E hiahia ana ahau ki te whakapuaki i taku wheako ki te whakakotahi i nga whatunga i roto i nga whare noho mamao e toru, ka whakamahia e ia nga pouara me te OpenWRT hei kuaha, ki te whatunga noa. I te wa e whiriwhiri ana i tetahi tikanga mo te whakakotahi i nga whatunga i waenga i te L3 me te ararere kupenga-roto me te L2 me te piriti, ka noho nga pona whatunga katoa i roto i te kupenga-roto kotahi, i hoatu te manakohanga ki te tikanga tuarua, he uaua ake te whirihora, engari he nui ake nga huarahi, mai i te I whakamaheretia te whakamahi maamaa o nga hangarau i roto i te whatunga e hangaia ana Wake-on-Lan me DLNA.
Wāhanga 1: He whakamārama
Ko te kawa i whiriwhiria hei whakatinana i tēnei mahi i te tuatahi OpenVPN, nā te mea, tuatahi, ka taea e ia te hanga i tētahi taputapu tap ka taea te tāpiri atu ki te piriti me te kore he raruraru, tuarua, OpenVPN E tautoko ana i te TCP, he mea nui anō hoki tēnei, nā te mea kāore he wāhitau IP motuhake o ngā whare noho. Kāore i taea e au te whakamahi i te STUN nā te mea, mō ētahi take, ka aukati taku ISP i ngā hononga UDP e haere mai ana i ana whatunga. Nā te TCP ahau i tuku i te tauranga tūmau VPN ki te VPS reti mā te whakamahi i te SSH. Ahakoa he nui te utu tāpiri e puta mai ana i tēnei huarahi, nā te mea kua whakamunatia rua ngā raraunga, kāore au i hiahia ki te whakauru i te VPS ki taku whatunga tūmataiti, nā te mea he tūponotanga kei riro i ngā rōpū tuatoru te mana whakahaere ki runga. Nō reira, he tino koretake te whai i tētahi taputapu pēnei i runga i taku whatunga kāinga, nō reira i whakatau ahau ki te utu i te nui o te utu tāpiri mō te haumarutanga.
Hei tuku i te tauranga i runga i te pouara i whakamaheretia ai te tūmau kia whakatūria, i whakamahia e au te kaupapa sshtunnel. Kāore au e kōrero taipitopito mō tōna whirihoranga—he tino māmā noa iho. Ka mōhio noa ahau ko tana kaupapa he tuku i te tauranga TCP 1194 mai i te pouara ki te VPS. Muri iho, i whirihorahia e au te tūmau. OpenVPN I runga i te taputapu tap0, i honoa ki te piriti br-lan. Whai muri i te whakamātautau i te hononga ki te tūmau hou i hangaia mai i taku pona, i mārama kua angitu te whakaaro tuku tauranga, ā, kua uru taku pona ki te whatunga o te pouara, ahakoa ehara i te mea he wāhanga ā-tinana.
Ko te mea anake i toe ko te tohatoha i ngā wāhitau IP ki ngā whare noho rerekē kia kore ai e taupatupatu, me te whirihora i ngā pouara kia rite ki OpenVPN-ngā kiritaki.
