{"id":55823,"date":"2020-01-29T00:00:00","date_gmt":"2020-01-28T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uskoryaem-openvpn-na-routere-openwrt-alternativnaya-versiya-bez-payalnika-i-hardvarnogo-ekstremizma"},"modified":"2020-02-18T14:03:58","modified_gmt":"2020-02-18T11:03:58","slug":"uskoryaem-openvpn-na-routere-openwrt-alternativnaya-versiya-bez-payalnika-i-hardvarnogo-ekstremizma","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/uskoryaem-openvpn-na-routere-openwrt-alternativnaya-versiya-bez-payalnika-i-hardvarnogo-ekstremizma","title":{"rendered":"Pospe\u0161ujemo OpenVPN na usmerjevalniku Openwrt. Alternativna razli\u010dica brez spajkanja in strojnega ekstremizma","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Pospe\u0161ujemo
\n
\nPozdravljeni, nedavno sem prebral staro \u010dlanko<\/a><\/noindex> o tem, kako lahko pospe\u0161imo OpenVPN na usmerjevalniku, tako da prenesemo \u0161ifriranje na lo\u010deno strojno opremo, ki je spajkana znotraj samega usmerjevalnika. Imamo podoben primer kot avtor \u2014 TP-Link WDR3500 z 128 megabajti RAM-a in slabim procesorjem, ki se povsem ne spopada s \u0161ifriranjem predorov. Vendar pa se mi ni \u017eelelo ukvarjati z usmerjevalnikom s spajkalnikom. Podrobneje vam predstavim svojo izku\u0161njo prenosa OpenVPN na lo\u010deno strojno opremo z rezervacijo na usmerjevalniku za primer okvare.
\n<\/a><\/noindex><\/p>\n

Naloga<\/h3>\n

\nImam usmerjevalnik TP-Link WDR3500 in Orange Pi Zero H2. \u017delimo, da bi se s \u0161ifriranjem predorov ukvarjal Orange Pi, pri \u010demer, \u010de se mu kaj zgodi, obdelava VPN<\/a> vrne nazaj na usmerjevalnik. Vse nastavitve po\u017earnega zidu na usmerjevalniku morajo delovati kot prej. Na splo\u0161no bi morala dodana strojna oprema za vse potekati prozorno in neopazno. OpenVPN deluje po TCP, adapter TAP v na\u010dinu mostu (server-bridge).<\/p>\n

Solution<\/h3>\n

\nNamesto povezovanja prek USB sem se odlo\u010dil porabiti en od priklju\u010dkov usmerjevalnika in ga povezati na Orange Pi za vse podomre\u017eja, kjer je VPN most. Tako bo strojna oprema fizi\u010dno povezana z istimi omre\u017eji kot VPN stre\u017eniki na usmerjevalniku. Po tem postavimo enake stre\u017enike na Orange Pi, na usmerjevalniku pa nastavimo kak\u0161no proxy, da usmerja vse vhodne povezave na zunanji stre\u017enik, v primeru, da je Orange Pi mrtev ali nedostopen \u2014 takrat na notranji rezervni stre\u017enik. Izbral sem HAProxy.<\/p>\n

Torej izgleda tako:<\/p>\n

    \n
  1. Stranka pride<\/li>\n
  2. \u010ce zunanji stre\u017enik ni dostopen \u2014 kot prej povezava gre na notranji stre\u017enik<\/li>\n
  3. \u010ce je dostopen \u2014 stranko sprejme Orange Pi<\/li>\n
  4. VPN na Orange Pi de\u0161ifrira pakete in jih vrne nazaj na usmerjevalnik<\/li>\n
  5. Usmerjevalnik jih usmerja nekam<\/li>\n<\/ol>\n

    <\/p>\n

    Primer izvedbe<\/h3>\n

    \nTorej, recimo, da imamo na usmerjevalniku dve omre\u017eji \u2014 main(1) in guest(2), za vsako od njih imamo OpenVPN stre\u017enik za zunanje povezave.<\/p>\n

    Konfiguracija omre\u017eja<\/h4>\n

    \nMoramo pro\u0107i kroz jednu mre\u017eu koriste\u0107i jedan port, zato kreiramo 2 VLAN-a. <\/p>\n

    Na ruteru u odeljku Network\/Switch kreiramo VLAN-ove (na primer 1 i 2) i uklju\u010dujemo ih u tagged re\u017eimu na potrebnom portu, dodajemo novo kreirane eth0.1 i eth0.2 odgovaraju\u0107im mre\u017eama (na primer, dodaju\u0107i u brigde). <\/p>\n

