ืืื ืจืืึฟ ืงืึทืกืขืก, ืงืึทื ืขืงืืื ื ืึท ืจืึทืืืขืจ ืฆื ืึท ืืืคึผื ืืื ื ืืฉื ืฉืืืขืจ, ืึธืืขืจ ืืืื ืืืจ ืืืืื ืฆื ืืึทืฉืืฆื ืื ืืื ืฆืข ื ืขืฅ ืืื ืืื ืืขืจ ืืขืืืืงืขืจ ืฆืืื ืืึทืืื ืึธืคึผืืืืึทื ืงืฉืจ ืืืืงืืึทื, ืืขืจ ืืขืกืืขืจ ืืืืืื ื ืืื ืฆื ื ืืฆื ืึท VPN ืืื ืขื. .
ืจืึธืืืขืจืก ืืืงืจืึธืืืง ืคึผืจืืืื ืฆื ืืืื ืคืึทืจืืึธืืืขื ืืื ืืืืขืจ ืคืืขืงืกืึทืืึทื ืกืึทืืืฉืึทื ื, ืึธืืขืจ ืืืืืขืจ ื ืึธื ื ืืฉื ืืื ืขืก ืืื ื ืืฉื ืืืงืื ื ืืืขื ืขืก ืืืขื ืืขืจืฉืืึทื ืขื ืืื ืืื ืืืึธืก ืคืึธืจืฉืืขืืื ื. ืืขืฆืื ืก ืืืขืื ืืืึธืก ืื ืืขืืืขืืึธืคึผืขืจืก ืคืื ืื WireGuard VPN ืืื ืขื ืกืึทืืืืฉืขืกืืื , ืืืึธืก ืืืขื ืืึทืื ืืืืขืจ ืืืคึผื ืืึทื ืึทืืื ื ืืืืืืืืืจื ืืืื ืคืื ืื ืืื ืืงืก ืงืขืจื, ืืืจ ืืึธืคื ืึทื ืืึธืก ืืืขื ืืืืฉืืืืขืจื ืฆื ืื ืงืื ืืขืจ ืืื RouterOS.
ืึธืืขืจ, ืืืืืขืจ, ืฆื ืงืึทื ืคืืืืขืจ WireGuard ืืืืฃ ืึท ืืืงืจืึธืืืง ืจืึทืืืขืจ, ืืืจ ืืึทืจืคึฟื ืฆื ืืืืฉื ืื ืคืืจืืืืึทืจืข.
ืคืืึทืฉืื ื ืืืงืจืึธืืืง, ืื ืกืืึทืืืจื ืืื ืงืึทื ืคืืืืขืจ OpenWrt
ืขืจืฉืืขืจ ืืืจ ืืึทืจืคึฟื ืฆื ืืึทืื ืืืืขืจ ืึทื OpenWrt ืฉืืืฆื ืืืื ืืึธืืขื. ืืขื ืืืื ืึท ืืึธืืขื ืืืืึทืื ืืืื ืคึฟืึทืจืงืืืฃ ื ืึธืืขื ืืื ืืืื .
ืืืื ืฆื openwrt.com .
ืคึฟืึทืจ ืืขื ืืืื, ืืืจ ืืึทืจืคึฟื 2 ืืขืงืขืก:
ืืืจ ืืึทืจืคึฟื ืฆื ืึธืคึผืืึธืืืจื ืืืืืข ืืขืงืขืก: ืื ืกืืึทืืืจื ะธ ืืคึผืืจืึทืืข.
1. ื ืขืฅ ืกืขืืึทืคึผ, ืืจืืคืงืืคืืข ืืื ืกืขืืึทืคึผ ืคึผืงืกืข ืกืขืจืืืขืจ
ืืจืืคืงืืคืืข ืคึฟืึทืจ ืื ืืขืฆืืข ืืืขืจืกืืข ืคืื โโโโWindows.
