{"id":19356,"date":"2017-01-01T06:48:11","date_gmt":"2016-12-31T22:48:11","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/01\/01\/%e8%a9%a6%e7%94%a8-banana-pi-r1-ubuntu-minimal-16-04-%e4%b8%8a%e5%ae%89%e8%a3%9d-openvpn\/"},"modified":"2021-03-18T17:24:52","modified_gmt":"2021-03-18T09:24:52","slug":"%e8%a9%a6%e7%94%a8-banana-pi-r1-ubuntu-minimal-16-04-%e4%b8%8a%e5%ae%89%e8%a3%9d-openvpn","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/01\/01\/%e8%a9%a6%e7%94%a8-banana-pi-r1-ubuntu-minimal-16-04-%e4%b8%8a%e5%ae%89%e8%a3%9d-openvpn\/","title":{"rendered":"\u8a66\u7528 Banana Pi R1 – Ubuntu minimal 16.04 \u4e0a\u5b89\u88dd OpenVPN"},"content":{"rendered":"

\u53c3\u8003\u7db2\u7ad9\uff1a
How To Set Up an OpenVPN Server on Ubuntu 16.04 | DigitalOcean<\/a> <\/p>\n

1. \u5b89\u88dd OpenVPN
# apt-get install openvpn easy-rsa<\/span> <\/p>\n

2. \u5efa\u7acb Certificate Authority
# mkdir -p \/etc\/openvpn\/easy-rsa\/keys<\/span>
# cp -r \/usr\/share\/easy-rsa \/etc\/openvpn<\/span>
# cd \/etc\/openvpn\/easy-rsa<\/span>
\u8acb\u60c5\u6cc1\u4fee\u6539 \/etc\/openvpn\/easy-rsa\/vars<\/span> \u4e2d\u7684\u8b8a\u6578
# vim \/etc\/open<\/span><\/span><\/span>vpn\/easy-rsa\/vars<\/span>
export KEY_COUNTRY=”TW<\/span>“<\/span>
export KEY_PROVINCE=”Taiwan<\/span>“<\/span>
export KEY_CITY=”Yilan<\/span>“<\/span>
export KEY_ORG=”School<\/span>“<\/span>
export KEY_EMAIL=”me@myhost.mydomain”<\/span>
export KEY_OU=”MyOrganizationalUnit”<\/span> <\/p>\n

# X509 Subject Field<\/span>
export KEY_NAME=”EasyRSA”[@more@]<\/span>
# source .\/vars<\/span>
NOTE: If you run .\/clean-all, I will be doing a rm -rf on \/etc\/openvpn\/easy-rsa\/keys<\/span>
# .\/clean-all<\/span>
# .\/build-ca<\/span> <\/p>\n

3. \u7522\u751f Server \u6191\u8b49\u3001\u91d1\u9470\u53ca\u52a0\u5bc6\u6a94\u6848
#\u00a0 .\/build-key-server server<\/span>
Certificate is to be certified until Dec 21 10:24:53 2026 GMT (3650 days) <\/span>
Sign the certificate? [y\/n]:<\/span>y<\/span> <\/p>\n

1 out of 1 certificate requests certified, commit? [y\/n]<\/span>y<\/span>
Write out database with 1 new entries <\/span>
Data Base Updated<\/span> <\/p>\n

\u6642\u9593\u6703\u7a0d\u5fae\u6bd4\u8f03\u4e45\u4e00\u4e9b
# .\/build-dh<\/span>
# openvpn –genkey –secret keys\/ta.key<\/span> <\/p>\n

4. \u7522\u751f Client Certificate \u548c Key Pair
# source .\/vars<\/span>
NOTE: If you run .\/clean-all, I will be doing a rm -rf on \/etc\/openvpn\/easy-rsa\/keys<\/span>
# .\/build-key client<\/span>
Please enter the following ‘extra’ attributes <\/span>
to be sent with your certificate request <\/span>
A challenge password []: <\/span>
An optional company name []: <\/span>
Using configuration from \/etc\/openvpn\/easy-rsa\/openssl-1.0.0.cnf <\/span>
Check that the request matches the signature <\/span>
Signature ok <\/span><\/p>\n

Certificate is to be certified until Dec 21 12:15:42 2026 GMT (3650 days) <\/span>
Sign the certificate? [y\/n]:<\/span>y<\/span> <\/p>\n

1 out of 1 certificate requests certified, commit? [y\/n]y <\/span>
Write out database with 1 new entries <\/span>
Data Base Updated<\/span> <\/p>\n

\u5982\u679c\u8981\u5efa\u7acb\u9700\u8981\u5bc6\u78bc
# source .\/vars<\/span>
NOTE: If you run .\/clean-all, I will be doing a rm -rf on \/etc\/openvpn\/easy-rsa\/keys<\/span>
# .\/build-pass client<\/span> <\/p>\n

