{"id":98201,"date":"2020-10-24T20:42:36","date_gmt":"2020-10-24T18:42:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/nastrojka-na-nas-synology-openvpn-servera-po-tipu-site-to-site"},"modified":"2020-11-18T00:58:46","modified_gmt":"2020-11-17T22:58:46","slug":"nastrojka-na-nas-synology-openvpn-servera-po-tipu-site-to-site","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/nastrojka-na-nas-synology-openvpn-servera-po-tipu-site-to-site","title":{"rendered":"Nastaven\u00ed OpenVPN serveru na NAS Synology typu site-to-site","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ahoj v\u0161ichni!<\/p>\n

V\u00edm, \u017ee pro nastaven\u00ed OpenVPN bylo vytvo\u0159eno mnoho materi\u00e1l\u016f. Nicm\u00e9n\u011b jsem narazil na to, \u017ee systematick\u00e9 informace k t\u00e9matu v podstat\u011b neexistuj\u00ed, a rozhodl jsem se pod\u011blit o sv\u00e9 zku\u0161enosti p\u0159edev\u0161\u00edm s t\u011bmi, kte\u0159\u00ed nejsou experty na administraci OpenVPN, ale cht\u011bli by dos\u00e1hnout p\u0159ipojen\u00ed vzd\u00e1len\u00fdch pods\u00edt\u00ed typu site-to-site na NAS Synology. Tak\u00e9 si t\u00edm ud\u011bl\u00e1m pozn\u00e1mku pro sebe.<\/p>\n

Tak\u017ee. M\u00e1m NAS Synology DS918+ s nainstalovan\u00fdm bal\u00ed\u010dkem VPN<\/a> Server, nastaven\u00fdm OpenVPN a u\u017eivateli, kte\u0159\u00ed se mohou p\u0159ipojovat k VPN serveru. Nebudu se rozepisovat o podrobnostech nastaven\u00ed serveru v rozhran\u00ed DSM (webov\u00fd port\u00e1l NAS serveru). Tyto informace jsou k dispozici na webu v\u00fdrobce.<\/p>\n

Probl\u00e9m je v tom, \u017ee rozhran\u00ed DSM (k datu publikace verze 6.2.3) m\u00e1 omezen\u00fd po\u010det nastaven\u00ed pro spr\u00e1vu OpenVPN serveru. V na\u0161em p\u0159\u00edpad\u011b je po\u017eadov\u00e1na sch\u00e9ma p\u0159ipojen\u00ed typu site-to-site, tj. hostitel\u00e9 pods\u00edt\u011b klienta VPN by m\u011bli vid\u011bt hostitele pods\u00edt\u011b VPN serveru a naopak. Standardn\u00ed nastaven\u00ed, kter\u00e1 jsou k dispozici na NAS, umo\u017e\u0148uj\u00ed nastavit p\u0159\u00edstup pouze od hostitel\u016f pods\u00edt\u011b klienta VPN k hostitel\u016fm pods\u00edt\u011b serveru VPN.
\n<\/a><\/noindex>
\nPro nastaven\u00ed p\u0159\u00edstupu k pods\u00edt\u00edm klient\u016f VPN z pods\u00edt\u011b VPN serveru bude pot\u0159eba p\u0159ihl\u00e1sit se na NAS p\u0159es SSH a ru\u010dn\u011b upravit konfigura\u010dn\u00ed soubor OpenVPN serveru.<\/p>\n

Pro \u00fapravu soubor\u016f na NAS p\u0159es SSH se mi l\u00e9pe pou\u017e\u00edv\u00e1 Midnight Commander. K tomu jsem v Centru bal\u00ed\u010dk\u016f p\u0159ipojil zdroj packages.synocommunity.com<\/a><\/noindex> a nainstaloval bal\u00ed\u010dek Midnight Commander.<\/p>\n

\"Nastaven\u00ed
\n
\nP\u0159ihla\u0161ujeme se p\u0159es SSH na NAS s \u00fa\u010dtem s administr\u00e1torsk\u00fdmi pr\u00e1vy.<\/p>\n

\"Nastaven\u00ed
\n
\nZad\u00e1v\u00e1me sudo su a je\u0161t\u011b jednou uv\u00e1d\u00edme heslo administr\u00e1tora:<\/p>\n

\"Nastaven\u00ed
\n
\nZad\u00e1v\u00e1me p\u0159\u00edkaz mc a spou\u0161t\u00edme Midnight Commander:<\/p>\n

