{"id":55823,"date":"2020-01-29T00:00:00","date_gmt":"2020-01-28T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uskoryaem-openvpn-na-routere-openwrt-alternativnaya-versiya-bez-payalnika-i-hardvarnogo-ekstremizma"},"modified":"2020-02-18T14:03:58","modified_gmt":"2020-02-18T11:03:58","slug":"uskoryaem-openvpn-na-routere-openwrt-alternativnaya-versiya-bez-payalnika-i-hardvarnogo-ekstremizma","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/uskoryaem-openvpn-na-routere-openwrt-alternativnaya-versiya-bez-payalnika-i-hardvarnogo-ekstremizma","title":{"rendered":"Vi accelererer OpenVPN p\u00e5 Openwrt-routeren. Alternativ version uden loddekolbe og hardware-ekstremisme.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Vi
\n
\nHej alle, jeg l\u00e6ste for nylig en gammel artikel<\/a><\/noindex> om hvordan man kan accelerere OpenVPN p\u00e5 en router ved at overf\u00f8re krypteringen til en separat hardwarekomponent, der loddes indeni selve routeren. Jeg har en tilsvarende situation som forfatteren \u2014 TP-Link WDR3500 med 128 megabyte RAM og en svag processor, der fuldst\u00e6ndig ikke klarer krypteringen af tunneler. Dog ville jeg overhovedet ikke have lyst til at g\u00e5 ind i routeren med loddekolben. Under katten er min erfaring med at flytte OpenVPN til en separat hardwareenhed med backup p\u00e5 routeren i tilf\u00e6lde af en n\u00f8dsituation.
\n<\/a><\/noindex><\/p>\n

Regler for godkendelse af merge-requests<\/h3>\n

\nDer er en TP-Link WDR3500 router og en Orange Pi Zero H2. Vi \u00f8nsker, at Orange Pi h\u00e5ndterer krypteringen af tunnelerne i normal drift, mens hvis der sker noget med den, vil behandlingen VPN<\/a> vende tilbage til routeren. Alle firewall-indstillinger p\u00e5 routeren skal fungere som f\u00f8r. Generelt set skal tilf\u00f8jelsen af ekstra hardware v\u00e6re gennemsigtig og usynlig for alle. OpenVPN fungerer over TCP, TAP-adapteren er i brotilstand (server-bro).<\/p>\n

L\u00f8sning<\/h3>\n

\nI stedet for at tilslutte via USB besluttede jeg at bruge en port p\u00e5 routeren og forbinde alle netv\u00e6rk, hvor VPN-broen er, til Orange Pi. Det betyder, at hardwarekomponenten fysisk vil v\u00e6re tilsluttet de samme netv\u00e6rk som VPN-serverne p\u00e5 routeren. Efter dette ops\u00e6tter vi de samme servere p\u00e5 Orange Pi, og p\u00e5 routeren konfigurerer vi en eller anden proxy, s\u00e5 den sender alle indkommende forbindelser til den eksterne server, og hvis Orange Pi er d\u00f8d eller utilg\u00e6ngelig \u2014 s\u00e5 til den interne backupserver. Jeg valgte HAProxy.<\/p>\n

S\u00e5dan:<\/p>\n

    \n
  1. Klienten ankommer<\/li>\n
  2. Hvis den eksterne server er utilg\u00e6ngelig \u2014 ligesom f\u00f8r g\u00e5r forbindelsen til den interne server<\/li>\n
  3. Hvis den er tilg\u00e6ngelig \u2014 modtager klienten Orange Pi<\/li>\n
  4. VPN p\u00e5 Orange Pi dekrypterer pakkerne og sender dem tilbage til routeren<\/li>\n
  5. Routeren rutere dem et eller andet sted hen<\/li>\n<\/ol>\n

    <\/p>\n

    Eksempel p\u00e5 implementering<\/h3>\n

    \nLad os sige, at vi har to netv\u00e6rk p\u00e5 routeren \u2014 main(1) og guest(2), for hver har vi en OpenVPN-server til at forbinde udefra.<\/p>\n

    Netv\u00e6rkskonfiguration<\/h4>\n

    \nVi skal f\u00f8re begge netv\u00e6rk gennem \u00e9n port, s\u00e5 vi opretter 2 VLAN'er. <\/p>\n

    P\u00e5 routeren i sektionen Network\/Switch opretter vi VLAN'er (f.eks. 1 og 2) og aktiverer dem i tagged tilstand p\u00e5 den \u00f8nskede port, tilf\u00f8jer de nyoprettede eth0.1 og eth0.2 til de passende netv\u00e6rk (f.eks. tilf\u00f8j til bridge). <\/p>\n

    P\u00e5 Orange Pi opretter vi to VLAN-interface (jeg har Archlinux ARM + netctl):<\/p>\n