ืึทื ืืืคึผ ืฆื ืึท ืืึทืืื ืืขืจ ืืขืงืข. ืืื ืื config.ini ืืขืงืข ืืืืื ืืขื ืคึผืึทืจืึทืืขืืขืจ rfc951=1 ืึธืคึผืืืืืื ื [dhcp]. ืืขืจ ืคึผืึทืจืึทืืขืืขืจ ืืื ืืขืจ ืืขืืืืงืขืจ ืคึฟืึทืจ ืึทืืข ืืืงืจืึธืืืง ืืึธืืขืืก.
ืืึธืืืจ ืืืื ืฆื ืื ื ืขืฅ ืกืขืืืื ืืก: ืืืจ ืืึทืจืคึฟื ืฆื ืจืขืืืกืืจืืจื ืึท ืกืืึทืืืง ืืคึผ ืึทืืจืขืก ืืืืฃ ืืืื ืขืจ ืคืื ืื ื ืขืฅ ืื ืืขืจืคืืืกืื ืคืื ืืืื ืงืึธืืคึผืืืืขืจ.
IP ืึทืืจืขืก: 192.168.1.10
ื ืขืืืึทืกืง: 255.255.255.0
ืืืืคื ืงืืืื ืืฉืืง ืคึผืงืกืข ืกืขืจืืืืจืขืจ ืืืืฃ ืืืืึทืฃ ืคืื ืื ืึทืืืื ืืกืืจืึทืืึธืจ ืืื ืกืขืืขืงืืืจื ืืื ืืขื ืคืขืื ืืืงืคึผ ืกืขืจืืืขืจ ืกืขืจืืืขืจ ืืื ืึทืืจืขืก 192.168.1.10
ืืืืฃ ืขืืืขืืข ืืืขืจืกืืขืก ืคืื Windows, ืืขื ืฆืืืื ื ืงืขื ืืืื ืืืืื ื ืึธื ืึทื ืขืืืขืจื ืขื ืงืฉืจ. ืืื ืจืขืงืึธืืขื ืืืจื ืงืึทื ืขืงืืื ื ืึท ืจืึทืืืขืจ ืืื ืืืืื ืืึทืฉืืืืขื ืื ืจืึทืืืขืจ ืืื ืคึผืืกื ืืื ืึท ืืึทืืข ืฉื ืืจ.
ืืจืืงื ืื "..." ืงื ืขืคึผื (ืื ืึธ ืจืขืื) ืืื ืกืคึผืขืฆืืคืืฆืืจื ืื ืืขืงืข ืืื ืืืจ ืืึทืื ืืึธืืืื ืื ืคืืจืืืืึทืจืข ืืขืงืขืก ืคึฟืึทืจ ืืืงืจืึธืืืง.
ืงืืืึทืื ืึท ืืขืงืข ืืืขืืขื ืก ื ืึธืืขื ืขื ืืก ืืื "initramfs-kernel.bin or elf"
2. ืืืืื ื ืื ืจืึทืืืขืจ ืคืื ืื ืคึผืงืกืข ืกืขืจืืืขืจ
ืืืจ ืคืึทืจืืื ืื ืื ืคึผืืกื ืืื ืึท ืืจืึธื ืืื ืืขืจ ืขืจืฉืืขืจ ืคึผืึธืจื (ืืืึทื, ืืื ืืขืจื ืขื, ืคึผืึธืข ืืื, ...) ืคืื ืื ืจืึทืืืขืจ. ื ืึธื ืืขื, ืืืจ ื ืขืืขื ืึท ืฆืืื ืฉืืขืืขืจ, ืฉืืขืงื ืขืก ืืื ืื ืืึธื ืืื ืื ืื ืกืงืจืืคึผืฉืึทื "ืืึทืฉืืขืืืง".
ืืืจ ืงืขืจ ืืืืฃ ืื ืืึทืื ืคืื ืื ืจืึทืืืขืจ ืืื ืืืึทืจืื 20 ืกืขืงืื ืืขืก, ืืื ืืึธืื ืื ืฆืืื ืฉืืขืืขืจ.
