{"id":18489,"date":"2014-10-03T06:15:07","date_gmt":"2014-10-02T22:15:07","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2014\/10\/03\/banana-pi-%e6%b8%ac%e8%a9%a6-bananian-%e7%af%87-%e5%ae%89%e8%a3%9d-openvpn-server\/"},"modified":"2021-03-18T17:24:05","modified_gmt":"2021-03-18T09:24:05","slug":"banana-pi-%e6%b8%ac%e8%a9%a6-bananian-%e7%af%87-%e5%ae%89%e8%a3%9d-openvpn-server","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2014\/10\/03\/banana-pi-%e6%b8%ac%e8%a9%a6-bananian-%e7%af%87-%e5%ae%89%e8%a3%9d-openvpn-server\/","title":{"rendered":"Banana Pi \u6e2c\u8a66 – Bananian \u7bc7 \u5b89\u88dd OpenVPN Server"},"content":{"rendered":"

\u5e95\u4e0b\u6587\u7ae0\u53c3\u8003\uff1a
Raspberry Pi \u2022 View topic – [How to] Dynamic DNS and Openvpn server<\/a>
chen: \u5b89\u88ddOpenVpn For Raspberry PI \u7684\u6b65\u9a5f<\/a>
\u5229\u7528Raspberry Pi\u5efa\u7acbVPN server – TakoBear<\/a> <\/p>\n

\u5b89\u88dd OpenVPN
# apt-get install openvpn<\/span><\/p>\n

\u5efa\u7acb\u76ee\u9304
# mkdir \/etc\/openvpn\/easy-rsa\/<\/span>[@more@]
\u8907\u88fd\u7bc4\u4f8b\u7684\u8a2d\u5b9a\u6a94\u5230 \/etc\/openvpn\/easy-rsa\u00a0\u76ee\u9304
# cp -r \/usr\/share\/doc\/openvpn\/examples\/easy-rsa\/2.0\/* \/etc\/openvpn\/easy-rsa\/<\/span><\/p>\n

\u5c07 KEY_SIZE\u00a0\u7684\u9577\u5ea6\u7531 1024\u00a0\u6539\u6210 204\uff0c\u589e\u52a0\u6191\u8b49\u96e3\u5ea6
# sed -i ‘s\/KEY_SIZE=1024\/KEY_SIZE=2048\/’ \/etc\/openvpn\/easy-rsa\/vars<\/span><\/p>\n

\u4fee\u6539\u6191\u8b49\u9810\u8a2d\u8cc7\u8a0a
# sed -i ‘s\/KEY_COUNTRY=”US”\/KEY_COUNTRY=”TW”\/’ \/etc\/openvpn\/easy-rsa\/vars<\/span>
# sed -i ‘s\/KEY_PROVINCE=”CA”\/KEY_PROVINCE=”Taiwan”\/’ \/etc\/openvpn\/easy-rsa\/<\/span>vars<\/span>
# sed -i ‘s\/KEY_CITY=”SanFrancisco”\/KEY_CITY=”E-Land”\/’ \/etc\/openvpn\/easy-rsa\/<\/span>vars<\/span>
# sed -i ‘s\/KEY_ORG=”Fort-Funston”\/KEY_ORG=”Home”\/’ \/etc\/openvpn\/easy-rsa\/<\/span>vars<\/span><\/p>\n

\u5207\u63db\u76ee\u9304
# cd \/etc\/openvpn\/easy-rsa<\/span><\/p>\n

\u958b\u59cb\u5efa\u7acb\u6191\u8b49
# source .\/vars<\/span>
NOTE: If you run .\/clean-all, I will be doing a rm -rf on \/etc\/openvpn\/easy-rsa\/keys<\/span><\/p>\n

\u6e05\u7a7a\u820a\u6709\u6191\u8b49
# .\/clean-all<\/span><\/p>\n

\u5efa\u7acb\u6240\u9700\u6191\u8b49
# .\/build-ca<\/span>
# .\/build-key-server bananapi<\/span>
# .\/build-dh<\/span>
# .\/build-key banana
<\/span>
\u5c07 tls.key \u79fb\u5230 keys \u8cc7\u6599\u593e\u4e0b
# mv .\/tls.key .\/keys\/<\/span><\/p>\n

\u5207\u63db\u5230 \/etc\/openvpn\/easy-rsa\/keys<\/span>\u00a0\u76ee\u9304
# cd \/etc\/openvpn\/easy-rsa\/keys<\/span><\/p>\n

\u8907\u88fd Server\u00a0\u7aef\u7684\u6a94\u6848\u5230 \/etc\/openvpn<\/span>
# cp ca.crt ca.key dh2048.pem bananapi.crt bananapi.key \/etc\/openvpn<\/span><\/p>\n

\u5efa\u7acb\u7528\u4f86\u5b58\u653e Client\u00a0\u7aef\u6240\u9808\u6a94\u6848\u7684\u76ee\u9304
# mkdir $HOME\/openvpn-client-files<\/span>
\u8907\u88fd Client\u00a0\u7aef\u6240\u9808\u6a94\u6848
# cp ca.crt banana.crt banana.key $HOME\/openvpn-client-files<\/span><\/p>\n

