{"id":18637,"date":"2014-12-02T06:53:33","date_gmt":"2014-12-01T22:53:33","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2014\/12\/02\/cubie-truck-%e6%b8%ac%e8%a9%a6-arch-linux-%e5%ae%89%e8%a3%9d-openvpn-server\/"},"modified":"2021-03-18T17:24:12","modified_gmt":"2021-03-18T09:24:12","slug":"cubie-truck-%e6%b8%ac%e8%a9%a6-arch-linux-%e5%ae%89%e8%a3%9d-openvpn-server","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2014\/12\/02\/cubie-truck-%e6%b8%ac%e8%a9%a6-arch-linux-%e5%ae%89%e8%a3%9d-openvpn-server\/","title":{"rendered":"Cubie Truck \u6e2c\u8a66 – Arch Linux \u5b89\u88dd OpenVPN Server"},"content":{"rendered":"

\u53c3\u8003\u7db2\u9801\uff1a
OpenVPN – ArchWiki<\/a>
Create a Public Key Infrastructure Using the easy-rsa Scripts – ArchWiki<\/a>
\u982d\u57ce\u570b\u5c0f\u8cc7\u8a0a\u7d44 | Banana Pi \u6e2c\u8a66 – Bananian \u7bc7 \u5b89\u88dd OpenVPN Server<\/a><\/p>\n

\u5b89\u88dd OpenVPN
# pacman -S openvpn easy-rsa<\/span><\/p>\n

\u8907\u88fd\u7bc4\u4f8b\u7684\u8a2d\u5b9a\u6a94\u5230 \/etc\/openvpn<\/span> \u76ee\u9304
# cp -r \/usr\/share\/easy-rsa \/etc\/openvpn<\/span><\/p>\n

\u4fee\u6539\u6191\u8b49\u9810\u8a2d\u8cc7\u8a0a
# sed -i ‘s\/KEY_COUNTRY=”US”\/KEY_COUNTRY=”TW”\/’ \/etc\/openvpn\/easy-rsa\/vars<\/span>
# sed -i ‘s\/KEY_PROVINCE=”CA”\/KEY_PROVINCE=”Taiwan”\/’ \/etc\/openvpn\/easy-rsa\/vars<\/span>
# sed -i ‘s\/KEY_CITY=”SanFrancisco”\/KEY_CITY=”E-Land”\/’ \/etc\/openvpn\/easy-rsa\/vars<\/span>
# sed -i ‘s\/KEY_ORG=”Fort-Funston”\/KEY_ORG=”Home”\/’ \/etc\/openvpn\/easy-rsa\/vars<\/span>
[@more@]
\u5207\u63db\u76ee\u9304 \/etc\/openvpn\/easy-rsa<\/span>
# cd \/etc\/openvpn\/easy-rsa<\/span><\/p>\n

\u958b\u59cb\u5efa\u7acb\u6191\u8b49
# source .\/vars<\/span>
NOTE: If you run .\/clean-all, I will be doing a rm -rf on \/etc\/openvpn\/easy-rsa\/keys<\/span><\/p>\n

\u6e05\u7a7a\u820a\u6709\u6191\u8b49
# .\/clean-all<\/span><\/p>\n

\u5efa\u7acb\u6240\u9700\u6191\u8b49
# .\/build-ca<\/span>
# .\/build-key-server CubieTruck<\/span>
# .\/build-dh<\/span>
# .\/build-key Cubier<\/span><\/p>\n

\u7522\u751f ta.key<\/span>
# openvpn –genkey –secret \/etc\/openvpn\/easy-rsa\/keys\/ta.key<\/span><\/p>\n

\u5207\u63db\u5230 \/etc\/openvpn\/easy-rsa\/keys<\/span> \u76ee\u9304
# cd \/etc\/openvpn\/easy-rsa\/keys<\/span><\/p>\n

\u8907\u88fd Server \u7aef\u7684\u6a94\u6848\u5230 \/etc\/openvpn<\/span>
# cp ta.key ca.crt ca.key dh2048.pem CubieTruck.crt CubieTruck.key \/etc\/openvpn<\/span><\/p>\n

\u5efa\u7acb\u7528\u4f86\u5b58\u653e Client \u7aef\u6240\u9808\u6a94\u6848\u7684\u76ee\u9304
# mkdir $HOME\/openvpn-client-files<\/span>
\u8907\u88fd Client \u7aef\u6240\u9808\u6a94\u6848
# cp ca.crt Cubier.crt Cubier.key $HOME\/openvpn-client-files<\/span><\/p>\n

\u66f4\u6539\u6a94\u6848\u540d\u7a31
# mv $HOME\/openvpn-client-files\/ca.crt $HOME\/openvpn-client-files\/capi.crt<\/span>
\u66f4\u6539\u6a94\u6848\u6b0a\u9650
# chmod +r $HOME\/openvpn-client-files\/Cubier.key<\/span><\/p>\n

