ืคึผืจืึธื”ืึธืกื˜ืขืจ > ื‘ืœืึธื’ > ืึทื“ืžื™ื ื™ืกื˜ืจืึทืฆื™ืข > ืึธืจื’ืึทื ื™ื–ืึทืฆื™ืข ืคื•ืŸ โ€‹โ€‹ื•ื•ื™ื™ึทื˜ ืึทืจื‘ืขื˜ ืคื•ืŸ ืึท SMB ืึธืจื’ืึทื ื™ื–ืึทืฆื™ืข ืื•ื™ืฃ OpenVPN

ืึธืจื’ืึทื ื™ื–ืึทืฆื™ืข ืคื•ืŸ โ€‹โ€‹ื•ื•ื™ื™ึทื˜ ืึทืจื‘ืขื˜ ืคื•ืŸ ืึท SMB ืึธืจื’ืึทื ื™ื–ืึทืฆื™ืข ืื•ื™ืฃ OpenVPN

ื•ื™ืกื–ืึธื’ื•ื ื’ ืคื•ืŸ ื“ื™ ืคึผืจืึธื‘ืœืขื

ื“ืขืจ ืึทืจื˜ื™ืงืœ ื‘ืืฉืจื™ื™ื‘ื˜ ื“ื™ ืึธืจื’ืึทื ื™ื–ืึทืฆื™ืข ืคื•ืŸ โ€‹โ€‹ื•ื•ื™ื™ึทื˜ ืึทืงืกืขืก ืคึฟืึทืจ ืขืžืคึผืœื•ื™ื™ื– ืื•ื™ืฃ ืึธืคึฟืŸ ืžืงื•ืจ ืคึผืจืึธื“ื•ืงื˜ืŸ ืื•ืŸ ืงืขื ืขืŸ ื–ื™ื™ืŸ ื’ืขื•ื•ื™ื™ื ื˜ ื‘ื™ื™ื“ืข ืฆื• ื‘ื•ื™ืขืŸ ืึท ื’ืึธืจ ืึธื˜ืึทื ืึทืžืึทืก ืกื™ืกื˜ืขื, ืื•ืŸ ื•ื•ืขื˜ ื–ื™ื™ืŸ ื ื•ืฆื™ืง ืคึฟืึทืจ ื™ืงืกืคึผืึทื ืฉืึทืŸ ื•ื•ืขืŸ ืขืก ืื™ื– ืึท ื“ื•ื—ืง ืคื•ืŸ ืœื™ื™ืกืึทื ืกื™ื– ืื™ืŸ ื“ื™ ื™ื’ื–ื™ืกื˜ื™ื ื’ ื’ืขืฉืขืคื˜ ืกื™ืกื˜ืขื ืึธื“ืขืจ ื“ื™ ืคืึธืจืฉื˜ืขืœื•ื ื’ ืื™ื– ื ื™ื˜ ื’ืขื ื•ื’ื™ืง.

ื“ืขืจ ืฆื™ืœ ืคื•ืŸ ื“ืขื ืึทืจื˜ื™ืงืœ ืื™ื– ืฆื• ื™ื ืกื˜ืจื•ืžืขื ื˜ ืึท ื’ืึทื ืฅ ืกื™ืกื˜ืขื ืคึฟืึทืจ ืคึผืจืึทื•ื•ื™ื™ื“ื™ื ื’ ื•ื•ื™ื™ึทื˜ ืึทืงืกืขืก ืฆื• ืึทืŸ ืึธืจื’ืึทื ื™ื–ืึทืฆื™ืข, ื•ื•ืึธืก ืื™ื– ื‘ื™ืกืœ ืžืขืจ ื•ื•ื™ "ื™ื ืกื˜ืึทืœื™ืจืŸ OpenVPN ืื™ืŸ 10 ืžื™ื ื•ื˜."