    \/etc\/netctl\/vlan-main<\/b><\/p>\n

    Description='Main VLAN on eth0'\nInterface=vlan-main\nConnection=vlan\nBindsToInterfaces=eth0\nVLANID=1\nIP=no\n<\/code><\/pre>\n
    \n\/etc\/netctl\/vlan-guest<\/b><\/p>\n
    Description='Guest VLAN on eth0'\nInterface=vlan-guest\nConnection=vlan\nBindsToInterfaces=eth0\nVLANID=2\nIP=no\n<\/code><\/pre>\n
    \nOg vi opretter straks to broer for dem:<\/p>\n
    \/etc\/netctl\/br-main<\/b><\/p>\n
    Description=\"Hoved broforbindelse\"\nInterface=br-main\nConnection=bridge\nBindsToInterfaces=(vlan-main)\nIP=dhcp\n<\/code><\/pre>\n
    \n\/etc\/netctl\/br-guest<\/b><\/p>\n
    Description=\"G\u00e6st broforbindelse\"\nInterface=br-guest\nConnection=bridge\nBindsToInterfaces=(vlan-guest)\nIP=dhcp\n<\/code><\/pre>\n
    \nAktiverer autostart for alle 4 profiler (netctl enable). Nu vil Orange Pi v\u00e6re tilsluttet de to \u00f8nskede netv\u00e6rk efter genstart. Adresserne til gr\u00e6nsefladerne p\u00e5 Orange Pi konfigureres i Static Leases p\u00e5 routeren. <\/p>\n
    ip addr show<\/b><\/p>\n
    4: vlan-main@eth0:  mtu 1500 qdisc noqueue master br-main state UP group default qlen 1000\n    link\/ether 02:42:f0:f8:23:c8 brd ff:ff:ff:ff:ff:ff\n    inet6 fe80::42:f0ff:fef8:23c8\/64 scope link \n       valid_lft forever preferred_lft forever\n\n5: vlan-guest@eth0:  mtu 1500 qdisc noqueue master br-guest state UP group default qlen 1000\n    link\/ether 02:42:f0:f8:23:c8 brd ff:ff:ff:ff:ff:ff\n    inet6 fe80::42:f0ff:fef8:23c8\/64 scope link \n       valid_lft forever preferred_lft forever\n\n6: br-main:  mtu 1500 qdisc noqueue state UP group default qlen 1000\n    link\/ether 52:c7:0f:89:71:6e brd ff:ff:ff:ff:ff:ff\n    inet 192.168.1.3\/24 brd 192.168.1.255 scope global dynamic noprefixroute br-main\n       valid_lft 29379sec preferred_lft 21439sec\n    inet6 fe80::50c7:fff:fe89:716e\/64 scope link \n       valid_lft forever preferred_lft forever\n\n7: br-guest:  mtu 1500 qdisc noqueue state UP group default qlen 1000\n    link\/ether ee:ea:19:31:34:32 brd ff:ff:ff:ff:ff:ff\n    inet 192.168.2.3\/24 brd 192.168.2.255 scope global br-guest\n       valid_lft forever preferred_lft forever\n    inet6 fe80::ecea:19ff:fe31:3432\/64 scope link \n       valid_lft forever preferred_lft forever\n<\/code><\/pre>\n
    <\/p>\n
    VPN-konfiguration<\/h4>\n
    \nDern\u00e6st kopierer vi routerens indstillinger til OpenVPN og n\u00f8gler. Indstillingerne kan normalt findes i \/tmp\/etc\/openvpn*.conf<\/i><\/p>\n
    Som standard holder openvpn, der k\u00f8rer i TAP-tilstand og server-bro, sin gr\u00e6nseflade inaktiv. For at alt fungerer, skal vi tilf\u00f8je et script, der k\u00f8res ved aktivering af forbindelsen. <\/p>\n
    \/etc\/openvpn\/main.conf<\/b><\/p>\n
    dev vpn-main\ndev-type tap\n\nclient-to-client\npersist-key\npersist-tun\nca \/etc\/openvpn\/main\/ca.crt\ncert \/etc\/openvpn\/main\/main.crt\ncipher AES-256-CBC\ncomp-lzo yes\ndh \/etc\/openvpn\/main\/dh2048.pem\nifconfig-pool-persist \/etc\/openvpn\/ipp_main.txt\nkeepalive 10 60\nkey \/etc\/openvpn\/main\/main.key\nport 443\nproto tcp\npush \"redirect-gateway\"\npush \"dhcp-option DNS 192.168.1.1\"\nserver-bridge 192.168.1.3 255.255.255.0 192.168.1.200 192.168.1.229\nstatus \/tmp\/openvpn.main.status\nverb 3\n\nsetenv profile_name main\nscript-security 2\nup \/etc\/openvpn\/vpn-up.sh\n<\/code><\/pre>\n
    \n\/etc\/openvpn\/vpn-up.sh<\/b><\/p>\n
    #!\/bin\/sh\n\nifconfig vpn-${profile_name} up\nbrctl addif br-${profile_name} vpn-${profile_name}\n<\/code><\/pre>\n
    \nSom f\u00f8lge heraf vil gr\u00e6nsefladen vpn-main blive tilf\u00f8jet til br-main, s\u00e5 snart forbindelsen er etableret. For g\u00e6stenetv\u00e6rket er det analogt med n\u00f8jagtig det samme navn p\u00e5 gr\u00e6nsefladen og adressen i server-bro.<\/p>\n
    Ruting af foresp\u00f8rgsler udefra og proxying<\/h4>\n
    \nP\u00e5 dette trin kan Orange Pi allerede modtage forbindelser og tillade klienter at f\u00e5 adgang til de \u00f8nskede netv\u00e6rk. Det sidste skridt er at konfigurere proxying af indg\u00e5ende forbindelser p\u00e5 routeren. <\/p>\n
    Vi flytter routerens VPN-servere til andre porte, installerer HAProxy p\u00e5 routeren og konfigurerer:<\/p>\n
    \/etc\/haproxy.cfg<\/b><\/p>\n
