-Sample Configs für OpenVPN mit NAT für inet (redirect-gateway) auf einem Internet Server (+ OpenVZ)\r
-\r
-OpenVPN Sampe Server Config:\r
-{{{\r
-port 1194\r
-\r
-proto tcp \r
-dev tun \r
-tls-server\r
-server 192.168.50.0 255.255.255.240 # NETZ ÄNDERN JE NACH BEDARF!\r
-\r
-ca /etc/openvpn/certs/ca_cert_vpn.pem\r
-cert /etc/openvpn/certs/server_cert_vpn.pem\r
-key /etc/openvpn/certs/server_key_vpn.pem\r
-dh /etc/openvpn/certs/dh2048.pem\r
-\r
-#Routes the packages to the intern network, you should use iptables instead of this\r
-#push "route 192.168.0.0 255.255.255.192"\r
-#push "dhcp-option DNS 192.168.50.3"\r
-\r
-#keepalive 10 120 \r
-\r
-auth SHA1\r
-\r
-user root\r
-group root\r
-\r
-persist-key\r
-persist-tun\r
-\r
-verb 3 \r
-comp-lzo\r
-client-to-client\r
-status /etc/openvpn/openvpn-status.log\r
-log-append /var/log/openvpn.log\r
-}}}\r
-\r
-Client Sample Config:\r
-{{{\r
-client\r
-dev tup \r
-proto tcp-client\r
-remote example.net\r
-resolv-retry infinite\r
-nobind\r
-persist-key\r
-persist-tun\r
-auth SHA1\r
-ca certs/ca_cert_vpn.pem\r
-cert certs/<USER>_cert_vpn.pem\r
-key certs/<USER>_key_vpn.pem\r
-comp-lzo\r
-verb 0\r
-port 143 \r
-#tls-remote VPNServer\r
-persist-local-ip\r
-}}}\r
-\r
-\r
-Zertifikate bauen: (common name muss wie der Host heißen!)\r
-{{{\r
-#!/bin/bash\r
-\r
-\r
-mkdir certs\r
-cd certs\r
-echo "CA Cert erstellen..."\r
-openssl genrsa -aes256 -out ca_key_vpn.pem 2048\r
-openssl req -new -x509 -days 3650 -key ca_key_vpn.pem -out ca_cert_vpn.pem -set_serial 1\r
-chmod 700 ../certs\r
-touch serial\r
-echo "01" > serial\r
-\r
-\r
-echo ""\r
-echo "Server Cert erstellen..."\r
-echo "Wichtig: Common Name einzigartig halten und merken - wird sp.eter im VPN Script gebraucht"\r
-echo ""\r
-openssl req -new -newkey rsa:2048 -out server_csr_vpn.pem -nodes -keyout server_key_vpn.pem -days 3650\r
-openssl x509 -req -in server_csr_vpn.pem -out server_cert_vpn.pem -CA ca_cert_vpn.pem -CAkey ca_key_vpn.pem -CAserial serial -days 3650\r
-rm server_csr_vpn.pem\r
-\r
-\r
-echo ""\r
-echo "Zufallszahlen erstellen..."\r
-openssl dhparam -out dh2048.pem 2048\r
-echo ""\r
-\r
-\r
-echo "Client Certs mit folgendem Commando vorbereiten:"\r
-echo "./clientcerts "\r
-}}}\r
-\r
-Clientcerts\r
-{{{\r
-#!/bin/bash\r
-\r
-\r
-cd certs\r
-echo "Client Cervorbvorbereiten..."\r
-openssl req -new -newkey rsa:2048 -out $1_csr_vpn.pem -nodes -keyout $1_key_vpn.pem -days 3650\r
-\r
-\r
-echo ""\r
-echo "Client Certs erstellen..."\r
-openssl x509 -req -in $1_csr_vpn.pem -out $1_cert_vpn.pem -CA ca_cert_vpn.pem -CAkey ca_key_vpn.pem -CAserial serial -days 3650\r
-echo ""\r
-echo "CSR Cert loeschen..."\r
-rm $1_csr_vpn.pem\r
-echo "Clientcert $1_cert_vpn.pem und Clientkey $1_key_vpn.pem erstellt..."\r
-cd ..\r
-}}}\r
-\r
-\r
-iptables für routing:\r
-{{{\r
-#!/bin/bash\r
-\r
-case $1 in\r
-stop)\r
-iptables -t filter -F INPUT\r
-iptables -t filter -F OUTPUT\r
-iptables -t filter -F FORWARD\r
-iptables -t filter -P INPUT ACCEPT\r
-iptables -t filter -P OUTPUT ACCEPT\r
-iptables -t filter -P FORWARD ACCEPT\r
-;;\r
-\r
-start)\r
-#$0 stop\r
-iptables -t nat -F POSTROUTING\r
-\r
-VPNDEV=tun0\r
-EXTDEV=venet0 # ANPASSEN BEI BEDARF\r
-VPNLAN=192.168.50.0/28 # BEI BEDARF ÄNDERN!\r
-echo 1 > /proc/sys/net/ipv4/ip_forward\r
-echo 1 > /proc/sys/net/ipv4/ip_dynaddr\r
-\r
-iptables -t filter -A INPUT -i lo -s 0/0 -d 0/0 -j ACCEPT\r
-iptables -t nat -A POSTROUTING -o $VPNDEV -j MASQUERADE\r
-\r
-iptables -A INPUT -i $VPNDEV -s $VPNLAN -j ACCEPT\r
-iptables -A FORWARD -i $VPNDEV -o $EXTDEV -s $VPNLAN -j ACCEPT\r
-iptables -A FORWARD -i $EXTDEV -o $VPNDEV -d $VPNLAN -m state --state RELATED,ESTABLISHED -j ACCEPT\r
-iptables -t nat -A POSTROUTING -s $VPNLAN -o $EXTDEV -j SNAT --to-source <IP DES SERVERS> \r
-;;\r
-\r
-restart)\r
-$0 stop && $0 start\r
-;;\r
-\r
-esac\r
-}}}
\ No newline at end of file
+
+Sample Configs für OpenVPN mit NAT für inet (redirect-gateway) auf einem Internet Server (+ OpenVZ)
+
+OpenVPN Sampe Server Config:
+[[!format txt """
+port 1194
+
+proto tcp
+dev tun
+tls-server
+server 192.168.50.0 255.255.255.240 # NETZ ÄNDERN JE NACH BEDARF!