\"Nastaven\u00ed
\n
\nPot\u00e9 p\u0159ech\u00e1z\u00edme do adres\u00e1\u0159e \/var\/packages\/VPNCenter\/etc\/openvpn\/ a hled\u00e1me soubor openvpn.conf:<\/p>\n

\"Nastaven\u00ed
\n
\nPro \u00fakol pot\u0159ebujeme p\u0159ipojit 2 vzd\u00e1len\u00e9 pods\u00edt\u011b. K tomu vytvo\u0159\u00edme p\u0159es DSM 2 \u00fa\u010dty na NAS s omezen\u00fdmi pr\u00e1vy na v\u0161echny slu\u017eby NAS a ud\u011bl\u00edme p\u0159\u00edstup pouze na VPN p\u0159ipojen\u00ed v nastaven\u00ed VPN Serveru. Pro ka\u017ed\u00e9ho klienta mus\u00edme nastavit statickou IP p\u0159id\u011blenou VPN serverem a sm\u011brov\u00e1n\u00ed p\u0159es tuto IP pro provoz z pods\u00edt\u011b VPN serveru na pods\u00ed\u0165 VPN klienta.<\/p>\n

V\u00fdchoz\u00ed \u00fadaje:<\/p>\n

Pods\u00ed\u0165 VPN serveru: 192.168.1.0\/24.
\nRozsah adres OpenVPN serveru 10.8.0.0\/24. Samotn\u00fd OpenVPN server z\u00edsk\u00e1v\u00e1 adresu 10.8.0.1.
\nPods\u00ed\u0165 VPN klienta 1 (u\u017eivatel VPN): 192.168.10.0\/24, by m\u011bl z\u00edskat na OpenVPN serveru statickou adresu 10.8.0.5.
\nVPN klienta 2 (u\u017eivatel VPN-GUST): 192.168.5.0\/24 by m\u011bl na OpenVPN serveru p\u0159ij\u00edmat statickou adresu 10.8.0.4<\/p>\n

V katalogu se nastaven\u00edm vytvo\u0159\u00edme slo\u017eku ccd a v n\u00ed vytvo\u0159\u00edme soubory s n\u00e1zvy odpov\u00eddaj\u00edc\u00edmi u\u017eivatelsk\u00fdm jm\u00e9n\u016fm.<\/p>\n

\"Nastaven\u00ed
\n
\nPro u\u017eivatele VPN v souboru specifikujeme n\u00e1sleduj\u00edc\u00ed nastaven\u00ed:<\/p>\n

\"Nastaven\u00ed
\n
\nPro u\u017eivatele VPN-GUST v souboru specifikujeme n\u00e1sleduj\u00edc\u00ed:<\/p>\n

\"Nastaven\u00ed
\n
\nZb\u00fdv\u00e1 jen doladit konfiguraci OpenVPN serveru \u2013 p\u0159idat parametr pro \u010dten\u00ed nastaven\u00ed klient\u016f a p\u0159idat routov\u00e1n\u00ed na pods\u00edt\u011b klient\u016f:<\/p>\n

\"Nastaven\u00ed
\n
\nNa uveden\u00e9m screenshotu se prvn\u00edch 2 \u0159\u00e1dk\u016f konfigurace nastavuje pomoc\u00ed rozhran\u00ed DSM (v\u00fdb\u011brem mo\u017enosti \u201eUmo\u017enit klient\u016fm p\u0159\u00edstup k m\u00edstn\u00ed s\u00edti serveru\u201c v nastaven\u00ed OpenVPN serveru).<\/p>\n

\u0158\u00e1dek client-config-dir ccd ukazuje, \u017ee nastaven\u00ed klient\u016f se nach\u00e1z\u00ed ve slo\u017ece ccd.<\/p>\n

D\u00e1le 2 \u0159\u00e1dky nastaven\u00ed p\u0159id\u00e1vaj\u00ed routy na pods\u00edt\u011b klient\u016f prost\u0159ednictv\u00edm odpov\u00eddaj\u00edc\u00edch OpenVPN br\u00e1n.<\/p>\n

A nakonec je pro spr\u00e1vnou funkci nezbytn\u00e9 pou\u017e\u00edt topologii subnet.
\nV\u0161echny ostatn\u00ed nastaven\u00ed v souboru nech\u00e1v\u00e1me nedot\u010dena.<\/p>\n

