Zugriff per OpenVPN auf die CCU – Teil 1

root@myserver:~$ apt-get install openvpn easy-rsa
root@myserver:~$ make-cadir ~/openvpn-ca

root@myserver:~$ apt-get install openvpn easy-rsa

root@myserver:~$ make-cadir ~/openvpn-ca

root@myserver:~# cd ~/openvpn-ca
root@myserver:~/openvpn-ca# source ./vars
root@myserver:~/openvpn-ca# ./clean-all
root@myserver:~/openvpn-ca# cp openssl-1.0.0.cnf openssl.cnf
root@myserver:~/openvpn-ca# ./build-ca
root@myserver:~/openvpn-ca# ./build-key-server myserver

root@myserver:~# cd ~/openvpn-ca

root@myserver:~/openvpn-ca# source ./vars

root@myserver:~/openvpn-ca# ./clean-all

root@myserver:~/openvpn-ca# cp openssl-1.0.0.cnf openssl.cnf

root@myserver:~/openvpn-ca# ./build-ca

root@myserver:~/openvpn-ca# ./build-key-server myserver

Certificate is to be certified until Sep 28 10:32:26 2029 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
root@myserver:~/openvpn-ca#

Certificate is to be certified until Sep 28 10:32:26 2029 GMT (3650 days)

Sign the certificate? [y/n]:y

​

​

1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated

root@myserver:~/openvpn-ca#

root@myserver:~/openvpn-ca# ./build-dh
root@myserver:~/openvpn-ca# openvpn --genkey --secret keys/ta.key

root@myserver:~/openvpn-ca# ./build-dh

root@myserver:~/openvpn-ca# openvpn --genkey --secret keys/ta.key

root@myserver:~/openvpn-ca# ./build-key lnx001
root@myserver:~/openvpn-ca# ./build-key myrouter

root@myserver:~/openvpn-ca# ./build-key lnx001

root@myserver:~/openvpn-ca# ./build-key myrouter

root@myserver:~/openvpn-ca# cp -r keys /etc/openvpn

root@myserver:~/openvpn-ca# cp -r keys /etc/openvpn

# Which TCP/UDP port should OpenVPN listen on?
# If you want to run multiple OpenVPN instances
# on the same machine, use a different port
# number for each one.  You will need to
# open up this port on your firewall.
port 1194

# TCP or UDP server?
; proto tcp
proto udp

# "dev tun" will create a routed IP tunnel,
# "dev tap" will create an ethernet tunnel.
# Use "dev tap0" if you are ethernet bridging
# and have precreated a tap0 virtual interface
# and bridged it with your ethernet interface.
# If you want to control access policies
# over the VPN, you must create firewall
# rules for the the TUN/TAP interface.
# On non-Windows systems, you can give
# an explicit unit number, such as tun0.
# On Windows, use "dev-node" for this.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun

topology subnet

# SSL/TLS root certificate (ca), certificate
# (cert), and private key (key).  Each client
# and the server must have their own cert and
# key file.  The server and all clients will
# use the same ca file.
#
# See the "easy-rsa" directory for a series
# of scripts for generating RSA certificates
# and private keys.  Remember to use
# a unique Common Name for the server
# and each of the client certificates.
#
# Any X509 key management system can be used.
# OpenVPN can also use a PKCS #12 formatted key file
# (see "pkcs12" directive in man page).
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/myserver.crt
key /etc/openvpn/keys/myserver.key  # This file should be kept secret

# Diffie hellman parameters.
# Generate your own with:
#   openssl dhparam -out dh1024.pem 1024
# Substitute 2048 for 1024 if you are using
# 2048 bit keys. 
dh /etc/openvpn/keys/dh2048.pem

# Configure server mode and supply a VPN subnet
# for OpenVPN to draw client addresses from.
# The server will take 10.50.11.1 for itself,
# the rest will be made available to clients.
# Each client will be able to reach the server
# on 10.50.11.1. Comment this line out if you are
# ethernet bridging. See the man page for more info.
server 10.50.11.0 255.255.255.0

# Push routes to the client to allow it
# to reach other private subnets behind
# the server.  Remember that these
# private subnets will also need
# to know to route the OpenVPN client
# address pool (10.8.0.0/255.255.255.0)
# back to the OpenVPN server.
push "dhcp-option DNS <YOUR DNS IP ON THE OPENVPN SERVER>"
push "dhcp-option DNS <YOUR 2nd DNS IP ON THE OPENVPN SERVER>"
push "explicit-exit-notify 3"