    Na Orange Pi ustvarimo dve VLAN vmesnici (imam Archlinux ARM + netctl):<\/p>\n

    \/etc\/netctl\/vlan-main<\/b><\/p>\n

    Opis='Glavni VLAN na eth0'\nSu\u010delje=vlan-glavni\nVeza=vlan\nPovezujeUzSu\u010delja=eth0\nVLANID=1\nIP=ne\n<\/code><\/pre>\n
    \n\/etc\/netctl\/vlan-guest<\/b><\/p>\n
    Opis='Gostuju\u0107i VLAN na eth0'\nSu\u010delje=vlan-gost\nVeza=vlan\nPovezujeUzSu\u010delja=eth0\nVLANID=2\nIP=ne\n<\/code><\/pre>\n
    \nI odmah kreiramo dva mosta za njih:<\/p>\n
    \/etc\/netctl\/br-main<\/b><\/p>\n
    Description=\"Glavna Bridge veza\"\nInterface=br-main\nConnection=bridge\nBindsToInterfaces=(vlan-main)\nIP=dhcp\n<\/code><\/pre>\n
    \n\/etc\/netctl\/br-guest<\/b><\/p>\n
    Description=\"Gosta Bridge veza\"\nInterface=br-guest\nConnection=bridge\nBindsToInterfaces=(vlan-guest)\nIP=dhcp\n<\/code><\/pre>\n
    \nUklju\u010dujemo automatski start za svih 4 profila (netctl enable). Sada \u0107e nakon ponovnog pokretanja Orange Pi biti povezan u dvije potrebne mre\u017ee. Adrese su\u010delja na Orange Pi postavljamo u Static Leases na routeru. <\/p>\n
    ip addr show<\/b><\/p>\n
    4: vlan-glavni@eth0:  mtu 1500 qdisc noqueue master br-glavni stanje UP grupa default qlen 1000\n    link\/ether 02:42:f0:f8:23:c8 brd ff:ff:ff:ff:ff:ff\n    inet6 fe80::42:f0ff:fef8:23c8\/64 opseg link \n       valid_lft zauvijek preferred_lft zauvijek\n\n5: vlan-gost@eth0:  mtu 1500 qdisc noqueue master br-gost stanje UP grupa default qlen 1000\n    link\/ether 02:42:f0:f8:23:c8 brd ff:ff:ff:ff:ff:ff\n    inet6 fe80::42:f0ff:fef8:23c8\/64 opseg link \n       valid_lft zauvijek preferred_lft zauvijek\n\n6: br-glavni:  mtu 1500 qdisc noqueue stanje UP grupa default qlen 1000\n    link\/ether 52:c7:0f:89:71:6e brd ff:ff:ff:ff:ff:ff\n    inet 192.168.1.3\/24 brd 192.168.1.255 opseg global dynamic noprefixroute br-glavni\n       valid_lft 29379sec preferred_lft 21439sec\n    inet6 fe80::50c7:fff:fe89:716e\/64 opseg link \n       valid_lft zauvijek preferred_lft zauvijek\n\n7: br-gost:  mtu 1500 qdisc noqueue stanje UP grupa default qlen 1000\n    link\/ether ee:ea:19:31:34:32 brd ff:ff:ff:ff:ff:ff\n    inet 192.168.2.3\/24 brd 192.168.2.255 opseg global br-gost\n       valid_lft zauvijek preferred_lft zauvijek\n    inet6 fe80::ecea:19ff:fe31:3432\/64 opseg link \n       valid_lft zauvijek preferred_lft zauvijek\n<\/code><\/pre>\n
    <\/p>\n
    Postavljanje VPN-a<\/h4>\n
    \nDalje kopiramo s routera postavke za OpenVPN i klju\u010deve. Postavke obi\u010dno mo\u017eemo uzeti u \/tmp\/etc\/openvpn*.conf<\/i><\/p>\n
    Po defaultu openvpn, pokrenut u TAP re\u017eimu i server-bridge dr\u017ei svoj su\u010delje neaktivnim. Da bi sve radilo, potrebno je dodati skriptu koja \u0107e se aktivirati prilikom povezivanja. <\/p>\n
    \/etc\/openvpn\/main.conf<\/b><\/p>\n
    dev vpn-main\ndev-type tap\n\nclient-to-client\npersist-key\npersist-tun\nca \/etc\/openvpn\/main\/ca.crt\ncert \/etc\/openvpn\/main\/main.crt\ncipher AES-256-CBC\ncomp-lzo yes\ndh \/etc\/openvpn\/main\/dh2048.pem\nifconfig-pool-persist \/etc\/openvpn\/ipp_main.txt\nkeepalive 10 60\nkey \/etc\/openvpn\/main\/main.key\nport 443\nproto tcp\npush \"redirect-gateway\"\npush \"dhcp-option DNS 192.168.1.1\"\nserver-bridge 192.168.1.3 255.255.255.0 192.168.1.200 192.168.1.229\nstatus \/tmp\/openvpn.main.status\nverb 3\n\nsetenv profile_name main\nscript-security 2\nup \/etc\/openvpn\/vpn-up.sh\n<\/code><\/pre>\n
    \n\/etc\/openvpn\/vpn-up.sh<\/b><\/p>\n
    #!\/bin\/sh\n\nifconfig vpn-${profile_name} up\nbrctl addif br-${profile_name} vpn-${profile_name}\n<\/code><\/pre>\n
    \nKao rezultat, \u010dim se dogodi povezivanje, su\u010delje vpn-glavni \u0107e biti dodano u br-glavni. Za mre\u017eu gostiju \u2014 isto tako s to\u010dno\u0161\u0107u do imena su\u010delja i adrese u server-bridge.<\/p>\n
    Usmjeravanje zahtjeva s vanjske strane i proksiranje<\/h4>\n
    \nU ovoj fazi Orange Pi ve\u0107 mo\u017ee primati veze i dopu\u0161tati klijentima pristup \u017eeljenim mre\u017eama. Ostaje da se postavi proksiranje dolaznih veza na routeru. <\/p>\n
    Preusmerjamo VPN stre\u017enike na druge porte, namestimo HAProxy na usmerjevalniku in ga konfiguriramo:<\/p>\n
    \/etc\/haproxy.cfg<\/b><\/p>\n
    global\n        maxconn 256\n        uid 0\n        gid 0\n        daemon\n\ndefaults\n        retries 1\n        contimeout 1000\n        option splice-auto\n\nlisten guest_vpn\n        bind :444\n        mode tcp\n        server 0-orange 192.168.2.3:444 check\n        server 1-local  127.0.0.1:4444 check backup\n\nlisten main_vpn\n        bind :443\n        mode tcp\n        server 0-orange 192.168.1.3:443 check\n        server 1-local  127.0.0.1:4443 check backup\n<\/code><\/pre>\n