    global\n        maxconn 256\n        uid 0\n        gid 0\n        daemon\n\ndefaults\n        retries 1\n        contimeout 1000\n        option splice-auto\n\nlisten guest_vpn\n        bind :444\n        mode tcp\n        server 0-orange 192.168.2.3:444 check\n        server 1-local  127.0.0.1:4444 check backup\n\nlisten main_vpn\n        bind :443\n        mode tcp\n        server 0-orange 192.168.1.3:443 check\n        server 1-local  127.0.0.1:4443 check backup\n<\/code><\/pre>\n
    <\/p>\n
    Vi nyder<\/h4>\n
    \nHvis alt gik som planlagt, vil kunderne overg\u00e5 til Orange Pi, og routerens processor vil ikke l\u00e6ngere overophede, mens hastigheden p\u00e5 VPN'en vil stige markant. Samtidig forbliver alle netv\u00e6rksregler, der er angivet p\u00e5 routeren, g\u00e6ldende. I tilf\u00e6lde af en fejl p\u00e5 Orange Pi vil det falde ud, og HAProxy vil dirigere kunderne til de lokale servere. <\/p>\n
    Tak for opm\u00e6rksomheden, \u00f8nsker og rettelser er velkomne.
    \n
    Kilde: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
    \u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442, \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u043b \u0434\u0430\u0432\u043d\u044e\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0443\u0441\u043a\u043e\u0440\u0438\u0442\u044c OpenVPN \u043d\u0430 \u0440\u043e\u0443\u0442\u0435\u0440\u0435, \u043f\u0435\u0440\u0435\u043d\u0435\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u0443\u044e \u0436\u0435\u043b\u0435\u0437\u043a\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0438\u043f\u0430\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0432\u043d\u0443\u0442\u0440\u0438 \u0441\u0430\u043c\u043e\u0433\u043e \u0440\u043e\u0443\u0442\u0435\u0440\u0430. \u0423 \u043c\u0435\u043d\u044f \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0439 \u0441 \u0430\u0432\u0442\u043e\u0440\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0439 \u2014 TP-Link WDR3500 \u0441 128 \u043c\u0435\u0433\u0430\u0431\u0430\u0439\u0442\u0430\u043c\u0438 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043a\u0438 \u0438 \u0431\u0435\u0434\u043d\u044b\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0430\u043f\u0440\u043e\u0447\u044c \u043d\u0435 \u0441\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0441 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0442\u0443\u043d\u043d\u0435\u043b\u0435\u0439. \u041e\u0434\u043d\u0430\u043a\u043e, \u043b\u0435\u0437\u0442\u044c \u0432 \u0440\u043e\u0443\u0442\u0435\u0440 \u0441 \u043f\u0430\u044f\u043b\u044c\u043d\u0438\u043a\u043e\u043c \u043c\u043d\u0435 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0447\u0435\u0441\u043a\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":55824,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-55823","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vi accelererer OpenVPN p\u00e5 Openwrt-routeren. Alternativ version uden loddekolbe og hardwareekstremisme | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/uskoryaem-openvpn-na-routere-openwrt-alternativnaya-versiya-bez-payalnika-i-hardvarnogo-ekstremizma","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0441\u043a\u043e\u0440\u044f\u0435\u043c OpenVPN \u043d\u0430 \u0440\u043e\u0443\u0442\u0435\u0440\u0435 Openwrt. \u0410\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u043d\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u0431\u0435\u0437 \u043f\u0430\u044f\u043b\u044c\u043d\u0438\u043a\u0430 \u0438 \u0445\u0430\u0440\u0434\u0432\u0430\u0440\u043d\u043e\u0433\u043e \u044d\u043a\u0441\u0442\u0440\u0435\u043c\u0438\u0437\u043c\u0430 | ProHoster","og:url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/uskoryaem-openvpn-na-routere-openwrt-alternativnaya-versiya-bez-payalnika-i-hardvarnogo-ekstremizma","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-28T21:00:00+00:00","article:modified_time":"2020-02-18T11:03:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55823","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:36:29","updated":"2026-02-04 14:42:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/55823","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=55823"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/55823\/revisions"}],"predecessor-version":[{"id":156721,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/55823\/revisions\/156721"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/55824"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=55823"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=55823"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=55823"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}