5. \u8907\u88fd\u6191\u8b49\u91d1\u9470\u5230 \/etc\/openvpn\/keys<\/span> \u76ee\u9304
# cd \/etc\/openvpn\/easy-rsa\/keys<\/span>\u00a0
# mkdir \/etc\/openvpn\/keys<\/span>
# cp ca.crt ca.key server.crt server.key ta.key dh2048.pem \/etc\/openvpn\/keys<\/span><\/p>\n

6. \u8a2d\u5b9a OpenVPN
\u4fee\u6539 \/etc\/openvpn\/server.conf<\/span> \u8a2d\u5b9a\u6a94
# gunzip -c \/usr\/share\/doc\/openvpn\/examples\/sample-config-files\/server.conf.gz | tee \/etc\/openvpn\/server.conf<\/span>
# cp \/etc\/openvpn\/server.conf \/etc\/openvpn\/server.conf.$(date +%F)<\/span> <\/p>\n

\u4fee\u6539\u8a2d\u5b9a
# sed -i ‘s\/;tls-auth\/tls-auth\/’ \/etc\/openvpn\/server.conf<\/span>
# sed -i ‘\/tls-auth\/ akey-direction 0’ \/etc\/openvpn\/server.conf<\/span>
# sed -i ‘s\/;cipher AES\/cipher AES\/’ \/etc\/openvpn\/server.conf<\/span>
# sed -i ‘\/^cipher\/ aauth SHA256’ \/etc\/openvpn\/server.conf<\/span>
OpenVPN \u57f7\u884c\u4f7f\u7528\u8005\u53ca\u7fa4\u7d44
# sed -i ‘s\/^;user\/user\/’ \/etc\/openvpn\/server.conf<\/span>
# sed -i ‘s\/^;group\/group\/’ \/etc\/openvpn\/server.conf<\/span>
VPN Client \u7684 Default Gatewa y\u4ee5 VPN Gateway \u70ba\u4e3b
# sed -i ‘s\/^;push “redirect\/push “redirect\/’ \/etc\/openvpn\/server.conf<\/span>
DNS \u00a0\u8a2d\u5b9a
# sed -i ‘s\/^;push “dhcp-option DNS 208.67.222.222″\/push “dhcp-option DNS 168.95.1.1″\/’ \/etc\/openvpn\/server.conf<\/span>
# sed -i ‘s\/^;push “dhcp-option DNS 208.67.220.220″\/push “dhcp-option DNS 8.8.8.8″\/’ \/etc\/openvpn\/server.conf<\/span>
\u5c07\u9810\u8a2d\u7684 UDP \u6539\u70ba TCP
# sed -i ‘s\/^;proto tcp\/proto tcp\/’ \/etc\/openvpn\/server.conf<\/span>
# sed -i ‘s\/^proto udp\/;proto udp\/’ \/etc\/openvpn\/server.conf<\/span>
\u66f4\u6539 crt \/ key \u7684\u6a94\u6848\u4f4d\u7f6e
# sed -i ‘s|ca ca.crt|ca \/etc\/openvpn\/keys\/ca.crt|’<\/span> \/etc\/openvpn\/server.conf<\/span>
# sed -i ‘s|cert server.crt|cert \/etc\/openvpn\/keys\/server.crt|’<\/span> \/etc\/openvpn\/server.conf<\/span>
# sed -i ‘s|key server.key|key \/etc\/openvpn\/keys\/server.key|’<\/span> \/etc\/openvpn\/server.conf<\/span>
# sed -i ‘s|dh dh2048.pem|dh \/etc\/openvpn\/keys\/dh2048.pem|’<\/span> \/etc\/openvpn\/server.conf<\/span>
# sed -i ‘s|tls-auth ta.key 0|tls-auth \/etc\/openvpn\/keys\/ta.key 0|’<\/span> \/etc\/openvpn\/server.conf<\/span>
\u4f7f\u7528\u6191\u8b49\u8a8d\u8b49\u6642\uff0c\u5141\u8a31\u6240\u6709\u7684 Client \u4f7f\u7528\u76f8\u540c\u7684 KEY \u767b\u5165
# sed -i ‘s\/^;duplicate-cn\/duplicate-cn\/’ \/etc\/openvpn\/server.conf<\/span>
\u5141\u8a31 Client \u9593\u4e92\u63a5\u9023\u63a5
# sed -i ‘s\/^;client-to-client\/client-to-client\/’<\/span> \/etc\/openvpn\/server.conf<\/span>
\u66f4\u6539 log \u6a94\u4f4d\u7f6e
# sed -i ‘s|status openvpn-status.log|status \/var\/log\/openvpn\/openvpn-status.log|’\u00a0<\/span> \/etc\/openvpn\/server.conf<\/span>
# sed -i ‘s|;log\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 openvpn.log|log\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/var\/log\/openvpn\/openvpn.log|’<\/span> \/etc\/openvpn\/server.conf<\/span>
# sed -i ‘s|;log-append\u00a0 openvpn.log|log-append\u00a0 \/var\/log\/openvpn\/openvpn.log|’<\/span> \/etc\/openvpn\/server.conf<\/span>
\u6b64\u7db2\u6bb5\u8d70 VPN Gateway
# sed -i ‘\/^;push “route 192.168.10\/ ipush “route 10.8.0.0 255.255.255.0″‘ \/etc\/openvpn\/server.conf
<\/span>
For sed
# cat script-file<\/span>
s\/;tls-auth\/tls-auth\/<\/span>
\/tls-auth\/ akey-direction 0<\/span>
s\/;cipher AES\/cipher AES\/<\/span>
\/^cipher\/ aauth SHA256<\/span>
s\/^;user\/user\/<\/span>
s\/^;group\/group\/<\/span>
s\/^;push “redirect\/push “redirect\/<\/span>
s\/^;push “dhcp-option DNS 208.67.222.222″\/push “dhcp-option DNS 168.95.1.1″\/<\/span>
s\/^;push “dhcp-option DNS 208.67.220.220″\/push “dhcp-option DNS 8.8.8.8″\/<\/span>
s\/^;proto tcp\/proto tcp\/<\/span>
s\/^proto udp\/;proto udp\/<\/span>
s|ca ca.crt|ca \/etc\/openvpn\/keys\/ca.crt|<\/span>
s|cert server.crt|cert \/etc\/openvpn\/keys\/server.crt|<\/span>
s|key server.key|key \/etc\/openvpn\/keys\/server.key|<\/span>
s|dh dh2048.pem|dh \/etc\/openvpn\/keys\/dh2048.pem|<\/span>
s|tls-auth ta.key 0|tls-auth \/etc\/openvpn\/keys\/ta.key 0|<\/span>
s\/^;duplicate-cn\/duplicate-cn\/<\/span>
s\/^;client-to-client\/client-to-client\/<\/span>
s|status openvpn-status.log|status \/var\/log\/openvpn\/openvpn-status.log|<\/span>
s|;log\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 openvpn.log|log\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/var\/log\/openvpn\/openvpn.log|<\/span>
s|;log-append\u00a0 openvpn.log|log-append\u00a0 \/var\/log\/openvpn\/openvpn.log|<\/span>
\/^;push “route 192.168.10\/ ipush “route 10.8.0.0 255.255.255.0”<\/span><\/p>\n

