задача - связать машинку в инетах и роутер (сеть) дома.
===========================
ставим на фряхе
Код: Выделить всё
pkg install openvpn-2.4.6_1создаём директорию под конфиги, ходим в неё, генерим ключ. один, блин, ключ, а не пачку
Код: Выделить всё
bkp0# mkdir /usr/local/etc/openvpn
bkp0# mkdir /usr/local/etc/openvpn
bkp0# cd /usr/local/etc/openvpn
bkp0# openvpn --genkey --secret static.key
openvpn: Команда не найдена.
bkp0# rehash
bkp0# openvpn --genkey --secret static.key
bkp0# Код: Выделить всё
bkp0# cat /usr/local/etc/openvpn/openvpn.conf
# устройство
dev tun0
# IP адреса туннеля
ifconfig 192.168.111.1 192.168.111.2
# ключ шифрования
secret /usr/local/etc/openvpn/static.key
# маршрут домой, добавляемый при поднятии туннеля
route 192.168.254.0 255.255.255.0Код: Выделить всё
bkp0# tail -2 /etc/rc.conf
openvpn_enable="YES"Код: Выделить всё
bkp0# tail -20 /var/log/messages
Jul 26 21:24:35 bkp0 pkg: easy-rsa-3.0.4 installed
Jul 26 21:24:36 bkp0 pkg: openvpn-2.4.6_1 installed
Jul 26 21:24:36 bkp0 pkg: lame upgraded: 3.99.5_2 -> 3.100
Jul 26 21:34:00 bkp0 openvpn[5032]: disabling NCP mode (--ncp-disable) because not in P2MP client or server mode
Jul 26 21:34:00 bkp0 openvpn[5032]: OpenVPN 2.4.6 amd64-portbld-freebsd11.1 [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] built on Jun 26 2018
Jul 26 21:34:00 bkp0 openvpn[5032]: library versions: OpenSSL 1.0.2k-freebsd 26 Jan 2017, LZO 2.09
Jul 26 21:34:00 bkp0 openvpn[5033]: WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Jul 26 21:34:00 bkp0 openvpn[5033]: WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Jul 26 21:34:00 bkp0 openvpn[5033]: TUN/TAP device /dev/tun0 opened
Jul 26 21:34:00 bkp0 kernel: tun0: link state changed to UP
Jul 26 21:34:00 bkp0 openvpn[5033]: do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Jul 26 21:34:00 bkp0 openvpn[5033]: /sbin/ifconfig tun0 192.168.111.1 192.168.111.2 mtu 1500 netmask 255.255.255.255 up
Jul 26 21:34:00 bkp0 openvpn[5033]: Could not determine IPv4/IPv6 protocol. Using AF_INET6
Jul 26 21:34:00 bkp0 openvpn[5033]: setsockopt(IPV6_V6ONLY=0)
Jul 26 21:34:00 bkp0 openvpn[5033]: UDPv6 link local (bound): [AF_INET6][undef]:1194
Jul 26 21:34:00 bkp0 openvpn[5033]: UDPv6 link remote: [AF_UNSPEC]
bkp0#
bkp0# ifconfig tun0
tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500
options=80000<LINKSTATE>
inet6 fe80::225:90ff:fe29:f58f%tun0 prefixlen 64 scopeid 0x4
inet 192.168.111.1 --> 192.168.111.2 netmask 0xffffffff
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
groups: tun
Opened by PID 5033
bkp0#
топаем на OpenWRT, у меня Chaos Calmer.