Ko nga wahitau IP pouara e whai ake nei me nga awhe tūmau DHCP i tohua:
- 192.168.10.1 me te awhe 192.168.10.2 - 192.168.10.80 mo te tūmau
- 192.168.10.100 me te awhe 192.168.10.101 - 192.168.10.149 mo te pouara i roto i te whare No
- 192.168.10.150 me te awhe 192.168.10.151 - 192.168.10.199 mo te pouara i roto i te whare No
I tika hoki kia tohaina ēnei wāhitau ki ngā pouara kiritaki. OpenVPN-server, mā te tāpiri i te rārangi e whai ake nei ki tōna whirihoranga:
ifconfig-pool-persist /etc/openvpn/ipp.txt 0me te taapiri i nga rarangi e whai ake nei ki te konae /etc/openvpn/ipp.txt:
flat1_id 192.168.10.100
flat2_id 192.168.10.150
ko flat1_id me flat2_id ngā ingoa pūrere kua tohua i te wā e hanga ana i ngā tiwhikete mō te hono atu ki OpenVPN
Muri iho, i whirihorahia ngā pouara OpenVPN- kiritaki, i tāpirihia ngā taputapu tap0 i runga i ngā mea e rua ki te piriti br-lan. I tēnei wā, i te āhua pai ngā mea katoa, i te mea ka taea e ngā whatunga e toru te kite tetahi i tetahi, me te mahi hei wae kotahi. Heoi, i puta mai tētahi kōrero tino kino: i ētahi wā ka whiwhi ngā taputapu i tētahi wāhitau IP mai i te pouara hē, me ngā hua katoa i puta mai. Mō ētahi take, kāore te pouara i roto i tētahi o ngā whare noho i whakautu ki te DHCPDISCOVER i te wā tika, ā, i whiwhi te taputapu i te wāhitau hē. I kite ahau me tātari e au aua tono i roto i te tap0 i runga i ia pouara, engari i te mutunga, kāore e taea e ngā iptables te mahi me tētahi taputapu mena he wāhanga o tētahi piriti, nō reira me whakamahi e au ngā ebtables. Engari, kāore i whakaurua e taku pūmanawa, nō reira me hanga anō e au ngā whakaahua mō ia taputapu. I muri i te mahi i tēnei me te tāpiri i ngā rārangi e whai ake nei ki /etc/rc.local i runga i ia pouara, i whakatauhia te raruraru:
ebtables -A INPUT --in-interface tap0 --protocol ipv4 --ip-protocol udp --ip-destination-port 67:68 -j DROP
ebtables -A INPUT --in-interface tap0 --protocol ipv4 --ip-protocol udp --ip-source-port 67:68 -j DROP
ebtables -A FORWARD --out-interface tap0 --protocol ipv4 --ip-protocol udp --ip-destination-port 67:68 -j DROP
ebtables -A FORWARD --out-interface tap0 --protocol ipv4 --ip-protocol udp --ip-source-port 67:68 -j DROP
E toru tau te roa o tenei whirihoranga.
Wāhanga 2: Te Mōhio ki a Koe WireGuard
Nō nā tata nei, kua piki haere ngā kōrero i runga i te Ipurangi mō WireGuard, me te miharo ki tōna ngāwari o te whirihoranga, te tere whakawhiti teitei, te ping iti, me te haumarutanga rite tonu. I te rapunga mō ētahi atu kōrero mōna i kitea kāore e tautoko i te tautoko mema piriti, i te kawa TCP rānei, ā, nā tēnā i whakapono ahau kāore he huarahi kē atu. OpenVPN ki ahau nei, kāore anō kia tae mai. Nō reira ka whakaroa ahau i te ako mō WireGuard.
I ētahi rā kua pahure ake nei, i horapa ngā purongo mā roto i ngā rauemi e pā ana ki te hangarau mōhiohio i tētahi ara, i tētahi ara rānei, WireGuard ka whakaurua ki roto i te kernel Linux, tīmata mai i te putanga 5.6. Pērā tonu, i whakanuia ngā tuhinga purongo WireGuardI ruku anō ahau ki te rapu huarahi hei whakakapi i te mea tawhito OpenVPNI tēnei wā i tūtaki ahau ki . I korero mo te hanga i te kauhanga Ethernet i runga i te L3 ma te whakamahi GRE. Na tenei tuhinga i homai he tumanako ki ahau. Kaore i tino marama he aha te mahi ki te kawa UDP. Ko te rapunga i arahi ahau ki nga tuhinga mo te whakamahi i te socat i te taha o te kohanga SSH ki te tuku i tetahi tauranga UDP, heoi, i kii ratou ko tenei huarahi ka mahi i roto i te aratau hononga kotahi, ara, ka kore e taea te mahi a etahi kaihoko VPN. I puta mai taku whakaaro ki te whakauru i tetahi tūmau VPN i runga i te VPS me te whakarite i te GRE mo nga kaihoko, engari i te mea kua puta, kaore a GRE e tautoko i te whakamunatanga, ka puta mai ki te mea ka uru atu nga roopu tuatoru ki te tūmau. , ko nga hokohoko katoa i waenga i aku whatunga ka noho ki o raatau ringaringa, kaore i pai ki ahau.