ื•ื•ื™ ืึท ืจืขื–ื•ืœื˜ืึทื˜, ืžื™ืจ ื•ื•ืขืœืŸ ื‘ืึทืงื•ืžืขืŸ ืึท ืกื™ืกื˜ืขื ืื™ืŸ ื•ื•ืึธืก ืกืขืจื˜ื™ืคื™ืงืึทืฅ ืื•ืŸ (ืึธืคึผื˜ื™ืึธื ืึทืœืœื™) ื“ื™ ืคึฟื™ืจืžืข ืึทืงื˜ื™ื•ื•ืข Directory ื•ื•ืขื˜ ื–ื™ื™ืŸ ื’ืขื ื•ืฆื˜ ืฆื• ืึธื˜ืขื ื˜ืึทืงื™ื™ื˜ ื ื™ืฆืขืจืก. ืึทื–. ืžื™ืจ ื•ื•ืขืœืŸ ื‘ืึทืงื•ืžืขืŸ ืึท ืกื™ืกื˜ืขื ืžื™ื˜ ืฆื•ื•ื™ื™ ื•ื•ืขืจืึทืคืึทืงื™ื™ืฉืึทืŸ ืกื™ื‘ื•ืช - ื•ื•ืึธืก ืื™ืš ื”ืึธื‘ืŸ (ื‘ืึทื•ื•ื™ื™ึทื–ืŸ) ืื•ืŸ ื•ื•ืึธืก ืื™ืš ื•ื•ื™ืกืŸ (ืคึผืึทืจืึธืœ).

ื ืฆื™ื™ื›ืŸ ืึทื– ืึท ื‘ืึทื ื™ืฆืขืจ ืื™ื– ืขืจืœื•ื™ื‘ื˜ ืฆื• ืคืึทืจื‘ื™ื ื“ืŸ ืื™ื– ื–ื™ื™ืขืจ ืžื™ื˜ื’ืœื™ื“ืขืจืฉืึทืคื˜ ืื™ืŸ ื“ื™ myVPNUsr ื’ืจื•ืคึผืข. ื“ื™ ืกืขืจื˜ื™ืคื™ืงืึทื˜ ืื•ื™ื˜ืึธืจื™ื˜ืขื˜ ื•ื•ืขื˜ ื–ื™ื™ืŸ ื’ืขื•ื•ื™ื™ื ื˜ ืึธืคืคืœื™ื ืข.

ื“ืขืจ ืคึผืจื™ื™ึทื– ืคื•ืŸ ื™ืžืคึผืœืึทืžืขื ื™ื ื’ ื“ื™ ืœื™ื™ื–ื•ื ื’ ืื™ื– ื‘ืœื•ื™ื– ืงืœื™ื™ืŸ ื™ื™ึทื–ื ื•ื•ืึทืจื’ ืจืขืกื•ืจืกืŸ ืื•ืŸ 1 ืฉืขื” ืคื•ืŸ ืึทืจื‘ืขื˜ ืคื•ืŸ ื“ื™ ืกื™ืกื˜ืขื ืึทื“ืžื™ื ื™ืกื˜ืจืึทื˜ืึธืจ.

ืžื™ืจ ื•ื•ืขืœืŸ ื ื•ืฆืŸ ืึท ื•ื•ื™ืจื˜ื•ืึทืœ ืžืึทืฉื™ืŸ ืžื™ื˜ OpenVPN ืื•ืŸ Easy-RSA ื•ื•ืขืจืกื™ืข 3 ืื•ื™ืฃ CetntOS 7, ื•ื•ืึธืก ืื™ื– ืึทืœืึทืงื™ื™ื˜ื™ื“ 100 ื•ื•ืงืคึผื•ืก ืื•ืŸ 4 ื’ื™ื‘ ื‘ืึทืจืึทืŸ ืคึผืขืจ 4 ืงืึทื ืขืงืฉืึทื ื–.

