{"id":98201,"date":"2020-10-24T20:42:36","date_gmt":"2020-10-24T18:42:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/nastrojka-na-nas-synology-openvpn-servera-po-tipu-site-to-site"},"modified":"2020-11-18T00:58:46","modified_gmt":"2020-11-17T22:58:46","slug":"nastrojka-na-nas-synology-openvpn-servera-po-tipu-site-to-site","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/nastrojka-na-nas-synology-openvpn-servera-po-tipu-site-to-site","title":{"rendered":"Nastavenie OpenVPN servera na NAS Synology typu site-to-site","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ahojte v\u0161etci!<\/p>\n

Vieme, \u017ee existuje mnoho nastaven\u00ed OpenVPN. Av\u0161ak s\u00e1m som sa stretol s t\u00fdm, \u017ee systematizovan\u00e9 inform\u00e1cie na t\u00e9mu nadpisu v z\u00e1sade nie s\u00fa a rozhodol som sa podeli\u0165 o sk\u00fasenosti predov\u0161etk\u00fdm s t\u00fdmi, ktor\u00ed nie s\u00fa guru v administr\u00e1cii OpenVPN, ale chceli by dosiahnu\u0165 pripojenie vzdialen\u00fdch podsiet\u00ed typu site-to-site na NAS Synology. Z\u00e1rove\u0148 si to chcem necha\u0165 ako pozn\u00e1mku na pamiatku.<\/p>\n

Tak\u017ee. M\u00e1m NAS Synology DS918+ s nain\u0161talovan\u00fdm bal\u00edkom VPN<\/a> Server, na ktorom je nastaven\u00fd OpenVPN a u\u017e\u00edvatelia, ktor\u00ed sa m\u00f4\u017eu pripoji\u0165 k VPN serveru. Nebudem sa podrobne zaobera\u0165 nastaven\u00edm servera v rozhran\u00ed DSM (webov\u00fd port\u00e1l NAS servera). T\u00e1to inform\u00e1cia je na webovej str\u00e1nke v\u00fdrobcu.<\/p>\n

Probl\u00e9m je v tom, \u017ee rozhranie DSM (k d\u00e1tumu zverejnenia verzia 6.2.3) m\u00e1 obmedzen\u00fd po\u010det nastaven\u00ed pre spr\u00e1vu OpenVPN servera. V na\u0161om pr\u00edpade potrebujeme sch\u00e9mu pripojenia typu site-to-site, t. j. hostitelia podsiete klienta VPN by mali vidie\u0165 hostite\u013eov podsiete VPN servera a naopak. \u0160tandardn\u00e9 nastavenia, dostupn\u00e9 na NAS, umo\u017e\u0148uj\u00fa nastavi\u0165 pr\u00edstup len od hostite\u013eov podsiete klienta VPN k hostite\u013eom podsiete servera VPN.
\n<\/a><\/noindex>
\nNa nastavenie pr\u00edstupu k podsietiam klientov VPN z podsiete VPN servera sa mus\u00edme prihl\u00e1si\u0165 na NAS cez SSH a manu\u00e1lne upravi\u0165 konfigura\u010dn\u00fd s\u00fabor OpenVPN servera.<\/p>\n

Na \u00fapravu s\u00faborov na NAS cez SSH sa mi pohodlnej\u0161ie pou\u017e\u00edva Midnight Commander. Na tento \u00fa\u010del som v Centre bal\u00edkov pripojil zdroj packages.synocommunity.com<\/a><\/noindex> a nain\u0161taloval som bal\u00edk Midnight Commander.<\/p>\n

\"Nastavenie
\n
\nPrihl\u00e1sime sa cez SSH na NAS s administr\u00e1torsk\u00fdm \u00fa\u010dtom.<\/p>\n

\"Nastavenie
\n
\nZad\u00e1me sudo su a e\u0161te raz zad\u00e1me heslo administr\u00e1tora:<\/p>\n

\"Nastavenie
\n
\nNap\u00ed\u0161eme pr\u00edkaz mc a spust\u00edme Midnight Commander:<\/p>\n