Ano ano, i whakatauhia te whakatau mo te whakamunatanga taapiri, ma te whakamahi VPN mo VPN ma te whakamahi i te kaupapa e whai ake nei:
Taumata XNUMX VPN:
VPS ko te reira tūmau me te wahitau o roto 192.168.30.1
MS ko te reira kiritaki VPS me te wahitau o roto 192.168.30.2
MK2 ko te reira kiritaki VPS me te wahitau o roto 192.168.30.3
MK3 ko te reira kiritaki VPS me te wahitau o roto 192.168.30.4
VPN taumata tuarua:
MS ko te reira tūmau me te wahitau o waho 192.168.30.2 me roto 192.168.31.1
MK2 ko te reira kiritaki MS me te wāhitau 192.168.30.2 me te IP ā-roto 192.168.31.2
MK3 ko te reira kiritaki MS me te wāhitau 192.168.30.2 me te IP ā-roto 192.168.31.3
* MS — pouara-tūmau i roto i te whare 1, MK2 - pouara i roto i te whare 2, MK3 - pouara i roto i te whare 3
* Ko nga whirihoranga taputapu ka whakaputaina i roto i te kaipahua i te mutunga o te tuhinga.
Na, kei te rere nga pings i waenga i nga node whatunga 192.168.31.0/24, kua tae ki te wa ki te neke ki te whakatuu i tetahi kohanga GRE. I mua i tenei, kia kore ai e ngaro te uru ki nga pouara, he mea tika ki te whakatu i nga kohanga SSH ki te tuku i te tauranga 22 ki te VPS, na, hei tauira, ka uru te pouara mai i te whare 10022 ki te tauranga 2 o te VPS, me te Ko te pouara mai i te whare 11122 ka uru atu ki te tauranga 3 pouara mai i te whare XNUMX. He pai ake te whirihora i te tuku whakamua ma te whakamahi i te sshtunnel ano, na te mea ka whakahokia mai te kauhanga mena ka rahua.
Kua whirihorahia te kauhanga, ka taea e koe te hono atu ki te SSH ma te tauranga whakamua:
ssh root@МОЙ_VPS -p 10022Muri iho me whakakore e koe OpenVPN:
/etc/init.d/openvpn stopInaianei me whakarite he kohanga GRE i runga i te pouara mai i te whare 2:
ip link add grelan0 type gretap remote 192.168.31.1 local 192.168.31.2
ip link set grelan0 up
Na ka taapirihia te atanga hanga ki te piriti:
brctl addif br-lan grelan0
Kia rite ano te mahi i runga i te pouara tūmau:
ip link add grelan0 type gretap remote 192.168.31.2 local 192.168.31.1
ip link set grelan0 up
Me taapiri ano te atanga hanga ki te piriti:
brctl addif br-lan grelan0
timata mai i tenei wa, ka timata nga pings ki te haere angitu ki te whatunga hou, a, me te pai, ka haere ahau ki te inu kawhe. Na, ki te arotake me pehea te mahi a te whatunga ki tera pito o te raina, ka ngana ahau ki te SSH ki tetahi o nga rorohiko i te whare 2, engari ka peke te kaihoko ssh me te kore tono mo te kupuhipa. Kei te ngana ahau ki te hono atu ki tenei rorohiko ma te waea waea i runga i te tauranga 22 ka kite ahau i tetahi raina e mohio ana ahau kei te whakatuu te hononga, kei te whakautu te tūmau SSH, engari mo etahi take karekau e akiaki i ahau ki te takiuru i roto.
$ telnet 192.168.10.110 22
SSH-2.0-OpenSSH_8.1
Kei te ngana ahau ki te hono atu ma te VNC ka kite i tetahi mata pango. Ka whakapono ahau ko te raru kei te rorohiko mamao, na te mea ka taea e au te hono atu ki te pouara mai i tenei whare ma te whakamahi i te wahitau o roto. Heoi, ka whakatau ahau ki te hono atu ki te SSH o tenei rorohiko na roto i te pouara ka miharo ahau ki te mohio kua angitu te hononga, me te mahi noa te rorohiko mamao, engari kaore e taea te hono atu ki taku rorohiko.