обновляем список пакетов, ставим openvpn
Код: Выделить всё
root@RT-N13U:~# opkg update
root@RT-N13U:~# opkg install openvpn-opensslКод: Выделить всё
root@RT-N13U:~# mkdir -p /etc/openvpn/Код: Выделить всё
HP$ scp bkp0.host-food.ru:/tmp/static.key /tmp/
static.key 100% 636 0.6KB/s 00:00
HP$ scp /tmp/static.key root@192.168.254.1:/etc/openvpn/
static.key 100% 636 0.6KB/s 00:00
HP$ Код: Выделить всё
root@RT-N13U:~# cat /etc/openvpn/tun0.conf
# server
remote bkp0.host-food.ru
# interface
dev tun0
# tunnel IP addresses
ifconfig 192.168.111.2 192.168.111.1
# key
secret /etc/openvpn/static.key
# ping remote IP
keepalive 60 120Код: Выделить всё
root@RT-N13U:~# openvpn --config /etc/openvpn/tun0.conf
Thu Jul 26 21:47:34 2018 OpenVPN 2.3.6 mipsel-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jul 25 2015
Thu Jul 26 21:47:34 2018 library versions: OpenSSL 1.0.2g 1 Mar 2016, LZO 2.08
Thu Jul 26 21:47:34 2018 WARNING: file '/etc/openvpn/static.key' is group or others accessible
Thu Jul 26 21:47:34 2018 TUN/TAP device tun0 opened
Thu Jul 26 21:47:34 2018 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Jul 26 21:47:34 2018 /sbin/ifconfig tun0 192.168.111.2 pointopoint 192.168.111.1 mtu 1500
Thu Jul 26 21:47:34 2018 UDPv4 link local (bound): [undef]
Thu Jul 26 21:47:34 2018 UDPv4 link remote: [AF_INET]91.227.16.22:1194Код: Выделить всё
bkp0# ping 192.168.111.1
PING 192.168.111.1 (192.168.111.1): 56 data bytes
64 bytes from 192.168.111.1: icmp_seq=0 ttl=64 time=0.057 ms
64 bytes from 192.168.111.1: icmp_seq=1 ttl=64 time=0.058 ms
64 bytes from 192.168.111.1: icmp_seq=2 ttl=64 time=0.060 ms
64 bytes from 192.168.111.1: icmp_seq=3 ttl=64 time=0.064 ms
^C
--- 192.168.111.1 ping statistics ---
4 packets transmitted, 4 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 0.057/0.060/0.064/0.003 ms
bkp0# Код: Выделить всё
root@RT-N13U:~# /etc/init.d/openvpn start
root@RT-N13U:~# /etc/init.d/openvpn enable
root@RT-N13U:~# Код: Выделить всё
bkp0# ping 192.168.254.254
PING 192.168.254.254 (192.168.254.254): 56 data bytes
92 bytes from 192.168.111.2: Destination Port Unreachable
Vr HL TOS Len ID Flg off TTL Pro cks Src Dst
4 5 00 0054 3b91 0 0000 3f 01 50c7 192.168.111.1 192.168.254.254
92 bytes from 192.168.111.2: Destination Port Unreachable
Vr HL TOS Len ID Flg off TTL Pro cks Src Dst
4 5 00 0054 fd16 0 0000 3f 01 8f41 192.168.111.1 192.168.254.254
^C
--- 192.168.254.254 ping statistics ---
3 packets transmitted, 0 packets received, 100.0% packet loss
bkp0# Код: Выделить всё
root@RT-N13U:~# tail -8 /etc/rc.local
# tunnel forwarding
iptables -I INPUT -i tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -j ACCEPT
iptables -I OUTPUT -o tun0 -j ACCEPT
iptables -I FORWARD -o tun0 -j ACCEPT
exit 0
root@RT-N13U:~# Код: Выделить всё
root@RT-N13U:~# sh /etc/rc.local
root@RT-N13U:~# Код: Выделить всё
bkp0# ping 192.168.254.254
PING 192.168.254.254 (192.168.254.254): 56 data bytes
64 bytes from 192.168.254.254: icmp_seq=0 ttl=63 time=56.021 ms
64 bytes from 192.168.254.254: icmp_seq=1 ttl=63 time=47.977 ms
64 bytes from 192.168.254.254: icmp_seq=2 ttl=63 time=52.506 ms
^C
--- 192.168.254.254 ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 47.977/52.168/56.021/3.293 ms
bkp0# 