\"Nastavenie
\n
\nPotom prejdeme do adres\u00e1ra \/var\/packages\/VPNCenter\/etc\/openvpn\/ a n\u00e1jdeme s\u00fabor openvpn.conf:<\/p>\n

\"Nastavenie
\n
\nPod\u013ea \u00falohy potrebujeme pripoji\u0165 2 vzdialen\u00e9 podsiete. Na tento \u00fa\u010del vytvor\u00edme cez DSM 2 \u00fa\u010dty na NAS s obmedzen\u00fdmi pr\u00e1vami na v\u0161etky slu\u017eby NAS a poskytneme pr\u00edstup len na VPN pripojenie v nastaveniach VPN Servera. Pre ka\u017ed\u00e9ho klienta mus\u00edme nastavi\u0165 statick\u00fd IP pridelovan\u00fd VPN serverom a routovanie cez tento IP trasy z podsiete VPN servera na podsie\u0165 VPN klienta.<\/p>\n

Z\u00e1kladn\u00e9 \u00fadaje:<\/p>\n

Podsie\u0165 VPN servera: 192.168.1.0\/24.
\nRozsah adries OpenVPN servera 10.8.0.0\/24. S\u00e1m OpenVPN server z\u00edskava adresu 10.8.0.1.
\nPodsie\u0165 VPN klienta 1 (u\u017e\u00edvate\u013e VPN): 192.168.10.0\/24, mus\u00ed z\u00edska\u0165 na OpenVPN serveri statick\u00fa adresu 10.8.0.5.
\nPodsie\u0165 VPN klienta 2 (pou\u017e\u00edvate\u013e VPN-GUST): 192.168.5.0\/24, by mala na OpenVPN serveri dosta\u0165 statick\u00fa adresu 10.8.0.4<\/p>\n

V adres\u00e1ri nastaven\u00ed vytvor\u00edme slo\u017eku ccd a v nej vytvor\u00edme s\u00fabory nastaven\u00ed s n\u00e1zvami zodpovedaj\u00facimi prihlasovac\u00edm men\u00e1m pou\u017e\u00edvate\u013eov.<\/p>\n

\"Nastavenie
\n
\nPre pou\u017e\u00edvate\u013ea VPN v s\u00fabore uvedieme nasleduj\u00face nastavenia:<\/p>\n

\"Nastavenie
\n
\nPre pou\u017e\u00edvate\u013ea VPN-GUST v s\u00fabore uvedieme nasledovn\u00e9:<\/p>\n

\"Nastavenie
\n
\nZost\u00e1va len doladi\u0165 konfigur\u00e1ciu OpenVPN servera \u2014 prida\u0165 parameter na \u010d\u00edtanie nastaven\u00ed klientov a prida\u0165 routovanie na podsiete klientov:<\/p>\n

\"Nastavenie
\n
\nNa uvedenom sn\u00edmku obrazovky sa prv\u00e9 2 riadky konfigur\u00e1cie nastavuj\u00fa pomocou rozhrania DSM (za\u0161krtnutie parametra \u201ePovoli\u0165 klientom pr\u00edstup k lok\u00e1lnej sieti servera\u201c v nastaveniach OpenVPN servera).<\/p>\n

Riadok client-config-dir ccd ud\u00e1va, \u017ee nastavenia klientov sa nach\u00e1dzaj\u00fa v prie\u010dinku ccd.<\/p>\n

Nasleduj\u00face 2 riadky nastavenia prid\u00e1vaj\u00fa routy na podsiete klientov cez pr\u00edslu\u0161n\u00e9 br\u00e1ny OpenVPN.<\/p>\n

A nakoniec, pre spr\u00e1vnu funkciu je potrebn\u00e9 aplikova\u0165 topol\u00f3giu subnet.
\nV\u0161etky ostatn\u00e9 nastavenia v s\u00fabore nemen\u00edme.<\/p>\n

