{"id":55823,"date":"2020-01-29T00:00:00","date_gmt":"2020-01-28T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uskoryaem-openvpn-na-routere-openwrt-alternativnaya-versiya-bez-payalnika-i-hardvarnogo-ekstremizma"},"modified":"2020-02-18T14:03:58","modified_gmt":"2020-02-18T11:03:58","slug":"uskoryaem-openvpn-na-routere-openwrt-alternativnaya-versiya-bez-payalnika-i-hardvarnogo-ekstremizma","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/uskoryaem-openvpn-na-routere-openwrt-alternativnaya-versiya-bez-payalnika-i-hardvarnogo-ekstremizma","title":{"rendered":"Kiirendame OpenVPN-i Openwrt ruuteris. Alternatiivne versioon ilma jootmiseta ja riistvara ekstremismita","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Kiirendame
\n
\nTere k\u00f5igile, lugesin hiljuti vana artiklit<\/a><\/noindex> sellest, kuidas saab OpenVPN-i ruuteris kiiremaks teha, viies kr\u00fcpteerimise eraldi seadmele, mis joodetakse otse ruuteri sisse. Minu olukord on autoriga sarnane \u2014 TP-Link WDR3500 128 megabaidi muutm\u00e4luga ja tagasihoidliku protsessoriga, mis tunnelite kr\u00fcpteerimisega \u00fcldse toime ei tule. Samas ei olnud mul v\u00e4himatki soovi ruuteri kallale jootekolviga minna. Allpool on minu kogemus OpenVPN-i eraldi seadmele viimisest koos ruuteripoolse varulahendusega juhuks, kui midagi peaks juhtuma.
\n<\/a><\/noindex><\/p>\n

\u00dclesanne<\/h3>\n

\nOn olemas TP-Link WDR3500 ruuter ja Orange Pi Zero H2. Soovime, et tavare\u017eiimis tegeleks tunnelite kr\u00fcpteerimisega Orange Pi, kuid kui sellega midagi juhtub, siis t\u00f6\u00f6tlus VPN<\/a> l\u00e4heb tagasi ruuterisse. K\u00f5ik ruuteri tulem\u00fc\u00fcri seaded peavad t\u00f6\u00f6tama nagu varem. \u00dcldiselt peaks lisaseadme lisamine olema k\u00f5igi jaoks t\u00e4iesti l\u00e4bipaistev ja m\u00e4rkamatu. OpenVPN t\u00f6\u00f6tab \u00fcle TCP, TAP-adapter sillare\u017eiimis (server-bridge).<\/p>\n

Lahendus<\/h3>\n

\nUSB kaudu \u00fchendamise asemel otsustasin kasutada \u00fchte ruuteri porti ja tuua selle kaudu Orange Pi-sse k\u00f5ik alamv\u00f5rgud, kus on VPN-i sild. Nii j\u00e4\u00e4b seade f\u00fc\u00fcsiliselt samadesse v\u00f5rkudesse, kus asuvad ruuteri VPN-serverid. Seej\u00e4rel t\u00f5stame Orange Pi peal \u00fcles t\u00e4pselt samasugused serverid ning seadistame ruuteris mingi proxy, mis suunab k\u00f5ik sissetulevad \u00fchendused v\u00e4lisele serverile, aga kui Orange Pi on maas v\u00f5i k\u00e4ttesaamatu, siis sisemisele fallback-serverile. Mina kasutasin HAProxy't.<\/p>\n

Tuleb v\u00e4lja nii:<\/p>\n

    \n
  1. Klient loob \u00fchenduse<\/li>\n
  2. Kui v\u00e4line server pole saadaval, l\u00e4heb \u00fchendus nagu varem sisemisele serverile<\/li>\n
  3. Kui server on saadaval, v\u00f5tab kliendi vastu Orange Pi<\/li>\n
  4. Orange Pi peal olev VPN dekr\u00fcpteerib paketid ja saadab need tagasi ruuterisse<\/li>\n
  5. Ruuter marsruudib need edasi sihtkohta<\/li>\n<\/ol>\n