ืืื ืืขืจ ืืืืึทืืขืจ ืืื ืื, ืื ืคืืืืขื ืืข ืึทืจืืืงืืขื ืืึธื ืืขืจืฉืืึทื ืขื ืืื ืื ืงืืืื ืืฉืืง ืคึผืงืกืข ืกืขืจืืืืจืขืจ ืคึฟืขื ืฆืืขืจ:
ืืืื ืืขืจ ืึธื ืืึธื ืืื ืืจืืืก, ืืืจ ืืขื ื ืืื ืื ืจืขืื ืจืืืืื ื!
ืืืงืขืจื ืื ืกืขืืืื ืืก ืืืืฃ ืื ื ืขืฅ ืึทืืึทืคึผืืขืจ ืืื ืฉืืขืื ืื ืึทืืจืขืก ืืื ืึทืืืงืึทืืื (ืืืจื DHCP).
ืคืึทืจืืื ืื ืฆื ืื ืืึทื ืคึผืึธืจืฅ ืคืื ืื ืืืงืจืึธืืืง ืจืึทืืืขืจ (2โฆ5 ืืื ืืื ืืืขืจ ืคืึทื) ืืื ืืขืจ ืืขืืืืงืขืจ ืืึทืืข ืฉื ืืจ. ื ืึธืจ ืืึทืฉืืืืขื ืขืก ืคืื 1 ืคึผืึธืจื ืฆื 2 ืคึผืึธืจื. ืขืคืขื ืขื ืึทืืจืขืก ืืื ืืขื ืืืขืืขืจืขืจ.
ืงืืึธืฅ ืืื ืฆื ืื OpenWRT ืึทืืืื ืืกืืจืึทืืืืืข ืฆืืืื ื ืืื ืืืื ืฆื ืื "ืกืืกืืขื -> ืืึทืงืงืืคึผ / ืคืืึทืฉ ืคืืจืืืืึทืจืข" ืืขื ืื ืึธืคึผืืืืืื ื
ืืื ืื ืกืึทืืกืขืงืฉืึทื "ืคืืึทืฉ ื ืืึท ืคืืจืืืืึทืจืข ืืืื", ืืื ืื "ืกืขืืขืงืืืจื ืืขืงืข (ืึธืคึผืคืืืงื)" ืงื ืขืคึผื.
ืกืคึผืขืฆืืคืืฆืืจื ืืขื ืืจื ืฆื ืึท ืืขืงืข ืืืขืืขื ืก ื ืึธืืขื ืขื ืืก ืืื "-squashfs-sysupgrade.bin".
ื ืึธื ืืขื, ืืื ืื "ืคืืึทืฉ ืืืื" ืงื ืขืคึผื.
ืืื ืืขืจ ืืืืึทืืขืจ ืคึฟืขื ืฆืืขืจ, ืืื ืื "ืคืึธืจืืขืฆื" ืงื ืขืคึผื. ืื ืคืืจืืืืึทืจืข ืืืขื ืึธื ืืืืื ืืึทืื ืืึธืืืื ื ืฆื ืื ืจืึทืืืขืจ.
!!! ืืื ืงืืื ืืขืฉืขืขื ืืฉ ืืึธื ื ืื ืืืกืงืึทื ืขืงื ืื ืืึทืื ืคืื ืื ืจืึทืืืขืจ ืืขืฉืึทืก ืื ืคืืจืืืืึทืจืข ืคึผืจืึธืฆืขืก !!!
ื ืึธื ืคืืึทืฉืื ื ืืื ืจืขืืึธืึธื ืื ืจืึทืืืขืจ, ืืืจ ืืืขื ืืึทืงืืืขื ืืืงืจืึธืืืง ืืื OpenWRT ืคืืจืืืืึทืจืข.
