{"id":98201,"date":"2020-10-24T20:42:36","date_gmt":"2020-10-24T18:42:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/nastrojka-na-nas-synology-openvpn-servera-po-tipu-site-to-site"},"modified":"2020-11-18T00:58:46","modified_gmt":"2020-11-17T22:58:46","slug":"nastrojka-na-nas-synology-openvpn-servera-po-tipu-site-to-site","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/nastrojka-na-nas-synology-openvpn-servera-po-tipu-site-to-site","title":{"rendered":"Configurarea unui server OpenVPN pe NAS Synology tip site-to-site","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Salut tuturor!<\/p>\n

\u0218tiu c\u0103 pentru configurarea OpenVPN s-au realizat multe lucruri. Totu\u0219i, m-am confruntat cu lipsa unei informa\u021bii sistematizate \u00een leg\u0103tur\u0103 cu subiectul, a\u0219a c\u0103 am decis s\u0103 \u00eemp\u0103rt\u0103\u0219esc experien\u021ba mea, \u00een primul r\u00e2nd cu cei care nu sunt exper\u021bi \u00een administrarea OpenVPN, dar care ar dori s\u0103 realizeze conexiunea re\u021belelor externe de tip site-to-site pe NAS Synology. De asemenea, vreau s\u0103 las \u0219i eu o not\u0103 pentru mine.<\/p>\n

A\u0219adar, avem un NAS Synology DS918+ cu pachetul VPN<\/a> Server, configurat cu OpenVPN \u0219i utilizatori care pot s\u0103 se conecteze la serverul VPN. Nu voi intra \u00een detalii privind configurarea serverului \u00een interfa\u021ba DSM (portalul web al serverului NAS). Aceast\u0103 informa\u021bie se g\u0103se\u0219te pe site-ul produc\u0103torului.<\/p>\n

Problema este c\u0103 interfa\u021ba DSM (la data public\u0103rii, versiunea 6.2.3) are un num\u0103r limitat de set\u0103ri pentru gestionarea serverului OpenVPN. \u00cen cazul nostru, este necesar\u0103 o schem\u0103 de conectare de tip site-to-site, adic\u0103 gazdele din subre\u021beaua clientului VPN trebuie s\u0103 poat\u0103 vedea gazdele din subre\u021beaua serverului VPN \u0219i viceversa. Set\u0103rile standard disponibile pe NAS permit conectarea doar de la gazdele subre\u021belei clientului VPN la gazdele subre\u021belei serverului VPN.
\n<\/a><\/noindex>
\nPentru a configura accesul la subre\u021belele clien\u021bilor VPN din subre\u021beaua serverului VPN, va trebui s\u0103 ne conect\u0103m la NAS prin SSH \u0219i s\u0103 configur\u0103m manual fi\u0219ierul de configurare al serverului OpenVPN.<\/p>\n

Pentru editarea fi\u0219ierelor pe NAS prin SSH, prefer s\u0103 folosesc Midnight Commander. De aceea, am ad\u0103ugat sursa \u00een Centrul de Pachete packages.synocommunity.com<\/a><\/noindex> \u0219i am instalat pachetul Midnight Commander.<\/p>\n

\"Configurarea
\n
\nNe conect\u0103m prin SSH la NAS cu un cont de administrator.<\/p>\n

\"Configurarea
\n
\nIntroducem sudo su \u0219i din nou introducem parola administratorului:<\/p>\n

\"Configurarea
\n
\nIntroducem comanda mc \u0219i lans\u0103m Midnight Commander:<\/p>\n

\"Configurarea
\n
\nApoi navig\u0103m la directorul \/var\/packages\/VPNCenter\/etc\/openvpn\/ \u0219i c\u0103ut\u0103m fi\u0219ierul openvpn.conf:<\/p>\n

\"Configurarea
\n
\nPentru sarcina noastr\u0103, trebuie s\u0103 conect\u0103m dou\u0103 subre\u021bele externe. Pentru aceasta, cre\u0103m prin DSM dou\u0103 conturi pe NAS cu drepturi limitate la toate serviciile NAS \u0219i oferim acces doar pentru conexiunea VPN \u00een set\u0103rile serverului VPN. Pentru fiecare client, trebuie s\u0103 configur\u0103m un IP static alocat de serverul VPN \u0219i rutare prin acest IP a traficului din subre\u021beaua serverului VPN c\u0103tre subre\u021beaua clientului VPN.<\/p>\n

Datele ini\u021biale:<\/p>\n

Subre\u021beaua serverului VPN: 192.168.1.0\/24.
\nPool-ul de adrese al serverului OpenVPN 10.8.0.0\/24. Serverul OpenVPN prime\u0219te adresa 10.8.0.1.
\nSubre\u021beaua clientului VPN 1 (utilizator VPN): 192.168.10.0\/24, trebuie s\u0103 primeasc\u0103 pe serverul OpenVPN un adres\u0103 static\u0103 10.8.0.5.
\nSubre\u021beaua VPN a utilizatorului 2 (utilizator VPN-GUST): 192.168.5.0\/24, trebuie s\u0103 primeasc\u0103 o adres\u0103 static\u0103 10.8.0.4 pe serverul OpenVPN.<\/p>\n

\u00cen catalogul de set\u0103ri, cre\u0103m un folder ccd \u0219i \u00een acesta cre\u0103m fi\u0219iere de configurare cu denumirile corespunz\u0103toare loginurilor utilizatorilor.<\/p>\n

\"Configurarea
\n
\nPentru utilizatorul VPN, \u00een fi\u0219ier ad\u0103ug\u0103m urm\u0103toarele set\u0103ri:<\/p>\n

\"Configurarea
\n
\nPentru utilizatorul VPN-GUST, \u00een fi\u0219ier ad\u0103ug\u0103m urm\u0103toarele:<\/p>\n