    <\/p>\n
    U\u017eivamo<\/h4>\n
    \n\u010ce bo vse \u0161lo po na\u010drtu, bodo stranke pre\u0161le na Orange Pi in procesor usmerjevalnika se ne bo ve\u010d pregreval, hitrost VPN pa se bo znatno pove\u010dala. Vse omre\u017ene pravilnike, ki so navedeni na usmerjevalniku, pa bodo \u0161e vedno veljali. V primeru okvare na Orange Pi se bo ta izklopil in HAProxy bo preusmeril stranke na lokalne stre\u017enike. <\/p>\n
    Hvala za pozornost, vabljeni ste, da jih delite in priporo\u010dila so dobrodo\u0161la.
    \n
    Izvor: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
    \u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442, \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u043b \u0434\u0430\u0432\u043d\u044e\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0443\u0441\u043a\u043e\u0440\u0438\u0442\u044c OpenVPN \u043d\u0430 \u0440\u043e\u0443\u0442\u0435\u0440\u0435, \u043f\u0435\u0440\u0435\u043d\u0435\u0441\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u0443\u044e \u0436\u0435\u043b\u0435\u0437\u043a\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0438\u043f\u0430\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0432\u043d\u0443\u0442\u0440\u0438 \u0441\u0430\u043c\u043e\u0433\u043e \u0440\u043e\u0443\u0442\u0435\u0440\u0430. \u0423 \u043c\u0435\u043d\u044f \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0439 \u0441 \u0430\u0432\u0442\u043e\u0440\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0439 \u2014 TP-Link WDR3500 \u0441 128 \u043c\u0435\u0433\u0430\u0431\u0430\u0439\u0442\u0430\u043c\u0438 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043a\u0438 \u0438 \u0431\u0435\u0434\u043d\u044b\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0430\u043f\u0440\u043e\u0447\u044c \u043d\u0435 \u0441\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0441 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0442\u0443\u043d\u043d\u0435\u043b\u0435\u0439. \u041e\u0434\u043d\u0430\u043a\u043e, \u043b\u0435\u0437\u0442\u044c \u0432 \u0440\u043e\u0443\u0442\u0435\u0440 \u0441 \u043f\u0430\u044f\u043b\u044c\u043d\u0438\u043a\u043e\u043c \u043c\u043d\u0435 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0447\u0435\u0441\u043a\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":55824,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-55823","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Pospe\u0161ujemo OpenVPN na usmerjevalniku Openwrt. Alternativna razli\u010dica brez spajkalnika in hardverskega ekstremizma | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/uskoryaem-openvpn-na-routere-openwrt-alternativnaya-versiya-bez-payalnika-i-hardvarnogo-ekstremizma","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0441\u043a\u043e\u0440\u044f\u0435\u043c OpenVPN \u043d\u0430 \u0440\u043e\u0443\u0442\u0435\u0440\u0435 Openwrt. \u0410\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u043d\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f \u0431\u0435\u0437 \u043f\u0430\u044f\u043b\u044c\u043d\u0438\u043a\u0430 \u0438 \u0445\u0430\u0440\u0434\u0432\u0430\u0440\u043d\u043e\u0433\u043e \u044d\u043a\u0441\u0442\u0440\u0435\u043c\u0438\u0437\u043c\u0430 | ProHoster","og:url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/uskoryaem-openvpn-na-routere-openwrt-alternativnaya-versiya-bez-payalnika-i-hardvarnogo-ekstremizma","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-28T21:00:00+00:00","article:modified_time":"2020-02-18T11:03:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55823","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:36:29","updated":"2026-02-04 14:42:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/55823","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=55823"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/55823\/revisions"}],"predecessor-version":[{"id":156721,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/55823\/revisions\/156721"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media\/55824"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=55823"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=55823"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=55823"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}