# To assign specific IP addresses to specific
# clients or if a connecting client has a private
# subnet behind it that should also have VPN access,
# use the subdirectory "ccd" for client-specific
# configuration files (see man page for more info).

client-config-dir /etc/openvpn/ccd
route 10.70.11.0 255.255.255.0 10.50.11.11

# If enabled, this directive will configure
# all clients to redirect their default
# network gateway through the VPN, causing
# all IP traffic such as web browsing and
# and DNS lookups to go through the VPN
# (The OpenVPN server machine may need to NAT
# or bridge the TUN/TAP interface to the internet
# in order for this to work properly).
push "redirect-gateway def1"

# Uncomment this directive to allow different
# clients to be able to "see" each other.
# By default, clients will only see the server.
# To force clients to only see the server, you
# will also need to appropriately firewall the
# server's TUN/TAP interface.
client-to-client

# The keepalive directive causes ping-like
# messages to be sent back and forth over
# the link so that each side knows when
# the other side has gone down.
# Ping every 10 seconds, assume that remote
# peer is down if no ping received during
# a 120 second time period.
keepalive 10 120

# For extra security beyond that provided
# by SSL/TLS, create an "HMAC firewall"
# to help block DoS attacks and UDP port flooding.
#
# Generate with:
#   openvpn --genkey --secret ta.key
#
# The server and each client must have
# a copy of this key.
# The second parameter should be '0'
# on the server and '1' on the clients.
tls-auth /etc/openvpn/keys/ta.key 0 # This file is secret

# Select a cryptographic cipher.
# This config item must be copied to
# the client config file as well.
;cipher BF-CBC        # Blowfish (default)
; cipher AES-128-CBC   # AES
cipher AES-192-CBC   # AES
;cipher DES-EDE3-CBC  # Triple-DES

# Enable compression on the VPN link.
# If you enable it here, you must also
# enable it in the client config file.
comp-lzo adaptive

# It's a good idea to reduce the OpenVPN
# daemon's privileges after initialization.
#
# You can uncomment this out on
# non-Windows systems.
user nobody
group nogroup

# Output a short status file showing
# current connections, truncated
# and rewritten every minute.
status openvpn-status.log

# By default, log messages will go to the syslog (or
# on Windows, if running as a service, they will go to
# the "\Program Files\OpenVPN\log" directory).
# Use log or log-append to override this default.
# "log" will truncate the log file on OpenVPN startup,
# while "log-append" will append to it.  Use one
# or the other (but not both).
log         openvpn.log
;log-append  openvpn.log

# Set the appropriate level of log
# file verbosity.
#
# 0 is silent, except for fatal errors
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
verb 4

