode server
82 9 Laurent GUERBY
tls-server
83 9 Laurent GUERBY
84 9 Laurent GUERBY
persist-key
85 9 Laurent GUERBY
persist-tun
86 9 Laurent GUERBY
87 9 Laurent GUERBY
client-config-dir ccd
88 9 Laurent GUERBY
89 9 Laurent GUERBY
client-to-client
90 9 Laurent GUERBY
comp-lzo yes
91 9 Laurent GUERBY
keepalive 10 60
92 9 Laurent GUERBY
93 9 Laurent GUERBY
verb 3
94 9 Laurent GUERBY
log-append  log/openvpn-tap-tcp.log
95 9 Laurent GUERBY
status status/openvpn-tap-tcp.txt
96 9 Laurent GUERBY
97 9 Laurent GUERBY
# keys generated with id ip-X-Y-Z-T, files:
98 9 Laurent GUERBY
# ip-91-224-149-165.crt
99 9 Laurent GUERBY
# ip-91-224-149-165.csr
100 9 Laurent GUERBY
# ip-91-224-149-165.key
101 9 Laurent GUERBY
102 9 Laurent GUERBY
# cat /etc/openvpn/ccd/ip-91-224-149-165
103 9 Laurent GUERBY
ifconfig-push 91.224.149.165 255.255.255.0
104 9 Laurent GUERBY
push "route-gateway 91.224.149.254"
105 9 Laurent GUERBY
push "redirect-gateway def1"
106 9 Laurent GUERBY
push "dhcp-option DNS 8.8.8.8"
107 9 Laurent GUERBY
108 9 Laurent GUERBY
# bridge
109 9 Laurent GUERBY
brctl addbr br0
110 9 Laurent GUERBY
brctl addif br0 eth0
111 9 Laurent GUERBY
ip link set br0 up
112 9 Laurent GUERBY
ip link set br0 address 52:54:10:00:00:11 #force MAC to avoid MAC changes
113 9 Laurent GUERBY
114 1 Laurent GUERBY
openvpn --mktun --dev tap0udp
115 1 Laurent GUERBY
openvpn --mktun --dev tap0tcp
116 1 Laurent GUERBY
openvpn --mktun --dev tap6udp
117 1 Laurent GUERBY
118 1 Laurent GUERBY
brctl addif br0 tap0udp
119 1 Laurent GUERBY
ip link set tap0udp up
120 1 Laurent GUERBY
121 1 Laurent GUERBY
brctl addif br0 tap0tcp
122 1 Laurent GUERBY
ip link set tap0tcp up
123 1 Laurent GUERBY
124 1 Laurent GUERBY
brctl addif br0 tap6udp
125 1 Laurent GUERBY
ip link set tap6udp up
126 1 Laurent GUERBY
127 1 Laurent GUERBY
</pre>
128 1 Laurent GUERBY
129 1 Laurent GUERBY
Pour ignorer les push IP et route du serveur coté client openvpn il suffit de mettre "tls-client" a la place de "client" l'option --client est un raccourci pour --tls-client  --pull et --pull est ce qui accepte les directives serveur.
130 10 Laurent GUERBY
131 10 Laurent GUERBY
h2. Client
132 10 Laurent GUERBY
133 10 Laurent GUERBY
134 10 Laurent GUERBY
<pre>
135 10 Laurent GUERBY
# cat /etc/openvpn/ttnn.conf
136 10 Laurent GUERBY
client
137 10 Laurent GUERBY
dev tap
138 10 Laurent GUERBY
139 10 Laurent GUERBY
### from outside with UDP available
140 10 Laurent GUERBY
#proto udp
141 10 Laurent GUERBY
#remote openvpn.tetaneutral.net 11195
142 10 Laurent GUERBY
143 10 Laurent GUERBY
### from outside with no UDP
144 10 Laurent GUERBY
proto tcp
145 10 Laurent GUERBY
remote openvpn.tetaneutral.net 443
146 10 Laurent GUERBY
# 91.224.149.211 443
147 10 Laurent GUERBY
148 10 Laurent GUERBY
# from outside using IPv6 over UDP
149 10 Laurent GUERBY
#proto udp6
150 10 Laurent GUERBY
#remote openvpn6.tetaneutral.net 11196
151 10 Laurent GUERBY
152 10 Laurent GUERBY
ca ttnn/ca.crt
153 10 Laurent GUERBY
cert ttnn/ip-91-224-149-165.crt
154 10 Laurent GUERBY
key ttnn/ip-91-224-149-165.key
155 10 Laurent GUERBY
156 10 Laurent GUERBY
persist-key
157 10 Laurent GUERBY
persist-tun
158 10 Laurent GUERBY
159 10 Laurent GUERBY
script-security 2
160 10 Laurent GUERBY
161 10 Laurent GUERBY
comp-lzo yes
162 10 Laurent GUERBY
keepalive 10 60
163 10 Laurent GUERBY
164 10 Laurent GUERBY
verb 3
165 10 Laurent GUERBY
log-append log/openvpn.log
166 10 Laurent GUERBY
</pre>
167 10 Laurent GUERBY
168 10 Laurent GUERBY
h2. point a point
169 10 Laurent GUERBY
170 10 Laurent GUERBY
<pre>
171 10 Laurent GUERBY
openvpn --genkey --secret tst.key
172 10 Laurent GUERBY
173 10 Laurent GUERBY
#server
174 10 Laurent GUERBY
openvpn --mktun --dev-type tap --dev taptst
175 10 Laurent GUERBY
ip link set taptst up
176 10 Laurent GUERBY
openvpn --dev-type tap --dev tapstg --comp-lzo yes --cipher none --proto udp --daemon --keepalive 10 30 --secret tst.key --port 1234
177 10 Laurent GUERBY
178 10 Laurent GUERBY
#client
179 10 Laurent GUERBY
openvpn --mktun --dev-type tap --dev taptst
180 10 Laurent GUERBY
ip link set taptst up
181 10 Laurent GUERBY
openvpn --dev-type tap --dev tapstg --comp-lzo yes --cipher none --proto udp --daemon --keepalive 10 30 --secret tst.key --remote A.B.C.D 1234
182 10 Laurent GUERBY
</pre>
183 3 Laurent GUERBY
184 5 Jocelyn Dealande
h2. Point-à-point avec routage d'un bloc d'IP.
185 5 Jocelyn Dealande
186 8 Jocelyn Dealande
[[Partage ADSL OpenVPN]]
187 5 Jocelyn Dealande
188 3 Laurent GUERBY
h2. Proxmox
189 3 Laurent GUERBY
190 3 Laurent GUERBY
http://www.nedproductions.biz/wiki/configuring-a-proxmox-ve-2.x-cluster-running-over-an-openvpn-intranet
191 4 Laurent GUERBY
http://blog.developpeur-neurasthenique.fr/auto-hebergement-configurer-un-cluster-proxmox-2-sans-multicast.html
192 11 Laurent GUERBY
193 11 Laurent GUERBY
h2. Links
194 11 Laurent GUERBY
195 11 Laurent GUERBY
https://community.openvpn.net/openvpn/changeset/150fb45047c5482858b32a669de4097e66dec1c7
196 11 Laurent GUERBY
"Allow 'lport 0' setup for random port binding"