\u5efa\u7acb \/etc\/openvpn\/server.conf<\/span> \u8a2d\u5b9a\u6a94
# vim \/etc\/openvpn\/server.conf<\/span>
port 1194<\/span>
proto tcp<\/span>
dev tun<\/span>
;; Key File \u8a2d\u5b9a<\/span>
dh \/etc\/openvpn\/dh2048.pem<\/span>
ca \/etc\/openvpn\/ca.crt<\/span>
cert \/etc\/openvpn\/CubieTruck.crt<\/span>
key \/etc\/openvpn\/CubieTruck.key<\/span>
tls-auth \/etc\/openvpn\/ta.key 0<\/span>
;; vpn \u4f7f\u7528\u7db2\u6bb5<\/span>
server 10.8.0.0 255.255.255.0<\/span>
cipher AES-256-CBC<\/span>
comp-lzo<\/span>
persist-key<\/span>
persist-tun<\/span>
status openvpn-status.log<\/span>
verb 3<\/span>
tun-mtu 1500<\/span>
tun-mtu-extra 32<\/span>
mssfix 1450<\/span>
;; \u5141\u8a31 client \u9593\u4e92\u76f8\u9023\u63a5<\/span>
;client-to-client<\/span>
push “redirect-gateway def1”<\/span>
;; DNS \u8a2d\u5b9a<\/span>
push “dhcp-option DNS 168.95.1.1”<\/span>
push “dhcp-option DNS 140.111.66.1”<\/span>
keepalive 5 30<\/span>
;; \u6700\u5927\u4f7f\u7528\u8005\u91cf<\/span>
max-clients 12<\/span>
user nobody<\/span>
group nobody<\/span><\/p>\n

\u6e2c\u8a66 \/etc\/openvpn\/server.conf<\/span> \u8a2d\u5b9a\u6a94\u8a9e\u6cd5\u662f\u5426\u6b63\u78ba
# openvpn \/etc\/openvpn\/server.conf<\/span><\/p>\n

\u9632\u706b\u7246\u4e0a\u7684\u8a2d\u5b9a\uff0c\u5982\u679c\u539f\u672c\u5c31\u6709\u9632\u706b\u7246\uff0c\u5c31\u8981\u5c07\u898f\u5247\u505a\u6574\u5408
# vim \/etc\/firewall.vpn<\/span>
#!\/bin\/bash<\/span>
# Enable ip_forward<\/span>
echo “1” > \/proc\/sys\/net\/ipv4\/ip_forward<\/span>
iptables -t filter -F<\/span>
iptables -t nat -F<\/span>
iptables -A FORWARD -m state –state RELATED,ESTABLISHED -j ACCEPT<\/span>
iptables -A FORWARD -s “10.8.0.0\/24” -j ACCEPT<\/span>
iptables -A FORWARD -j REJECT<\/span>
iptables -t nat -A POSTROUTING -s “10.8.0.0\/24” -j MASQUERADE<\/span><\/p>\n

\u66f4\u6539\u6a94\u6848\u6b0a\u9650
# chmod 700 \/etc\/firewall.vpn<\/span><\/p>\n

\u8a2d\u5b9a\u958b\u6a5f\u6642\u57f7\u884c
\u5728 \/etc\/rc.local<\/span> \u6a94\u6848\u6700\u5f8c\u9762\u52a0\u5165\u57f7\u884c\u9632\u706b\u7246\u898f\u5247\u7684\u8a2d\u5b9a
# sed -i ‘$a # OpenVPN \u9632\u706b\u7246nsh \/etc\/firewall.vpn’ \/etc\/rc.local<\/span><\/p>\n

\u57f7\u884c OpenVPN Server
# systemctl start openvpn@server.service<\/span><\/p>\n

\u8a2d\u5b9a\u958b\u6a5f\u6642\u57f7\u884c OpenVPN Server
# systemctl enable openvpn@server.service<\/span><\/p>\n

\u6aa2\u67e5 OpenVPN Server\u00a0\u57f7\u884c\u72c0\u614b
# systemctl status<\/span> openvpn@server.service<\/span><\/p>\n

\u6aa2\u67e5 OpenVPN Server\u00a0\u662f\u5426\u6709\u6b63\u5e38\u57f7\u884c
# netstat -antpul | grep openvpn<\/span>
tcp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0\u00a0\u00a0\u00a0 0 0.0.0.0:1194\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0:*\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 LISTEN\u00a0\u00a0\u00a0\u00a0\u00a0 3682\/openvpn<\/span><\/p>\n

tun0 \u4ecb\u9762\u8cc7\u8a0a
# ip addr show tun0<\/span>
7: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100<\/span>
\u00a0\u00a0\u00a0 link\/none<\/span>
\u00a0\u00a0\u00a0 inet 10.8.0.1 peer 10.8.0.2\/32 scope global tun0<\/span><\/p>\n

\u89e3\u6c7a\u51fa\u73fe Failed to read PID from file \/run\/openvpn@server.pid: Invalid argument<\/span>\u00a0\u7684\u8a0a\u606f
# chown nobody:nobody \/var\/run\/openvpn@server.pid<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

\u53c3\u8003\u7db2\u9801\uff1aOpenVPN – ArchWikiCreate a Public Key Infras … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008Cubie Truck \u6e2c\u8a66 – Arch Linux \u5b89\u88dd OpenVPN Server\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[167,170,168],"tags":[],"class_list":["post-18637","post","type-post","status-publish","format-standard","hentry","category-c-84386","category-c-85297","category-c-84780"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["523694"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18637"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=18637"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18637\/revisions"}],"predecessor-version":[{"id":20258,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18637\/revisions\/20258"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=18637"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=18637"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=18637"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}