# Which TCP/UDP port should OpenVPN listen on?

# If you want to run multiple OpenVPN instances

# on the same machine, use a different port

# number for each one.  You will need to

# open up this port on your firewall.

port 1194

​

# TCP or UDP server?

; proto tcp

proto udp

​

# "dev tun" will create a routed IP tunnel,

# "dev tap" will create an ethernet tunnel.

# Use "dev tap0" if you are ethernet bridging

# and have precreated a tap0 virtual interface

# and bridged it with your ethernet interface.

# If you want to control access policies

# over the VPN, you must create firewall

# rules for the the TUN/TAP interface.

# On non-Windows systems, you can give

# an explicit unit number, such as tun0.

# On Windows, use "dev-node" for this.

# On most systems, the VPN will not function

# unless you partially or fully disable

# the firewall for the TUN/TAP interface.

;dev tap

dev tun

​

topology subnet

​

# SSL/TLS root certificate (ca), certificate

# (cert), and private key (key).  Each client

# and the server must have their own cert and

# key file.  The server and all clients will

# use the same ca file.

#

# See the "easy-rsa" directory for a series

# of scripts for generating RSA certificates

# and private keys.  Remember to use

# a unique Common Name for the server

# and each of the client certificates.

#

# Any X509 key management system can be used.

# OpenVPN can also use a PKCS #12 formatted key file

# (see "pkcs12" directive in man page).

ca /etc/openvpn/keys/ca.crt

cert /etc/openvpn/keys/myserver.crt

key /etc/openvpn/keys/myserver.key  # This file should be kept secret

​

# Diffie hellman parameters.

# Generate your own with:

#   openssl dhparam -out dh1024.pem 1024

# Substitute 2048 for 1024 if you are using

# 2048 bit keys. 

dh /etc/openvpn/keys/dh2048.pem

​

# Configure server mode and supply a VPN subnet

# for OpenVPN to draw client addresses from.

# The server will take 10.50.11.1 for itself,

# the rest will be made available to clients.

# Each client will be able to reach the server

# on 10.50.11.1. Comment this line out if you are

# ethernet bridging. See the man page for more info.

server 10.50.11.0 255.255.255.0

​

# Push routes to the client to allow it

# to reach other private subnets behind

# the server.  Remember that these

# private subnets will also need

# to know to route the OpenVPN client

# address pool (10.8.0.0/255.255.255.0)

# back to the OpenVPN server.

push "dhcp-option DNS <YOUR DNS IP ON THE OPENVPN SERVER>"

push "dhcp-option DNS <YOUR 2nd DNS IP ON THE OPENVPN SERVER>"

push "explicit-exit-notify 3"

​

# To assign specific IP addresses to specific

# clients or if a connecting client has a private

# subnet behind it that should also have VPN access,

# use the subdirectory "ccd" for client-specific

# configuration files (see man page for more info).

​

client-config-dir /etc/openvpn/ccd

route 10.70.11.0 255.255.255.0 10.50.11.11

​

# If enabled, this directive will configure

# all clients to redirect their default

# network gateway through the VPN, causing

# all IP traffic such as web browsing and

# and DNS lookups to go through the VPN

# (The OpenVPN server machine may need to NAT

# or bridge the TUN/TAP interface to the internet

# in order for this to work properly).

push "redirect-gateway def1"

​

# Uncomment this directive to allow different

# clients to be able to "see" each other.

# By default, clients will only see the server.

# To force clients to only see the server, you

# will also need to appropriately firewall the

# server's TUN/TAP interface.

client-to-client

​

# The keepalive directive causes ping-like

# messages to be sent back and forth over

# the link so that each side knows when

# the other side has gone down.

# Ping every 10 seconds, assume that remote

# peer is down if no ping received during

# a 120 second time period.

keepalive 10 120

​

# For extra security beyond that provided

# by SSL/TLS, create an "HMAC firewall"

# to help block DoS attacks and UDP port flooding.

#

# Generate with:

#   openvpn --genkey --secret ta.key

#

# The server and each client must have

# a copy of this key.

# The second parameter should be '0'

# on the server and '1' on the clients.

tls-auth /etc/openvpn/keys/ta.key 0 # This file is secret

​

# Select a cryptographic cipher.

# This config item must be copied to

# the client config file as well.

;cipher BF-CBC        # Blowfish (default)

; cipher AES-128-CBC   # AES

cipher AES-192-CBC   # AES

;cipher DES-EDE3-CBC  # Triple-DES

​

# Enable compression on the VPN link.

# If you enable it here, you must also

# enable it in the client config file.

comp-lzo adaptive

​

# It's a good idea to reduce the OpenVPN

# daemon's privileges after initialization.

#

# You can uncomment this out on

# non-Windows systems.

user nobody

group nogroup

​

# Output a short status file showing

# current connections, truncated

# and rewritten every minute.

status openvpn-status.log

​

# By default, log messages will go to the syslog (or

# on Windows, if running as a service, they will go to

# the "\Program Files\OpenVPN\log" directory).

# Use log or log-append to override this default.

# "log" will truncate the log file on OpenVPN startup,

# while "log-append" will append to it.  Use one

# or the other (but not both).

log         openvpn.log

;log-append  openvpn.log

​

# Set the appropriate level of log

# file verbosity.

#

# 0 is silent, except for fatal errors

# 4 is reasonable for general usage

# 5 and 6 can help to debug connection problems

# 9 is extremely verbose

verb 4

root@myserver:/etc/openvpn# mkdir ccd
root@myserver:/etc/openvpn# vi ccd/myrouter
ifconfig-push 10.50.11.11 255.255.255.0
iroute 10.70.11.0 255.255.255.0

root@myserver:/etc/openvpn# mkdir ccd

root@myserver:/etc/openvpn# vi ccd/myrouter

ifconfig-push 10.50.11.11 255.255.255.0

iroute 10.70.11.0 255.255.255.0

apt-get install network-manager-openvpn-gnome

apt-get install network-manager-openvpn-gnome