ืืขืืืขื ืคึผืจืึธืืืขืืก ืืื ืกืึทืืืฉืึทื ื
ืคืืืข ืืืงืจืึธืืืง ืืขืืืืกืขืก ืืืคืจืืื ืืื 2019 ื ืืฆื ืึท FLASH-NOR ืืึผืจืื ืฉืคึผืึธื ืคืื ืื GD25Q15 / Q16 ืืืคึผ. ืื ืคึผืจืึธืืืขื ืืื ืึทื ืืืขื ืคืืึทืฉืื ื, ืืึทืื ืืืขืื ืื ืืืื ืืึธืืขื ืืขื ืขื ื ืืฉื ืืขืจืืืขืืืขื.
ืืืื ืืืจ ืืขื ืื ืืขืืช "ืื ืืคึผืืึธืึทืืขื ืืืื ืืขืงืข ืืื ื ืืฉื ืึทื ืืืึทืืื ืึท ืฉืืืฆื ืคึฟืึธืจืืึทื. ืืึทืื ืืืืขืจ ืึทื ืืืจ ืงืืืึทืื ืื ืืืฉืึทื ืขืจืืง ืืืื ืคึฟืึธืจืืึทื ืคึฟืึทืจ ืืืื ืคึผืืึทืืคืึธืจืืข." ืืขืืึธืื ืจืืึฟ ืืกืชึผืื ืื ืคึผืจืึธืืืขื ืืื ืืื ืืืืฅ.
ืขืก ืืื ืืจืื ื ืฆื ืงืึธื ืืจืึธืืืจื ืืขื: ืืืืคื ืื ืืึทืคึฟืขื ืฆื ืงืึธื ืืจืึธืืืจื ืื ืืึธืืขื ืฉืืึทื ืืื ืื ืืืื ืืืึธืงืืึทื
root@OpenWrt: cat /tmp/sysinfo/board_nameืืื ืืืื ืืืจ ืืึทืงืืืขื ืื ืขื ืืคืขืจ "ืืืืืึทืงืึทื ื", ืืืจ ืืึทืจืคึฟื ืฆื ืืึทื ืืืึทืื ืกืคึผืขืฆืืคืืฆืืจื ืื ืืืื ืืึธืืขื ืืื ืื ืคืึธืจืขื "ืจื-951-2"
ืฆื ืืึทืงืืืขื ืื ืืืื ืืึธืืขื, ืืืืคื ืื ืืึทืคึฟืขื
root@OpenWrt: cat /tmp/sysinfo/model
MikroTik RouterBOARD RB951-2ndื ืึธื ืจืืกืืืืื ื ืื ืืืื ืืึธืืขื, ืื ืกืืึทืืืจื ืขืก ืืึทื ืืืึทืื:
echo 'rb-951-2nd' > /tmp/sysinfo/board_nameื ืึธื ืืขื, ืืืจ ืงืขื ืขื ืืืืฅ ืื ืืืื ืืืจื ืื ืืืขื ืฆืืืื ื ืึธืืขืจ ื ืืฆื ืื "ืกืืกืืคึผืืจืึทืืข" ืืึทืคึฟืขื
ืฉืึทืคึฟื ืึท VPN ืกืขืจืืืขืจ ืืื WireGuard
ืืืื ืืืจ ืฉืืื ืืึธืื ืึท ืกืขืจืืืขืจ ืืื WireGuard ืงืึทื ืคืืืืขืจื, ืืืจ ืงืขื ืขื ืืึธืคึผืงืขื ืืขื ืฉืจืื.
ืืื ืืืขื ื ืืฆื ืื ืึทืคึผืืึทืงืืืฉืึทื ืฆื ืฉืืขืื ืึท ืคืขืจืืขื ืืขืืข ืืืคึผื ืกืขืจืืืขืจ ืืืขืื ืื ืงืึทืฅ ืืื ืฉืืื .
