{"id":55823,"date":"2020-01-29T00:00:00","date_gmt":"2020-01-28T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uskoryaem-openvpn-na-routere-openwrt-alternativnaya-versiya-bez-payalnika-i-hardvarnogo-ekstremizma"},"modified":"2020-02-18T14:03:58","modified_gmt":"2020-02-18T11:03:58","slug":"uskoryaem-openvpn-na-routere-openwrt-alternativnaya-versiya-bez-payalnika-i-hardvarnogo-ekstremizma","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/uskoryaem-openvpn-na-routere-openwrt-alternativnaya-versiya-bez-payalnika-i-hardvarnogo-ekstremizma","title":{"rendered":"Acceler\u0103m OpenVPN pe routerul Openwrt. Versiune alternativ\u0103 f\u0103r\u0103 lipit \u0219i excese hardware","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Acceler\u0103m
\n
\nSalut tuturor, recent am citit un articol mai vechi<\/a><\/noindex> despre cum putem accelera OpenVPN pe un router, mut\u00e2nd criptarea pe o unitate hardware separat\u0103, care este sudat\u0103 \u00een interiorul routerului. Am o situa\u021bie similar\u0103 cu autorul \u2014 TP-Link WDR3500 cu 128 de megabytes de RAM \u0219i un procesor slab, care pur \u0219i simplu nu face fa\u021b\u0103 cript\u0103rii tunelurilor. Totu\u0219i, nu vreau s\u0103 m\u0103 apuc s\u0103 deschid routerul cu un fier de lipit. Dup\u0103 cat, experien\u021ba mea de mutare a OpenVPN pe o unitate hardware separat\u0103 cu rezervare pe router \u00een caz de defec\u021biune.
\n<\/a><\/noindex><\/p>\n

Sarcin\u0103<\/h3>\n

\nExist\u0103 un router TP-Link WDR3500 \u0219i un Orange Pi Zero H2. Vrem ca criptarea tunelurilor s\u0103 fie gestionat\u0103 \u00een mod standard de Orange Pi, iar dac\u0103 ceva se \u00eent\u00e2mpl\u0103 cu acesta, procesarea VPN<\/a> s\u0103 revin\u0103 pe router. Toate set\u0103rile firewall-ului de pe router ar trebui s\u0103 func\u021bioneze ca \u00eenainte. De asemenea, \u00een general, ad\u0103ugarea unei unit\u0103\u021bi hardware suplimentare ar trebui s\u0103 fie transparent\u0103 \u0219i invizibil\u0103 pentru to\u021bi. OpenVPN func\u021bioneaz\u0103 prin TCP, adaptorul TAP \u00een modul bridge (server-bridge).<\/p>\n

Solu\u021bie<\/h3>\n

\n\u00cen loc s\u0103 m\u0103 conectez prin USB, am decis s\u0103 folosesc un port de pe router \u0219i s\u0103 conectez pe acesta toate subre\u021belele \u00een care exist\u0103 un brij VPN. Asta \u00eenseamn\u0103 c\u0103 unitatea va fi fizic \u00een acelea\u0219i re\u021bele cu serverele VPN de pe router. Dup\u0103 aceasta, ridic\u0103m exact acelea\u0219i servere pe Orange Pi, iar pe router configur\u0103m un proxy pentru a redirec\u021biona toate conexiunile externe c\u0103tre serverul extern, iar dac\u0103 Orange Pi se defecteaz\u0103 sau nu este accesibil \u2014 atunci c\u0103tre un server intern de rezerv\u0103. Am folosit HAProxy.<\/p>\n

Rezultatul este acesta:<\/p>\n

    \n
  1. Clientul sose\u0219te<\/li>\n
  2. Dac\u0103 serverul extern nu este disponibil \u2014 la fel ca \u00eenainte, conexiunea merge c\u0103tre serverul intern<\/li>\n
  3. Dac\u0103 este disponibil \u2014 clientul este preluat de Orange Pi<\/li>\n
  4. VPN-ul de pe Orange Pi decripteaz\u0103 pachetele \u0219i le trimite \u00eenapoi la router<\/li>\n
  5. Routerul le ruteaz\u0103 undeva<\/li>\n<\/ol>\n