\"Configurarea
\n
\nR\u0103m\u00e2ne doar s\u0103 ajust\u0103m configura\u021bia serverului OpenVPN \u2014 s\u0103 ad\u0103ug\u0103m un parametru pentru citirea set\u0103rilor clien\u021bilor \u0219i s\u0103 ad\u0103ug\u0103m rut\u0103ri pentru subre\u021belele clien\u021bilor:<\/p>\n

\"Configurarea
\n
\n\u00cen captura de ecran prezentat\u0103, primele 2 linii ale configura\u021biei sunt setate prin intermediul interfe\u021bei DSM (marcarea c\u0103su\u021bei pentru parametru \u201ePermite\u021bi clien\u021bilor s\u0103 acceseze re\u021beaua local\u0103 a serverului\u201d \u00een set\u0103rile serverului OpenVPN).<\/p>\n

Linia client-config-dir ccd indic\u0103 faptul c\u0103 set\u0103rile clien\u021bilor se afl\u0103 \u00een folderul ccd.<\/p>\n

Urm\u0103toarele 2 linii de setare adaug\u0103 rute pentru subre\u021belele clien\u021bilor prin intermediul gateway-urilor corespunz\u0103toare OpenVPN.<\/p>\n

\u0218i \u00een cele din urm\u0103, pentru o func\u021bionare corect\u0103, este necesar s\u0103 aplic\u0103m topologia subnet.
\nToate celelalte set\u0103ri din fi\u0219ier le l\u0103s\u0103m neatinse.<\/p>\n

Dup\u0103 scrierea set\u0103rilor, nu uita\u021bi s\u0103 reporni\u021bi serviciul VPN Server \u00een managerul de pachete. Pe gazde sau gateway-ul pentru gazdele subre\u021belei serverului, trebuie s\u0103 scrie\u021bi rute pentru subre\u021belele clien\u021bilor prin NAS.
\n\u00cen cazul meu, gateway-ul pentru toate gazdele din subre\u021beaua \u00een care se afl\u0103 NAS (IP-ul s\u0103u 192.168.1.3) a fost router-ul (192.168.1.1). Pe acest router, am ad\u0103ugat \u00een tabela static\u0103 de rutare \u00eenregistr\u0103rile de rutare pentru re\u021belele 192.168.5.0\/24 \u0219i 192.168.10.0\/24 pe gateway 192.168.1.3 (NAS).<\/p>\n

Nu uita\u021bi c\u0103, cu firewall-ul activat pe NAS, va trebui s\u0103 \u00eel configura\u021bi \u0219i pe acesta. \u00cen plus, pe partea clientului, firewall-ul poate fi activat, care de asemenea va trebui configurat.<\/p>\n

P.S. Nu sunt profesionist \u00een tehnologia re\u021belelor \u0219i \u00een special \u00een utilizarea OpenVPN, doar \u00eemi \u00eemp\u0103rt\u0103\u0219esc experien\u021ba \u0219i public set\u0103rile pe care le-am realizat, care mi-au permis s\u0103 configurez conexiunea \u00eentre subre\u021bele de tip site-to-site. Este posibil s\u0103 existe o configurare mai simpl\u0103 \u0219i\/sau mai corect\u0103, voi fi bucuros dac\u0103 \u00eemp\u0103rt\u0103\u0219i\u021bi experien\u021ba \u00een comentarii.
\n
Sursa: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442! \u0417\u043d\u0430\u044e, \u0447\u0442\u043e \u0442\u0435\u043c \u0441 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c\u0438 OpenVPN \u0441\u0434\u0435\u043b\u0430\u043d\u043e \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e. \u041e\u0434\u043d\u0430\u043a\u043e, \u0441\u0430\u043c \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0441\u044f \u0441 \u0442\u0435\u043c, \u0447\u0442\u043e \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043f\u043e \u0442\u0435\u043c\u0435 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 \u0432 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0435 \u043d\u0435\u0442 \u0438 \u0440\u0435\u0448\u0438\u043b \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u043e\u043f\u044b\u0442\u043e\u043c \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u0441 \u0442\u0435\u043c\u0438, \u043a\u0442\u043e \u043d\u0435 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0433\u0443\u0440\u0443 \u0432 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 OpenVPN, \u043d\u043e \u0445\u043e\u0442\u0435\u043b \u0431\u044b \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0435\u0442\u0435\u0439 \u043f\u043e \u0442\u0438\u043f\u0443 site-to-site \u043d\u0430 NAS Synology. \u0417\u0430\u043e\u0434\u043d\u043e \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":98202,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-98201","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Configurare pe serverul NAS Synology OpenVPN de tip site-to-site | ProHoster","description":"Salut tuturor! \u0218tiu c\u0103 pentru set\u0103rile OpenVPN s-au realizat numeroase informa\u021bii.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/nastrojka-na-nas-synology-openvpn-servera-po-tipu-site-to-site","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043d\u0430 NAS Synology OpenVPN \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043f\u043e \u0442\u0438\u043f\u0443 site-to-site | ProHoster","og:description":"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442! \u0417\u043d\u0430\u044e, \u0447\u0442\u043e \u0442\u0435\u043c \u0441 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c\u0438 OpenVPN \u0441\u0434\u0435\u043b\u0430\u043d\u043e \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/nastrojka-na-nas-synology-openvpn-servera-po-tipu-site-to-site","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-24T18:42:36+00:00","article:modified_time":"2020-11-17T22:58:46+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"98201","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:03:30","updated":"2026-02-04 14:42:08","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/98201","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=98201"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/98201\/revisions"}],"predecessor-version":[{"id":156767,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/98201\/revisions\/156767"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/98202"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=98201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=98201"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=98201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}