    <\/p>\n

    Rakenduse n\u00e4ide<\/h3>\n

    \nNiisiis, oletame, et ruuteris on kaks v\u00f5rku \u2014 main(1) ja guest(2) ning kummagi jaoks on olemas OpenVPN-server v\u00e4ljast \u00fchendamiseks.<\/p>\n

    V\u00f5rgu konfigureerimine<\/h4>\n

    \nMe peame suunama m\u00f5lemad v\u00f5rgud l\u00e4bi \u00fche pordi, seega loome 2 VLAN'i. <\/p>\n

    Ruuteris jaotises Network\/Switch loome VLAN'id (n\u00e4iteks 1 ja 2) ja aktiveerime need soovitud pordil m\u00e4rgitud re\u017eiimis, lisame \u00e4sja loodud eth0.1 ja eth0.2 vastavatesse v\u00f5rkudesse (n\u00e4iteks lisame nende sildamisena). <\/p>\n

    Orange Pi peal loome kaks VLAN-liidest (mul on Archlinux ARM + netctl):<\/p>\n

    \/etc\/netctl\/vlan-main<\/b><\/p>\n

    Description='Main VLAN on eth0'\nInterface=vlan-main\nConnection=vlan\nBindsToInterfaces=eth0\nVLANID=1\nIP=no\n<\/code><\/pre>\n
    \n\/etc\/netctl\/vlan-guest<\/b><\/p>\n
    Description='Guest VLAN on eth0'\nInterface=vlan-guest\nConnection=vlan\nBindsToInterfaces=eth0\nVLANID=2\nIP=no\n<\/code><\/pre>\n
    \nJa loome neile kohe ka kaks bridge'i:<\/p>\n
    \/etc\/netctl\/br-main<\/b><\/p>\n
    Description=\"Peamine sillaga \u00fchendus\"\nInterface=br-peamine\nConnection=sillaga\nBindsToInterfaces=(vlan-peamine)\nIP=dhcp\n<\/code><\/pre>\n
    \n\/etc\/netctl\/br-guest<\/b><\/p>\n
    Description=\"K\u00fclastaja sillaga \u00fchendus\"\nInterface=br-k\u00fclastaja\nConnection=sillaga\nBindsToInterfaces=(vlan-k\u00fclastaja)\nIP=dhcp\n<\/code><\/pre>\n
    \nL\u00fclitame automaatse k\u00e4ivituse sisse k\u00f5igi 4 profiili jaoks (netctl enable). N\u00fc\u00fcd on Orange Pi p\u00e4rast taask\u00e4ivitust \u00fchendatud kahe vajaliku v\u00f5rguga. Orange Pi liideste aadressid seadistame ruuteris jaotises Static Leases. <\/p>\n
    ip addr show<\/b><\/p>\n
    4: vlan-main@eth0:  mtu 1500 qdisc noqueue master br-main state UP group default qlen 1000\n    link\/ether 02:42:f0:f8:23:c8 brd ff:ff:ff:ff:ff:ff\n    inet6 fe80::42:f0ff:fef8:23c8\/64 scope link \n       valid_lft forever preferred_lft forever\n\n5: vlan-guest@eth0:  mtu 1500 qdisc noqueue master br-guest state UP group default qlen 1000\n    link\/ether 02:42:f0:f8:23:c8 brd ff:ff:ff:ff:ff:ff\n    inet6 fe80::42:f0ff:fef8:23c8\/64 scope link \n       valid_lft forever preferred_lft forever\n\n6: br-main:  mtu 1500 qdisc noqueue state UP group default qlen 1000\n    link\/ether 52:c7:0f:89:71:6e brd ff:ff:ff:ff:ff:ff\n    inet 192.168.1.3\/24 brd 192.168.1.255 scope global dynamic noprefixroute br-main\n       valid_lft 29379sec preferred_lft 21439sec\n    inet6 fe80::50c7:fff:fe89:716e\/64 scope link \n       valid_lft forever preferred_lft forever\n\n7: br-guest:  mtu 1500 qdisc noqueue state UP group default qlen 1000\n    link\/ether ee:ea:19:31:34:32 brd ff:ff:ff:ff:ff:ff\n    inet 192.168.2.3\/24 brd 192.168.2.255 scope global br-guest\n       valid_lft forever preferred_lft forever\n    inet6 fe80::ecea:19ff:fe31:3432\/64 scope link \n       valid_lft forever preferred_lft forever\n<\/code><\/pre>\n
    <\/p>\n
    VPN-i seadistamine<\/h4>\n
    \nEdasi kopeerime ruuterist OpenVPN-i seaded ja v\u00f5tmed. Seaded saab tavaliselt v\u00f5tta siit \/tmp\/etc\/openvpn*.conf<\/i><\/p>\n