    <\/p>\n

    Exemplu de implementare<\/h3>\n

    \nDeci, s\u0103 presupunem c\u0103 avem pe router dou\u0103 re\u021bele \u2014 main(1) \u0219i guest(2), pentru fiecare dintre ele exist\u0103 un server OpenVPN pentru conectarea din exterior.<\/p>\n

    Configurarea re\u021belei<\/h4>\n

    \nTrebuie s\u0103 trecem ambele re\u021bele printr-un singur port, a\u0219a c\u0103 cre\u0103m 2 VLAN-uri. <\/p>\n

    Pe router, \u00een sec\u021biunea Network\/Switch, cre\u0103m VLAN-uri (de exemplu 1 \u0219i 2) \u0219i le activ\u0103m \u00een modul tagged pe portul dorit, ad\u0103ug\u0103m eth0.1 \u0219i eth0.2 create recent la re\u021belele corespunz\u0103toare (de exemplu, le ad\u0103ug\u0103m \u00een brigde). <\/p>\n

    Pe Orange Pi cre\u0103m dou\u0103 interfe\u021be VLAN (eu am Archlinux ARM + netctl):<\/p>\n

    \/etc\/netctl\/vlan-main<\/b><\/p>\n

    Description='Main VLAN on eth0'\nInterface=vlan-main\nConnection=vlan\nBindsToInterfaces=eth0\nVLANID=1\nIP=no\n<\/code><\/pre>\n
    \n\/etc\/netctl\/vlan-guest<\/b><\/p>\n
    Description='Guest VLAN on eth0'\nInterface=vlan-guest\nConnection=vlan\nBindsToInterfaces=eth0\nVLANID=2\nIP=no\n<\/code><\/pre>\n
    \n\u0218i imediat cre\u0103m dou\u0103 brigde pentru ele:<\/p>\n
    \/etc\/netctl\/br-main<\/b><\/p>\n
    Description=\"Conexiune principal\u0103 a podului\"\nInterface=br-main\nConnection=bridge\nBindsToInterfaces=(vlan-main)\nIP=dhcp\n<\/code><\/pre>\n
    \n\/etc\/netctl\/br-guest<\/b><\/p>\n
    Description=\"Conexiune guest a podului\"\nInterface=br-guest\nConnection=bridge\nBindsToInterfaces=(vlan-guest)\nIP=dhcp\n<\/code><\/pre>\n
    \nActiv\u0103m auto-start pentru toate cele 4 profile (netctl enable). Acum, dup\u0103 repornire, Orange Pi va fi conectat \u00een cele dou\u0103 re\u021bele necesare. Configur\u0103m adresele interfe\u021belor pe Orange Pi \u00een Static Leases pe router. <\/p>\n
    ip addr show<\/b><\/p>\n
    4: vlan-main@eth0:  mtu 1500 qdisc noqueue master br-main state UP group default qlen 1000\n    link\/ether 02:42:f0:f8:23:c8 brd ff:ff:ff:ff:ff:ff\n    inet6 fe80::42:f0ff:fef8:23c8\/64 scope link \n       valid_lft forever preferred_lft forever\n\n5: vlan-guest@eth0:  mtu 1500 qdisc noqueue master br-guest state UP group default qlen 1000\n    link\/ether 02:42:f0:f8:23:c8 brd ff:ff:ff:ff:ff:ff\n    inet6 fe80::42:f0ff:fef8:23c8\/64 scope link \n       valid_lft forever preferred_lft forever\n\n6: br-main:  mtu 1500 qdisc noqueue state UP group default qlen 1000\n    link\/ether 52:c7:0f:89:71:6e brd ff:ff:ff:ff:ff:ff\n    inet 192.168.1.3\/24 brd 192.168.1.255 scope global dynamic noprefixroute br-main\n       valid_lft 29379sec preferred_lft 21439sec\n    inet6 fe80::50c7:fff:fe89:716e\/64 scope link \n       valid_lft forever preferred_lft forever\n\n7: br-guest:  mtu 1500 qdisc noqueue state UP group default qlen 1000\n    link\/ether ee:ea:19:31:34:32 brd ff:ff:ff:ff:ff:ff\n    inet 192.168.2.3\/24 brd 192.168.2.255 scope global br-guest\n       valid_lft forever preferred_lft forever\n    inet6 fe80::ecea:19ff:fe31:3432\/64 scope link \n       valid_lft forever preferred_lft forever\n<\/code><\/pre>\n
    <\/p>\n
    Configurarea VPN<\/h4>\n
    \nUlterior, copiem set\u0103rile pentru OpenVPN \u0219i cheile de pe router. Set\u0103rile pot fi ob\u021binute, de obicei, din \/tmp\/etc\/openvpn*.conf<\/i><\/p>\n