ืงืึทื ืคืืืืขืจ WireGuard ืงืืืขื ื ืืืืฃ OpenWRT
ืคืึทืจืืื ืื ืฆื ืื ืจืึทืืืขืจ ืืืจื SSH ืคึผืจืึธืืึธืงืึธื:
ssh [email protected]ืื ืกืืึทืืืจื WireGuard:
opkg update
opkg install wireguardืฆืืืจืืืื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื (ืงืึธืคึผื ืื ืงืึธื ืืื ืื ืฆื ืึท ืืขืงืข, ืคืึทืจืืืึทืื ืื ืกืคึผืขืกืืคืืขื ืืืึทืืืขืก ืืื ืืืื ืืืืืขื ืข ืืื ืืืืคื ืืื ืื ืืืึธืงืืึทื).
ืืืื ืืืจ ื ืืฆื MyVPN, ืืื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืื ืื ืืืจ ื ืึธืจ ืืึทืจืคึฟื ืฆื ืืืืฉื WG_SERV - ืกืขืจืืืืจืขืจ IP WG_KEY - ืคึผืจืืืืึทื ืฉืืืกื ืคึฟืื ืื ืืืืจืขืืืึทืจื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข ืืื WG_PUB - ืฆืืืืจ ืฉืืืกื.
WG_IF="wg0"
WG_SERV="100.0.0.0" # ip ะฐะดัะตั ัะตัะฒะตัะฐ
WG_PORT="51820" # ะฟะพัั wireguard
WG_ADDR="10.8.0.2/32" # ะดะธะฐะฟะฐะทะพะฝ ะฐะดัะตัะพะฒ wireguard
WG_KEY="xxxxx" # ะฟัะธะฒะฐัะฝัะน ะบะปัั
WG_PUB="xxxxx" # ะฟัะฑะปะธัะฝัะน ะบะปัั
# Configure firewall
uci rename firewall.@zone[0]="lan"
uci rename firewall.@zone[1]="wan"
uci rename firewall.@forwarding[0]="lan_wan"
uci del_list firewall.wan.network="${WG_IF}"
uci add_list firewall.wan.network="${WG_IF}"
uci commit firewall
/etc/init.d/firewall restart
# Configure network
uci -q delete network.${WG_IF}
uci set network.${WG_IF}="interface"
uci set network.${WG_IF}.proto="wireguard"
uci set network.${WG_IF}.private_key="${WG_KEY}"
uci add_list network.${WG_IF}.addresses="${WG_ADDR}"
# Add VPN peers
uci -q delete network.wgserver
uci set network.wgserver="wireguard_${WG_IF}"
uci set network.wgserver.public_key="${WG_PUB}"
uci set network.wgserver.preshared_key=""
uci set network.wgserver.endpoint_host="${WG_SERV}"
uci set network.wgserver.endpoint_port="${WG_PORT}"
uci set network.wgserver.route_allowed_ips="1"
uci set network.wgserver.persistent_keepalive="25"
uci add_list network.wgserver.allowed_ips="0.0.0.0/1"
uci add_list network.wgserver.allowed_ips="128.0.0.0/1"
uci add_list network.wgserver.allowed_ips="::/0"
uci commit network
/etc/init.d/network restartืืึธืก ืงืึทืืคึผืืืฅ ืื WireGuard ืกืขืืึทืคึผ! ืืืฆื ืึทืืข ืคืึทืจืงืขืจ ืืืืฃ ืึทืืข ืงืึธื ื ืขืงืืขื ืืขืืืืกืขืก ืืื ืคึผืจืึธืืขืงืืขื ืืืจื ืึท ืืืคึผื ืงืฉืจ.
ืจืขืคึฟืขืจืขื ืฆื
(ืึทืืืฉื ืึทืื ืื ืืืฆื ืื ืกืืจืึทืงืฉืึทื ื ืคึฟืึทืจ ืืึทืฉืืขืืืงื L2TP, PPTP ืืืืฃ ื ืึธืจืืึทื ืืืงืจืึธืืืง ืคืืจืืืืึทืจืข)
ืืงืืจ: www.habr.com