    Vaikimisi hoiab TAP-re\u017eiimis ja server-bridge'iga k\u00e4ivitatud openvpn oma liidest mitteaktiivsena. Et k\u00f5ik t\u00f6\u00f6le hakkaks, tuleb lisada skript, mis k\u00e4ivitatakse \u00fchenduse aktiveerimisel. <\/p>\n
    \/etc\/openvpn\/main.conf<\/b><\/p>\n
    dev vpn-peamine\ndev-type tap\n\nclient-to-client\npersist-key\npersist-tun\nca \/etc\/openvpn\/main\/ca.crt\ncert \/etc\/openvpn\/main\/main.crt\ncipher AES-256-CBC\ncomp-lzo jah\ndh \/etc\/openvpn\/main\/dh2048.pem\nifconfig-pool-persist \/etc\/openvpn\/ipp_peamine.txt\nkeepalive 10 60\nkey \/etc\/openvpn\/main\/main.key\nport 443\nproto tcp\npush \"redirect-gateway\"\npush \"dhcp-option DNS 192.168.1.1\"\nserver-bridge 192.168.1.3 255.255.255.0 192.168.1.200 192.168.1.229\nstatus \/tmp\/openvpn.peamine.status\nverb 3\n\nsetenv profile_name peamine\nscript-security 2\nup \/etc\/openvpn\/vpn-up.sh\n<\/code><\/pre>\n
    \n\/etc\/openvpn\/vpn-up.sh<\/b><\/p>\n
    #!\/bin\/sh\n\nifconfig vpn-${profile_name} up\nbrctl addif br-${profile_name} vpn-${profile_name}\n<\/code><\/pre>\n
    \nSelle tulemusena lisatakse kohe p\u00e4rast \u00fchenduse loomist liides vpn-main sillale br-main. Guest-v\u00f5rgu puhul on k\u00f5ik analoogne, erinevad ainult liidese nimi ja server-bridge'i aadress.<\/p>\n
    V\u00e4liste p\u00e4ringute marsruutimine ja puhverserverdamine<\/h4>\n
    \nSelles etapis oskab Orange Pi juba \u00fchendusi vastu v\u00f5tta ja kliendid \u00f5igesse v\u00f5rku suunata. J\u00e4\u00e4b \u00fcle seadistada ruuteris sissetulevate \u00fchenduste puhverserverdamine. <\/p>\n
    T\u00f5stame ruuteri VPN-serverid teistele portidele, paigaldame ruuterisse HAProxy ja seadistame:<\/p>\n
    \/etc\/haproxy.cfg<\/b><\/p>\n
    global\n        maxconn 256\n        uid 0\n        gid 0\n        daemon\n\ndefaults\n        retries 1\n        contimeout 1000\n        option splice-auto\n\nlisten guest_vpn\n        bind :444\n        mode tcp\n        server 0-orange 192.168.2.3:444 check\n        server 1-local  127.0.0.1:4444 check backup\n\nlisten main_vpn\n        bind :443\n        mode tcp\n        server 0-orange 192.168.1.3:443 check\n        server 1-local  127.0.0.1:4443 check backup\n<\/code><\/pre>\n
    <\/p>\n
    Nautigem tulemust<\/h4>\n
    \nKui k\u00f5ik l\u00e4ks plaani j\u00e4rgi, suunatakse kliendid Orange Pi peale, ruuteri protsessor ei kuumene enam \u00fcle ning VPN-i kiirus kasvab m\u00e4rgatavalt. Samal ajal j\u00e4\u00e4vad kehtima k\u00f5ik ruuteris seadistatud v\u00f5rgureeglid. Kui Orange Pi-ga tekib rike, langeb see rivist v\u00e4lja ja HAProxy suunab kliendid kohalikele serveritele. <\/p>\n
    T\u00e4name t\u00e4helepanu eest, ettepanekud ja parandused on teretulnud.
    \n
    Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