ืื™ืŸ ื“ืขื ื‘ื™ื™ึทืฉืคึผื™ืœ, ื“ื™ ื ืขืฅ ืคื•ืŸ ืื•ื ื“ื–ืขืจ ืึธืจื’ืึทื ื™ื–ืึทืฆื™ืข ืื™ื– 172.16.0.0/16, ืื™ืŸ ื•ื•ืึธืก ื“ื™ ื•ื•ืคึผืŸ ืกืขืจื•ื•ืขืจ ืžื™ื˜ ื“ื™ ืึทื“ืจืขืก 172.16.19.123 ืื™ื– ืœื™ื’ืŸ ืื™ืŸ ื“ื™ ืึธืคึผืฉื ื™ื˜ 172.16.19.0/24, ื“ื ืก ืกืขืจื•ื•ืขืจืก 172.16.16.16 ืื•ืŸ 172.16.17.17, 172.16.20.0. .23/XNUMX ืื™ื– ืึทืœืึทืงื™ื™ื˜ื™ื“ ืคึฟืึทืจ ื•ื•ืคึผืŸ ืงืœื™ื™ืึทื ืฅ.

ืฆื• ืคืึทืจื‘ื™ื ื“ืŸ ืคึฟื•ืŸ ืึทืจื•ื™ืก, ืึท ืคึฟืึทืจื‘ื™ื ื“ื•ื ื’ ื“ื•ืจืš ืคึผืึธืจื˜ 1194/udp ืื™ื– ื’ืขื ื™ืฆื˜, ืื•ืŸ ืึทืŸ ื-ืจืขืงืึธืจื“ gw.abc.ru ืื™ื– ื‘ืืฉืืคืŸ ื’ืขื•ื•ืืจืŸ ืื™ืŸ ื“ื™ ื“ื ืก ืคึฟืึทืจ ืื•ื ื“ื–ืขืจ ืกืขืจื•ื•ืขืจ.

ืขืก ืื™ื– ืฉื˜ืจืขื ื’ ื ื™ืฉื˜ ืจืขืงืึทืžืขื ื“ื™ื“ ืฆื• ื“ื™ืกื™ื™ื‘ืึทืœ SELinux! OpenVPN ืึทืจื‘ืขื˜ ืึธืŸ ื“ื™ืกื™ื™ื‘ืึทืœื™ื ื’ ื–ื™ื›ืขืจื”ื™ื™ื˜ ืคึผืึทืœืึทืกื™ื–.

ืฆื•ืคืจื™ื“ืŸ

  1. ื™ื™ึทื ืžืึธื ื˜ื™ืจื•ื ื’ ืคื•ืŸ ืึทืก ืื•ืŸ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ื•ื•ื™ื™ื›ื•ื•ืืจื’
  2. ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ืงืจื™ืคึผื˜ืึธื’ืจืึทืคื™
  3. ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ OpenVPN
  4. AD ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ
  5. ืกื˜ืึทืจื˜ืึทืคึผ ืื•ืŸ ื“ื™ืึทื’ื ืึธืกื˜ื™ืงืก
  6. ืกืขืจื˜ื™ืคื™ืงืึทื˜ ืึทืจื•ื™ืกื’ืขื‘ืŸ ืื•ืŸ ืจืขื•ื•ืึธืงืึทื˜ื™ืึธืŸ
  7. ื ืขืฅ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ
  8. ื•ื•ืึธืก ืก ื•ื•ื™ื™ึทื˜ืขืจ

ื™ื™ึทื ืžืึธื ื˜ื™ืจื•ื ื’ ืคื•ืŸ ืึทืก ืื•ืŸ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ื•ื•ื™ื™ื›ื•ื•ืืจื’

ืžื™ืจ ื ื•ืฆืŸ ื“ื™ CentOS 7.8.2003 ืคืึทืจืฉืคึผืจื™ื™ื˜ื•ื ื’. ืžื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ื™ื ืกื˜ืึทืœื™ืจืŸ ื“ื™ ืึทืก ืื™ืŸ ืึท ืžื™ื ื™ืžืึทืœ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ. ืขืก ืื™ื– ื‘ืึทืงื•ื•ืขื ืฆื• ื˜ืึธืŸ ื“ืึธืก ื ื™ืฆืŸ ืงื™ืงืงืกื˜ืึทืจื˜, ืงืœืึธื•ื ื™ื ื’ ืึท ืคืจื™ืขืจ ืื™ื ืกื˜ืึทืœื™ืจืŸ ืึทืก ื‘ื™ืœื“ ืื•ืŸ ืื ื“ืขืจืข ืžื™ื˜ืœ.