Po zad\u00e1n\u00ed nastaven\u00ed nezapome\u0148te restartovat slu\u017ebu VPN Server v spr\u00e1vci bal\u00ed\u010dk\u016f. Na hostitel\u00edch nebo br\u00e1n\u011b pro hostitele pods\u00edt\u011b serveru je t\u0159eba napsat routy na pods\u00edt\u011b klient\u016f p\u0159es NAS.
\nV m\u00e9m p\u0159\u00edpad\u011b byla br\u00e1nou pro v\u0161echny hostitele pods\u00edt\u011b, ve kter\u00e9 se nach\u00e1z\u00ed NAS (jeho IP 192.168.1.3), router (192.168.1.1). Na tomto routeru jsem p\u0159idal do statick\u00e9 tabulky sm\u011brov\u00e1n\u00ed z\u00e1znamy pro s\u00edt\u011b 192.168.5.0\/24 a 192.168.10.0\/24 s br\u00e1nou 192.168.1.3 (NAS).<\/p>\n

Nezapome\u0148te, \u017ee p\u0159i zapnut\u00e9m firewallu na NAS bude t\u0159eba to tak\u00e9 nastavit. Na klientsk\u00e9 stran\u011b m\u016f\u017ee b\u00fdt zapnut\u00fd firewall, kter\u00fd tak\u00e9 bude nutn\u00e9 nakonfigurovat.<\/p>\n

P.S. Nejsem profesion\u00e1l v s\u00ed\u0165ov\u00fdch technologi\u00edch a zejm\u00e9na v pr\u00e1ci s OpenVPN, jen se d\u011bl\u00edm o sv\u00e9 zku\u0161enosti a zve\u0159ej\u0148uji nastaven\u00ed, kter\u00e1 jsem ud\u011blal, co\u017e umo\u017enilo nastavit spojen\u00ed mezi pods\u00edt\u011bmi typu site-to-site. Mo\u017en\u00e1 existuje jednodu\u0161\u0161\u00ed a\/nebo spr\u00e1vn\u011bj\u0161\u00ed nastaven\u00ed, budu vd\u011b\u010dn\u00fd, pokud se pod\u011bl\u00edte o zku\u0161enosti v koment\u00e1\u0159\u00edch.
\n
Zdroj: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442! \u0417\u043d\u0430\u044e, \u0447\u0442\u043e \u0442\u0435\u043c \u0441 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c\u0438 OpenVPN \u0441\u0434\u0435\u043b\u0430\u043d\u043e \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e. \u041e\u0434\u043d\u0430\u043a\u043e, \u0441\u0430\u043c \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0441\u044f \u0441 \u0442\u0435\u043c, \u0447\u0442\u043e \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043f\u043e \u0442\u0435\u043c\u0435 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 \u0432 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0435 \u043d\u0435\u0442 \u0438 \u0440\u0435\u0448\u0438\u043b \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u043e\u043f\u044b\u0442\u043e\u043c \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u0441 \u0442\u0435\u043c\u0438, \u043a\u0442\u043e \u043d\u0435 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0433\u0443\u0440\u0443 \u0432 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 OpenVPN, \u043d\u043e \u0445\u043e\u0442\u0435\u043b \u0431\u044b \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0435\u0442\u0435\u0439 \u043f\u043e \u0442\u0438\u043f\u0443 site-to-site \u043d\u0430 NAS Synology. \u0417\u0430\u043e\u0434\u043d\u043e \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":98202,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-98201","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Nastaven\u00ed OpenVPN serveru na NAS Synology typu site-to-site | ProHoster","description":"Ahoj v\u0161em! V\u00edm, \u017ee bylo vytvo\u0159eno mnoho t\u00e9mat o nastaven\u00ed OpenVPN.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/nastrojka-na-nas-synology-openvpn-servera-po-tipu-site-to-site","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043d\u0430 NAS Synology OpenVPN \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043f\u043e \u0442\u0438\u043f\u0443 site-to-site | ProHoster","og:description":"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442! \u0417\u043d\u0430\u044e, \u0447\u0442\u043e \u0442\u0435\u043c \u0441 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c\u0438 OpenVPN \u0441\u0434\u0435\u043b\u0430\u043d\u043e \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/nastrojka-na-nas-synology-openvpn-servera-po-tipu-site-to-site","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-24T18:42:36+00:00","article:modified_time":"2020-11-17T22:58:46+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"98201","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:03:30","updated":"2026-02-04 14:42:08","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/98201","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=98201"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/98201\/revisions"}],"predecessor-version":[{"id":156767,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/98201\/revisions\/156767"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/98202"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=98201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=98201"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=98201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}