\u66f4\u6539\u6a94\u6848\u540d\u7a31
# mv $HOME\/openvpn-client-files\/ca.crt $HOME\/openvpn-client-files\/capi.crt<\/span>
\u66f4\u6539\u6a94\u6848\u6b0a\u9650
# chmod +r $HOME\/openvpn-client-files\/banana.key<\/span><\/p>\n

\u5efa\u7acb \/etc\/openvpn\/server.conf<\/span>\u00a0\u8a2d\u5b9a\u6a94
# vim \/etc\/openvpn\/server.conf<\/span>
port 34567<\/span>
proto tcp<\/span>
dev tun<\/span>
;; Key File \u8a2d\u5b9a<\/span>
dh \/etc\/openvpn\/dh2048.pem<\/span>
ca \/etc\/openvpn\/ca.crt<\/span>
cert \/etc\/openvpn\/bananapi.crt<\/span>
key \/etc\/openvpn\/bananapi.key<\/span>
;; vpn \u4f7f\u7528\u7db2\u6bb5<\/span>
server 10.8.0.0 255.255.255.0<\/span>
cipher AES-256-CBC<\/span>
comp-lzo<\/span>
persist-key<\/span>
persist-tun<\/span>
status openvpn-status.log<\/span>
verb 3<\/span>
tun-mtu 1500<\/span>
tun-mtu-extra 32<\/span>
mssfix 1450<\/span>
;; \u5141\u8a31 client \u9593\u4e92\u76f8\u9023\u63a5<\/span>
;client-to-client<\/span>
push “redirect-gateway def1”<\/span>
;; DNS \u8a2d\u5b9a<\/span>
push “dhcp-option DNS 168.95.1.1”<\/span>
push “dhcp-option DNS 140.111.66.1”<\/span>
keepalive 5 30<\/span>
;; \u6700\u5927\u4f7f\u7528\u8005\u91cf<\/span>
max-clients 12<\/span><\/p>\n

\u9632\u706b\u7246\u4e0a\u7684\u8a2d\u5b9a\uff0c\u5982\u679c\u539f\u672c\u5c31\u6709\u9632\u706b\u7246\uff0c\u5c31\u8981\u5c07\u898f\u5247\u500b\u6574\u5408
# vim \/etc\/firewall.vpn<\/span>
#!\/bin\/bash<\/span>
# Enable ip_forward<\/span>
echo “1” > \/proc\/sys\/net\/ipv4\/ip_forward<\/span>
iptables -t filter -F<\/span>
iptables -t nat -F<\/span>
iptables -A FORWARD -m state –state RELATED,ESTABLISHED -j ACCEPT<\/span>
iptables -A FORWARD -s “10.8.0.0\/24” -j ACCEPT<\/span>
iptables -A FORWARD -j REJECT<\/span>
iptables -t nat -A POSTROUTING -s “10.8.0.0\/24” -j MASQUERADE<\/span><\/p>\n

\u66f4\u6539\u6a94\u6848\u6b0a\u9650
# chmod 700 \/etc\/firewall.vpn<\/span><\/p>\n

\u8a2d\u5b9a\u958b\u6a5f\u6642\u57f7\u884c
\u5728 \/etc\/rc.local<\/span>\u00a0\u6700\u5f8c\u4e00\u884c exit 0<\/span>\u00a0\u4e4b\u524d\u52a0\u5165 sh \/etc\/firewall.vpn<\/span>
# sed -i ‘\/^exit 0\/ish \/etc\/firewall.vpn’ \/etc\/rc.local<\/span><\/p>\n

\u6e2c\u8a66 OpenVPN\u00a0\u662f\u5426\u80fd\u6b63\u5e38\u57f7\u884c
# \/etc\/init.d\/openvpn start<\/span>
[ ok ] Starting virtual private network daemon: server.<\/span><\/p>\n

# netstat -antp | grep 34567<\/span>
tcp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0\u00a0\u00a0\u00a0 0 0.0.0.0:34567\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0:*\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 LISTEN\u00a0\u00a0\u00a0\u00a0\u00a0 3617\/openvpn<\/span><\/p>\n

tun0 \u4ecb\u9762\u8cc7\u8a0a
# ifconfig tun0<\/span>
tun0\u00a0\u00a0\u00a0\u00a0\u00a0 Link encap:UNSPEC\u00a0 HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 inet addr:10.8.0.1\u00a0 P-t-P:10.8.0.2\u00a0 Mask:255.255.255.255<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 UP POINTOPOINT RUNNING NOARP MULTICAST\u00a0 MTU:1500\u00a0 Metric:1<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 RX packets:0 errors:0 dropped:0 overruns:0 frame:0<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 collisions:0 txqueuelen:100<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 RX bytes:0 (0.0 B)\u00a0 TX bytes:0 (0.0 B)<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

\u5e95\u4e0b\u6587\u7ae0\u53c3\u8003\uff1a Raspberry Pi \u2022 View topic – [How to] Dyna … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008Banana Pi \u6e2c\u8a66 – Bananian \u7bc7 \u5b89\u88dd OpenVPN Server\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[162,168],"tags":[],"class_list":["post-18489","post","type-post","status-publish","format-standard","hentry","category-c-83744","category-c-84780"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["518843"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18489"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=18489"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18489\/revisions"}],"predecessor-version":[{"id":20129,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18489\/revisions\/20129"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=18489"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=18489"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=18489"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}