    Implicit, openvpn, rulat \u00een mod TAP \u0219i server-bridge, \u00ee\u0219i men\u021bine interfa\u021ba inactiv\u0103. Pentru ca totul s\u0103 func\u021bioneze, trebuie s\u0103 ad\u0103ug\u0103m un script care s\u0103 fie executat la activarea conexiunii. <\/p>\n
    \/etc\/openvpn\/main.conf<\/b><\/p>\n
    dev vpn-main\ndev-type tap\n\nclient-to-client\npersist-key\npersist-tun\nca \/etc\/openvpn\/main\/ca.crt\ncert \/etc\/openvpn\/main\/main.crt\ncipher AES-256-CBC\ncomp-lzo yes\ndh \/etc\/openvpn\/main\/dh2048.pem\nifconfig-pool-persist \/etc\/openvpn\/ipp_main.txt\nkeepalive 10 60\nkey \/etc\/openvpn\/main\/main.key\nport 443\nproto tcp\npush \"redirect-gateway\"\npush \"dhcp-option DNS 192.168.1.1\"\nserver-bridge 192.168.1.3 255.255.255.0 192.168.1.200 192.168.1.229\nstatus \/tmp\/openvpn.main.status\nverb 3\n\nsetenv profile_name main\nscript-security 2\nup \/etc\/openvpn\/vpn-up.sh\n<\/code><\/pre>\n
    \n\/etc\/openvpn\/vpn-up.sh<\/b><\/p>\n
    #!\/bin\/sh\n\nifconfig vpn-${profile_name} up\nbrctl addif br-${profile_name} vpn-${profile_name}\n<\/code><\/pre>\n
    \nCa rezultat, imediat ce se va realiza conexiunea, interfa\u021ba vpn-main va fi ad\u0103ugat\u0103 \u00een br-main. Pentru re\u021beaua guest \u2014 similar, cu precizia numelui interfe\u021bei \u0219i adresei \u00een server-bridge.<\/p>\n
    Rutare a cererilor din exterior \u0219i proxying<\/h4>\n
    \n\u00cen acest pas, Orange Pi poate accepta deja conexiuni \u0219i permite clien\u021bilor s\u0103 acceseze re\u021belele dorite. R\u0103m\u00e2ne s\u0103 configur\u0103m proxying-ul conexiunilor \u00een router. <\/p>\n
    Mut\u0103m serverele VPN de pe router pe alte porturi, instal\u0103m HAProxy pe router \u0219i configur\u0103m:<\/p>\n
    \/etc\/haproxy.cfg<\/b><\/p>\n
    global\n        maxconn 256\n        uid 0\n        gid 0\n        daemon\n\ndefaults\n        retries 1\n        contimeout 1000\n        option splice-auto\n\nlisten guest_vpn\n        bind :444\n        mode tcp\n        server 0-orange 192.168.2.3:444 check\n        server 1-local  127.0.0.1:4444 check backup\n\nlisten main_vpn\n        bind :443\n        mode tcp\n        server 0-orange 192.168.1.3:443 check\n        server 1-local  127.0.0.1:4443 check backup\n<\/code><\/pre>\n
    <\/p>\n
    Ne bucur\u0103m<\/h4>\n
    \nDac\u0103 totul a decurs conform planului, clien\u021bii se vor muta pe Orange Pi, iar procesorul routerului nu se va mai \u00eenc\u0103lzi, iar viteza VPN-ului va cre\u0219te semnificativ. \u00cen acest timp, toate regulile de re\u021bea stabilite pe router vor r\u0103m\u00e2ne valabile. \u00cen cazul unei defec\u021biuni la Orange Pi, acesta se va dezactiva, iar HAProxy va redirec\u021biona clien\u021bii c\u0103tre serverele locale. <\/p>\n
    V\u0103 mul\u021bumim pentru aten\u021bie, sugestiile \u0219i corect\u0103rile sunt binevenite.
    \n
    Sursa: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