# sed -i -f script-file \/etc\/openvpn\/server.conf<\/span><\/p>\n

\u5efa\u7acb\u5b58\u653e Log \u7684\u76ee\u9304
# mkdir \/var\/log\/openvpn<\/span><\/p>\n

7.\u8a2d\u5b9a\u7db2\u8def Forward
# sed -i ‘s\/#net.ipv4.ip_forward=1\/net.ipv4.ip_forward=1\/’ \/etc\/sysctl.conf<\/span>
# sysctl -p<\/span><\/p>\n

8. \u9632\u706b\u7246\u8a2d\u5b9a iptables
# iptables -t nat -A POSTROUTING -s 10.8.0.0\/24 -o eth0 -j MASQUERADE<\/span>
# iptables -A FORWARD -i tun0 -j ACCEPT<\/span>\u00a0
# iptables -A FORWARD -o tun0 -j ACCEPT<\/span><\/p>\n

9. \u8a2d\u5b9a\u958b\u6a5f\u6642\u555f\u52d5 OpenVPN \u670d\u52d9
# systemctl enable openvpn@server.service<\/span>
Created symlink from \/etc\/systemd\/system\/multi-user.target.wants\/openvpn@server.service to \/lib\/systemd\/system\/openvpn@.service.<\/span><\/p>\n

10. \u555f\u52d5\u4e26\u6aa2\u67e5\u662f\u5426\u6709\u6b63\u5e38\u555f\u52d5
# systemctl start openvpn@server.service<\/span>
# systemctl status openvpn@server.service | head -3<\/span>
\u25cf openvpn@server.service – OpenVPN connection to server<\/span>
\u00a0 \u00a0Loaded: loaded (\/lib\/systemd\/system\/openvpn@.service; enabled; vendor preset: enabled)<\/span>
\u00a0 \u00a0Active: active (<\/span>running<\/span>) since \u4e94 2016-12-23 21:35:43 CST; 15h ago<\/span><\/p>\n

# netstat -antpl | grep :1194<\/span>
<\/span>tcp \u00a0 \u00a0 \u00a0 \u00a00 \u00a0 \u00a0 \u00a00 0.0.0.0:1194 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a00.0.0.0:* \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 LISTEN \u00a0 \u00a0 \u00a03146\/openvpn<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

\u53c3\u8003\u7db2\u7ad9\uff1a How To Set Up an OpenVPN Server on Ubuntu 16.04 | … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008\u8a66\u7528 Banana Pi R1 – Ubuntu minimal 16.04 \u4e0a\u5b89\u88dd OpenVPN\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[162,168,119],"tags":[],"class_list":["post-19356","post","type-post","status-publish","format-standard","hentry","category-c-83744","category-c-84780","category-c-78464"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["680565"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19356"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=19356"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19356\/revisions"}],"predecessor-version":[{"id":20900,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19356\/revisions\/20900"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=19356"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=19356"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=19356"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}