Ka tangohia e au te pūrere grelan0 i waho o te piriti ka whakahaerehia OpenVPN I runga i te pouara i te whare noho 2, i whakaū ahau kei te mahi tika anō te whatunga, ā, kāore ngā hononga e heke ana. I a au e rapu ana, ka kite ahau i ngā huihuinga e amuamu ana te iwi mō ngā take ōrite, ā, i tohutohuhia rātou kia whakapiki ake i te MTU. Kāore i roa ka oti. Heoi, kia tae rā anō ki te taumata teitei o te MTU—7000 mō ngā taputapu gretap—i pā mai he hekenga o ngā hononga TCP, he iti rānei ngā tere whakawhiti. Nā te MTU teitei mō te gretap, ko te MTU mō ngā hononga WireGuard I whakatakotoria ngā taumata tuatahi me te tuarua ki te 8000 me te 7500.
I mahia e ahau he tatūnga rite i runga i te pouara mai i te whare 3, ko te rereke anake ko te atanga tuarua o te gretap ko grelan1 i honoa ki te pouara tūmau, i honoa ano ki te piriti br-lan.
Kei te mahi nga mea katoa. Ka taea e koe te whakauru i te huihuinga gretap ki te whakaoho. Mo tenei:
I whakanohoia e ahau enei raina ki /etc/rc.local ki runga i te pouara i te whare 2:
ip link add grelan0 type gretap remote 192.168.31.1 local 192.168.31.2
ip link set dev grelan0 mtu 7000
ip link set grelan0 up
brctl addif br-lan grelan0
I taapirihia tenei ki /etc/rc.local i runga i te pouara i te whare 3:
ip link add grelan0 type gretap remote 192.168.31.1 local 192.168.31.3
ip link set dev grelan0 mtu 7000
ip link set grelan0 up
brctl addif br-lan grelan0
A i runga i te pouara tūmau:
ip link add grelan0 type gretap remote 192.168.31.2 local 192.168.31.1
ip link set dev grelan0 mtu 7000
ip link set grelan0 up
brctl addif br-lan grelan0
ip link add grelan1 type gretap remote 192.168.31.3 local 192.168.31.1
ip link set dev grelan1 mtu 7000
ip link set grelan1 up
brctl addif br-lan grelan1
I muri i te whakaara anō i ngā pouara kiritaki, i kitea e au kāore rātou i te hono atu ki te tūmau, mō tētahi take. I muri i te hono atu ki tā rātou SSH (waimarie, kua whirihorahia e au te sshtunnel mō tēnei), i kitea e au WireGuard Mō ētahi take, ka hangaia he ara mō te pito whakamutunga, engari he hē. Hei tauira, mō te 192.168.30.2, i tohua e te ripanga ara he ara mā te atanga pppoe-wan, arā, mā te ipurangi, ahakoa ko te ara ki reira i tika kia tukuna mā te atanga wg0. I muri i te mukunga o tēnei ara, i whakahokia te hononga. Ka kitea e au ngā tohutohu i hea noa atu mō te akiaki i te WireGuard Kāore i taea e au te karo i te hanga i ēnei ara. Heoi anō, kāore au i te mārama mēnā he āhuatanga tēnei nō OpenWRT, nō te WireGuardKāore i roa te wā i pau ki te rapu i te raruraru, i tāpiri noa ahau i tētahi rārangi ki te tuhinga timer-loop i runga i ngā pouara e rua i muku i tēnei ara:
route del 192.168.30.2
Kohia ana
Whakakorenga katoa OpenVPN Kāore anō kia tutuki i ahau tēnei, nā te mea me hono atu ahau ki tētahi whatunga hou i ētahi wā mai i tētahi pona, i tētahi waea rānei, ā, he mea uaua te whakatū i tētahi taputapu gretap ki runga i aua whatunga. Heoi, ahakoa tēnei, kua whiwhi ahau i tētahi painga mō te tere whakawhiti raraunga i waenga i ngā whare noho, ā, hei tauira, he ngāwari te whakamahi i te VNC. Kua paku heke te Ping engari kua pūmau ake:
A, no te whakamahi OpenVPN:
[r0ck3r@desktop ~]$ ping -c 20 192.168.10.110
PING 192.168.10.110 (192.168.10.110) 56(84) bytes of data.