    \u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442, \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u043b \u0434\u0430\u0432\u043d\u044e\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0443\u0441\u043a\u043e\u0440\u0438\u0442\u044c OpenVPN \u043d\u0430 \u0440\u043e\u0443\u0442\u0435\u0440\u0435, \u043f\u0435\u0440\u0435\u043d\u0435\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u0443\u044e \u0436\u0435\u043b\u0435\u0437\u043a\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0438\u043f\u0430\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0432\u043d\u0443\u0442\u0440\u0438 \u0441\u0430\u043c\u043e\u0433\u043e \u0440\u043e\u0443\u0442\u0435\u0440\u0430. \u0423 \u043c\u0435\u043d\u044f \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0439 \u0441 \u0430\u0432\u0442\u043e\u0440\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0439 \u2014 TP-Link WDR3500 \u0441 128 \u043c\u0435\u0433\u0430\u0431\u0430\u0439\u0442\u0430\u043c\u0438 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043a\u0438 \u0438 \u0431\u0435\u0434\u043d\u044b\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0430\u043f\u0440\u043e\u0447\u044c \u043d\u0435 \u0441\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0441 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0442\u0443\u043d\u043d\u0435\u043b\u0435\u0439. \u041e\u0434\u043d\u0430\u043a\u043e, \u043b\u0435\u0437\u0442\u044c \u0432 \u0440\u043e\u0443\u0442\u0435\u0440 \u0441 \u043f\u0430\u044f\u043b\u044c\u043d\u0438\u043a\u043e\u043c \u043c\u043d\u0435 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0447\u0435\u0441\u043a\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":55824,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-55823","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Accelereaz\u0103 OpenVPN pe routerul Openwrt. O versiune alternativ\u0103 f\u0103r\u0103 lipit \u0219i extreme hardware | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/uskoryaem-openvpn-na-routere-openwrt-alternativnaya-versiya-bez-payalnika-i-hardvarnogo-ekstremizma","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0441\u043a\u043e\u0440\u044f\u0435\u043c OpenVPN \u043d\u0430 \u0440\u043e\u0443\u0442\u0435\u0440\u0435 Openwrt. \u0410\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u043d\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u0431\u0435\u0437 \u043f\u0430\u044f\u043b\u044c\u043d\u0438\u043a\u0430 \u0438 \u0445\u0430\u0440\u0434\u0432\u0430\u0440\u043d\u043e\u0433\u043e \u044d\u043a\u0441\u0442\u0440\u0435\u043c\u0438\u0437\u043c\u0430 | ProHoster","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/uskoryaem-openvpn-na-routere-openwrt-alternativnaya-versiya-bez-payalnika-i-hardvarnogo-ekstremizma","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-28T21:00:00+00:00","article:modified_time":"2020-02-18T11:03:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55823","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:36:29","updated":"2026-02-04 14:42:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/55823","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=55823"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/55823\/revisions"}],"predecessor-version":[{"id":156721,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/55823\/revisions\/156721"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/55824"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=55823"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=55823"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=55823"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}