Po zadan\u00ed nastaven\u00ed nezabudnite re\u0161tartova\u0165 slu\u017ebu VPN Server v spr\u00e1vcovi bal\u00edkov. Na hostite\u013eoch alebo br\u00e1ne pre hostite\u013esk\u00e9 podsiete je potrebn\u00e9 zada\u0165 routy na podsiete klientov cez NAS.
\nV mojom pr\u00edpade bola br\u00e1nou pre v\u0161etk\u00fdch hostite\u013eov podsiete, v ktorej sa nach\u00e1dza NAS (jeho IP 192.168.1.3), router (192.168.1.1). Na tomto routeri som pridal do statickej tabu\u013eky routovania z\u00e1znamy smerovania pre siete 192.168.5.0\/24 a 192.168.10.0\/24 na br\u00e1nu 192.168.1.3 (NAS).<\/p>\n

Nezab\u00fadajte, \u017ee pri zapnutom firewall-e na NAS bude potrebn\u00e9 nastavi\u0165 aj ten. Navy\u0161e na strane klienta m\u00f4\u017ee by\u0165 zapnut\u00fd firewall, ktor\u00fd tak isto bude potrebn\u00e9 nastavi\u0165.<\/p>\n

P.S. Nie som profesion\u00e1l v sie\u0165ov\u00fdch technol\u00f3giach a osobitne v pr\u00e1ci s OpenVPN, len sa del\u00edm o svoje sk\u00fasenosti a zverej\u0148ujem nastavenia, ktor\u00e9 som vytvoril a ktor\u00e9 umo\u017enili nastavi\u0165 spojenie medzi podsie\u0165ami typu site-to-site. Mo\u017eno existuje aj jednoduch\u0161ie a\/alebo spr\u00e1vnej\u0161ie nastavenie, budem len r\u00e1d, ak sa so mnou podel\u00edte o sk\u00fasenosti v koment\u00e1roch.
\n
Zdroj: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442! \u0417\u043d\u0430\u044e, \u0447\u0442\u043e \u0442\u0435\u043c \u0441 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c\u0438 OpenVPN \u0441\u0434\u0435\u043b\u0430\u043d\u043e \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e. \u041e\u0434\u043d\u0430\u043a\u043e, \u0441\u0430\u043c \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0441\u044f \u0441 \u0442\u0435\u043c, \u0447\u0442\u043e \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043f\u043e \u0442\u0435\u043c\u0435 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 \u0432 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0435 \u043d\u0435\u0442 \u0438 \u0440\u0435\u0448\u0438\u043b \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u043e\u043f\u044b\u0442\u043e\u043c \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u0441 \u0442\u0435\u043c\u0438, \u043a\u0442\u043e \u043d\u0435 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0433\u0443\u0440\u0443 \u0432 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 OpenVPN, \u043d\u043e \u0445\u043e\u0442\u0435\u043b \u0431\u044b \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0435\u0442\u0435\u0439 \u043f\u043e \u0442\u0438\u043f\u0443 site-to-site \u043d\u0430 NAS Synology. \u0417\u0430\u043e\u0434\u043d\u043e \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":98202,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-98201","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Nastavenie NAS Synology OpenVPN servera typu site-to-site | ProHoster","description":"Ahojte! Viem, \u017ee o nastaveniach OpenVPN bolo nap\u00edsan\u00fdch mno\u017estvo \u010dl\u00e1nkov.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/nastrojka-na-nas-synology-openvpn-servera-po-tipu-site-to-site","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043d\u0430 NAS Synology OpenVPN \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043f\u043e \u0442\u0438\u043f\u0443 site-to-site | ProHoster","og:description":"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442! \u0417\u043d\u0430\u044e, \u0447\u0442\u043e \u0442\u0435\u043c \u0441 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c\u0438 OpenVPN \u0441\u0434\u0435\u043b\u0430\u043d\u043e \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/nastrojka-na-nas-synology-openvpn-servera-po-tipu-site-to-site","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-24T18:42:36+00:00","article:modified_time":"2020-11-17T22:58:46+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"98201","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:03:30","updated":"2026-02-04 14:42:08","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/98201","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=98201"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/98201\/revisions"}],"predecessor-version":[{"id":156767,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/98201\/revisions\/156767"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/98202"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=98201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=98201"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=98201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}