64 bytes from 192.168.10.110: icmp_seq=1 ttl=64 time=133 ms
...
64 bytes from 192.168.10.110: icmp_seq=20 ttl=64 time=125 ms
--- 192.168.10.110 ping statistics ---
20 packets transmitted, 20 received, 0% packet loss, time 19006ms
rtt min/avg/max/mdev = 124.722/126.152/136.907/3.065 ms
A, no te whakamahi WireGuard:
[r0ck3r@desktop ~]$ ping -c 20 192.168.10.110
PING 192.168.10.110 (192.168.10.110) 56(84) bytes of data.
64 bytes from 192.168.10.110: icmp_seq=1 ttl=64 time=124 ms
...
64 bytes from 192.168.10.110: icmp_seq=20 ttl=64 time=124 ms
--- 192.168.10.110 ping statistics ---
20 packets transmitted, 20 received, 0% packet loss, time 19003ms
rtt min/avg/max/mdev = 123.954/124.423/126.708/0.675 ms
He nui ake te paanga o te ping teitei ki te VPS, e tata ana ki te 61.5 ms
Heoi, kua tino piki ake te tere. Nō reira, i roto i te whare noho me te pouara-tūmau, he 30 Mbps taku tere hononga ipurangi, ā, i roto i ngā whare noho kē atu he 5 Mbps. Heoi anō, i te wā e whakamahia ana OpenVPN Kāore i taea e au te whakatutuki i te tere whakawhiti raraunga i waenga i ngā whatunga neke atu i te 3,8 Mbps e ai ki ngā pānui iperf, i te mea WireGuard "i whakapūpū" ki te 5 Mbit/hekona.
Hōutuutu WireGuard i runga i te VPS[Interface]
Address = 192.168.30.1/24
ListenPort = 51820
PrivateKey = <ЗАКРЫТЫЙ_КЛЮЧ_ДЛЯ_VPS>
[Hoa]
KīTumatanui = <VPN_1_MS_PUBLIC_KEY>
IP Whakaaetia = 192.168.30.2/32
[Hoa]
KīTumatanui = <VPN_2_MK2_KĪ_TUMATAWAI>
IP Whakaaetia = 192.168.30.3/32
[Hoa]
KīTumatanui = <VPN_2_MK3_KĪ_TUMATAWAI>
IP Whakaaetia = 192.168.30.4/32
Hōutuutu WireGuard i runga i te MS (kua tāpirihia ki /etc/config/network)
#VPN первого уровня - клиент
config interface 'wg0'
option proto 'wireguard'
list addresses '192.168.30.2/24'
option private_key 'ЗАКРЫТЫЙ_КЛЮЧ_VPN_1_МС'
option auto '1'
option mtu '8000'
config wireguard_wg0
option public_key 'ОТКРЫТЫЙ_КЛЮЧ_VPN_1_VPS'
option endpoint_port '51820'
option route_allowed_ips '1'
option persistent_keepalive '25'
list allowed_ips '192.168.30.0/24'
option endpoint_host 'IP_АДРЕС_VPS'
#VPN второго уровня - сервер
config interface 'wg1'
option proto 'wireguard'
option private_key 'ЗАКРЫТЫЙ_КЛЮЧ_VPN_2_МС'
option listen_port '51821'
list addresses '192.168.31.1/24'
option auto '1'
option mtu '7500'
config wireguard_wg1
option public_key 'ОТКРЫТЫЙ_КЛЮЧ_VPN_2_МК2'
list allowed_ips '192.168.31.2'
config wireguard_wg1ip link add grelan0 type gretap remote 192.168.31.1 local 192.168.31.3
option public_key 'ОТКРЫТЫЙ_КЛЮЧ_VPN_2_МК3'
list allowed_ips '192.168.31.3'
Hōutuutu WireGuard i runga i te MK2 (kua tāpirihia ki /etc/config/network)
#VPN первого уровня - клиент
config interface 'wg0'
option proto 'wireguard'
list addresses '192.168.30.3/24'
option private_key 'ЗАКРЫТЫЙ_КЛЮЧ_VPN_1_МК2'
option auto '1'
option mtu '8000'
config wireguard_wg0
option public_key 'ОТКРЫТЫЙ_КЛЮЧ_VPN_1_VPS'
option endpoint_port '51820'