    \u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442, \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u043b \u0434\u0430\u0432\u043d\u044e\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0443\u0441\u043a\u043e\u0440\u0438\u0442\u044c OpenVPN \u043d\u0430 \u0440\u043e\u0443\u0442\u0435\u0440\u0435, \u043f\u0435\u0440\u0435\u043d\u0435\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u0443\u044e \u0436\u0435\u043b\u0435\u0437\u043a\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0438\u043f\u0430\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0432\u043d\u0443\u0442\u0440\u0438 \u0441\u0430\u043c\u043e\u0433\u043e \u0440\u043e\u0443\u0442\u0435\u0440\u0430. \u0423 \u043c\u0435\u043d\u044f \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0439 \u0441 \u0430\u0432\u0442\u043e\u0440\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0439 \u2014 TP-Link WDR3500 \u0441 128 \u043c\u0435\u0433\u0430\u0431\u0430\u0439\u0442\u0430\u043c\u0438 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043a\u0438 \u0438 \u0431\u0435\u0434\u043d\u044b\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0430\u043f\u0440\u043e\u0447\u044c \u043d\u0435 \u0441\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0441 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0442\u0443\u043d\u043d\u0435\u043b\u0435\u0439. \u041e\u0434\u043d\u0430\u043a\u043e, \u043b\u0435\u0437\u0442\u044c \u0432 \u0440\u043e\u0443\u0442\u0435\u0440 \u0441 \u043f\u0430\u044f\u043b\u044c\u043d\u0438\u043a\u043e\u043c \u043c\u043d\u0435 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0447\u0435\u0441\u043a\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":55824,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-55823","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kiirendame OpenVPN-i OpenWrt ruuteris. Alternatiivne lahendus ilma jootekolbi ja riistvaralise ekstreemsuseta - ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/uskoryaem-openvpn-na-routere-openwrt-alternativnaya-versiya-bez-payalnika-i-hardvarnogo-ekstremizma","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0441\u043a\u043e\u0440\u044f\u0435\u043c OpenVPN \u043d\u0430 \u0440\u043e\u0443\u0442\u0435\u0440\u0435 Openwrt. \u0410\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u043d\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u0431\u0435\u0437 \u043f\u0430\u044f\u043b\u044c\u043d\u0438\u043a\u0430 \u0438 \u0445\u0430\u0440\u0434\u0432\u0430\u0440\u043d\u043e\u0433\u043e \u044d\u043a\u0441\u0442\u0440\u0435\u043c\u0438\u0437\u043c\u0430 | ProHoster","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/uskoryaem-openvpn-na-routere-openwrt-alternativnaya-versiya-bez-payalnika-i-hardvarnogo-ekstremizma","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-28T21:00:00+00:00","article:modified_time":"2020-02-18T11:03:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55823","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:36:29","updated":"2026-02-04 14:42:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/55823","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=55823"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/55823\/revisions"}],"predecessor-version":[{"id":156721,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/55823\/revisions\/156721"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/55824"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=55823"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=55823"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=55823"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}