+
+ca /etc/openvpn/certs/ca_cert_vpn.pem
+cert /etc/openvpn/certs/server_cert_vpn.pem
+key /etc/openvpn/certs/server_key_vpn.pem
+dh /etc/openvpn/certs/dh2048.pem
+
+#Routes the packages to the intern network, you should use iptables instead of this
+#push "route 192.168.0.0 255.255.255.192"
+#push "dhcp-option DNS 192.168.50.3"
+
+#keepalive 10 120
+
+auth SHA1
+
+user root
+group root
+
+persist-key
+persist-tun
+
+verb 3
+comp-lzo
+client-to-client
+status /etc/openvpn/openvpn-status.log
+log-append /var/log/openvpn.log
+"""]]
+Client Sample Config:
+[[!format txt """
+client
+dev tup
+proto tcp-client
+remote example.net
+resolv-retry infinite
+nobind
+persist-key
+persist-tun
+auth SHA1
+ca certs/ca_cert_vpn.pem
+cert certs/<USER>_cert_vpn.pem
+key certs/<USER>_key_vpn.pem
+comp-lzo
+verb 0
+port 143
+#tls-remote VPNServer
+persist-local-ip
+"""]]
+Zertifikate bauen: (common name muss wie der Host heißen!)
+[[!format txt """
+#!/bin/bash
+
+
+mkdir certs
+cd certs
+echo "CA Cert erstellen..."
+openssl genrsa -aes256 -out ca_key_vpn.pem 2048
+openssl req -new -x509 -days 3650 -key ca_key_vpn.pem -out ca_cert_vpn.pem -set_serial 1
+chmod 700 ../certs
+touch serial
+echo "01" > serial
+
+
+echo ""
+echo "Server Cert erstellen..."
+echo "Wichtig: Common Name einzigartig halten und merken - wird sp.eter im VPN Script gebraucht"
+echo ""
+openssl req -new -newkey rsa:2048 -out server_csr_vpn.pem -nodes -keyout server_key_vpn.pem -days 3650
+openssl x509 -req -in server_csr_vpn.pem -out server_cert_vpn.pem -CA ca_cert_vpn.pem -CAkey ca_key_vpn.pem -CAserial serial -days 3650
+rm server_csr_vpn.pem
+
+
+echo ""
+echo "Zufallszahlen erstellen..."
+openssl dhparam -out dh2048.pem 2048
+echo ""
+
+
+echo "Client Certs mit folgendem Commando vorbereiten:"
+echo "./clientcerts "
+"""]]
+Clientcerts
+[[!format txt """
+#!/bin/bash
+
+
+cd certs
+echo "Client Cervorbvorbereiten..."
+openssl req -new -newkey rsa:2048 -out $1_csr_vpn.pem -nodes -keyout $1_key_vpn.pem -days 3650
+
+
+echo ""
+echo "Client Certs erstellen..."
+openssl x509 -req -in $1_csr_vpn.pem -out $1_cert_vpn.pem -CA ca_cert_vpn.pem -CAkey ca_key_vpn.pem -CAserial serial -days 3650
+echo ""
+echo "CSR Cert loeschen..."
+rm $1_csr_vpn.pem
+echo "Clientcert $1_cert_vpn.pem und Clientkey $1_key_vpn.pem erstellt..."
+cd ..
+"""]]
+iptables für routing:
+[[!format txt """
+#!/bin/bash
+
+case $1 in
+stop)
+iptables -t filter -F INPUT
+iptables -t filter -F OUTPUT
+iptables -t filter -F FORWARD
+iptables -t filter -P INPUT ACCEPT
+iptables -t filter -P OUTPUT ACCEPT
+iptables -t filter -P FORWARD ACCEPT
+;;
+
+start)
+#$0 stop
+iptables -t nat -F POSTROUTING
+
+VPNDEV=tun0
+EXTDEV=venet0 # ANPASSEN BEI BEDARF
+VPNLAN=192.168.50.0/28 # BEI BEDARF ÄNDERN!
+echo 1 > /proc/sys/net/ipv4/ip_forward
+echo 1 > /proc/sys/net/ipv4/ip_dynaddr
+
+iptables -t filter -A INPUT -i lo -s 0/0 -d 0/0 -j ACCEPT
+iptables -t nat -A POSTROUTING -o $VPNDEV -j MASQUERADE
+
+iptables -A INPUT -i $VPNDEV -s $VPNLAN -j ACCEPT
+iptables -A FORWARD -i $VPNDEV -o $EXTDEV -s $VPNLAN -j ACCEPT
+iptables -A FORWARD -i $EXTDEV -o $VPNDEV -d $VPNLAN -m state --state RELATED,ESTABLISHED -j ACCEPT
+iptables -t nat -A POSTROUTING -s $VPNLAN -o $EXTDEV -j SNAT --to-source <IP DES SERVERS>
+;;
+
+restart)
+$0 stop && $0 start
+;;
+
+esac
+"""]]
\ No newline at end of file
projects / debienna.git / blobdiff