option persistent_keepalive '25'
list allowed_ips '192.168.30.0/24'
option endpoint_host 'IP_АДРЕС_VPS'
#VPN второго уровня - клиент
config interface 'wg1'
option proto 'wireguard'
option private_key 'ЗАКРЫТЫЙ_КЛЮЧ_VPN_2_МК2'
list addresses '192.168.31.2/24'
option auto '1'
option listen_port '51821'
option mtu '7500'
config wireguard_wg1
option public_key 'ОТКРЫТЫЙ_КЛЮЧ_VPN_2_МС'
option endpoint_host '192.168.30.2'
option endpoint_port '51821'
option persistent_keepalive '25'
list allowed_ips '192.168.31.0/24'
Hōutuutu WireGuard i runga i te MK3 (kua tāpirihia ki /etc/config/network)
#VPN первого уровня - клиент
config interface 'wg0'
option proto 'wireguard'
list addresses '192.168.30.4/24'
option private_key 'ЗАКРЫТЫЙ_КЛЮЧ_VPN_1_МК3'
option auto '1'
option mtu '8000'
config wireguard_wg0
option public_key 'ОТКРЫТЫЙ_КЛЮЧ_VPN_1_VPS'
option endpoint_port '51820'
option persistent_keepalive '25'
list allowed_ips '192.168.30.0/24'
option endpoint_host 'IP_АДРЕС_VPS'
#VPN второго уровня - клиент
config interface 'wg1'
option proto 'wireguard'
option private_key 'ЗАКРЫТЫЙ_КЛЮЧ_VPN_2_МК3'
list addresses '192.168.31.3/24'
option auto '1'
option listen_port '51821'
option mtu '7500'
config wireguard_wg1
option public_key 'ОТКРЫТЫЙ_КЛЮЧ_VPN_2_МС'
option endpoint_host '192.168.30.2'
option endpoint_port '51821'
option persistent_keepalive '25'
list allowed_ips '192.168.31.0/24'
I roto i ngā whirihoranga kua whakaahuatia mō te VPN taumata tuarua, ka tohu atu ahau ki ngā kiritaki WireGuard Tauranga 51821. Kāore e tika ana tēnei, nā te mea ka whakatū te kiritaki i tētahi hononga mai i tētahi tauranga kore utu, kāore i te whai mana, engari i pēnei taku mahi kia taea ai e au te whakakore i ngā hononga katoa e haere mai ana i runga i ngā atanga wg0 o ngā pouara katoa, engari ko ngā hononga UDP e haere mai ana ki te tauranga 51821.
Kei te tumanako ahau ka whai hua te tuhinga ki tetahi.
PS Ano, e hiahia ana ahau ki te whakapuaki i taku tuhinga ka tukuna mai he panui PUSH ki taku waea i roto i te tono WirePusher ina puta mai he taputapu hou ki taku whatunga. Anei te hono ki te tuhinga: .
WHAKAHOU: Hōutuutu OpenVPN-ngā tūmau me ngā kiritaki
OpenVPN-tūmau
client-to-client
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/vpn-server.crt
dh /etc/openvpn/server/dh.pem
key /etc/openvpn/server/vpn-server.key
dev tap
ifconfig-pool-persist /etc/openvpn/ipp.txt 0
keepalive 10 60
proto tcp4
server-bridge 192.168.10.1 255.255.255.0 192.168.10.80 192.168.10.254
status /var/log/openvpn-status.log
verb 3
comp-lzoOpenVPN-kiritaki
client
tls-client
dev tap
proto tcp
remote VPS_IP 1194 # Change to your router's External IP
resolv-retry infinite
nobind
ca client/ca.crt
cert client/client.crt
key client/client.key
dh client/dh.pem
comp-lzo
persist-tun
persist-key
verb 3 I whakamahia e ahau te ngawari-rsa ki te whakaputa tiwhikete
Source: will.com