ื ืึธืš ื™ื ืกื˜ืึทืœื™ืจื•ื ื’, ืึทืกื™ื™ื ื™ื ื’ ืึทืŸ ืึทื“ืจืขืก ืฆื• ื“ื™ ื ืขืฅ ืฆื•ื‘ื™ื ื“ (ืœื•ื™ื˜ ื“ื™ ื˜ืขืจืžื™ื ืขืŸ ืคื•ืŸ ืึทืจื‘ืขื˜ 172.16.19.123), ืžื™ืจ ื“ืขืจื”ื™ื™ึทื ื˜ื™ืงืŸ ื“ื™ ืึทืก:

$ sudo yum update -y && reboot

ืžื™ืจ ืื•ื™ืš ื“ืึทืจืคึฟืŸ ืฆื• ืžืึทื›ืŸ ื–ื™ื›ืขืจ ืึทื– ืฆื™ื™ื˜ ืกื™ื ื’ืงืจืึทื ืึทื–ื™ื™ืฉืึทืŸ ืื™ื– ื“ื•ืจื›ื’ืขืงืึธื›ื˜ ืื•ื™ืฃ ืื•ื ื“ื–ืขืจ ืžืึทืฉื™ืŸ.
ืฆื• ื™ื ืกื˜ืึทืœื™ืจืŸ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ื•ื•ื™ื™ื›ื•ื•ืืจื’, ืื™ืจ ื“ืึทืจืคึฟืŸ ื“ื™ Openvpn, openvpn-auth-ldap, easy-rsa ืื•ืŸ vim ืคึผืึทืงืึทื“ื–ืฉืึทื– ื•ื•ื™ ื“ื™ ื”ื•ื™ืคึผื˜ ืจืขื“ืึทืงื˜ืึธืจ (ืื™ืจ ื•ื•ืขื˜ ื“ืึทืจืคึฟืŸ ื“ื™ EPEL ืจื™ืคึผืึทื–ืึทื˜ืึธืจื™).

$ sudo yum install epel-release
$ sudo yum install openvpn openvpn-auth-ldap easy-rsa vim

ืขืก ืื™ื– ื ื•ืฆื™ืง ืฆื• ื™ื ืกื˜ืึทืœื™ืจืŸ ืึท ื’ืึทืกื˜ ืึทื’ืขื ื˜ ืคึฟืึทืจ ืึท ื•ื•ื™ืจื˜ื•ืึทืœ ืžืึทืฉื™ืŸ:

$ sudo yum install open-vm-tools

ืคึฟืึทืจ VMware ESXi ืžื—ื ื•ืช, ืึธื“ืขืจ ืคึฟืึทืจ oVirt

$ sudo yum install ovirt-guest-agent

ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ืงืจื™ืคึผื˜ืึธื’ืจืึทืคื™

ื’ื™ื™ืŸ ืฆื• ื“ื™ easy-rsa ื•ื•ืขื’ื•ื•ื™ื™ึทื–ืขืจ:

$ cd /usr/share/easy-rsa/3/

ืฉืึทืคึฟืŸ ืึท ื•ื•ืขืจื™ืึทื‘ืึทืœ ื˜ืขืงืข:

$ sudo vim vars

ื“ื™ ืคืืœื’ืขื ื“ืข ืื™ื ื”ืึทืœื˜:

export KEY_COUNTRY="RU"
export KEY_PROVINCE="MyRegion"
export KEY_CITY="MyCity"
export KEY_ORG="ABC LLC"
export KEY_EMAIL="[email protected]"
export KEY_CN="allUsers"
export KEY_OU="allUsers"
export KEY_NAME="gw.abc.ru"
export KEY_ALTNAMES="abc-openvpn-server"
export EASYRSA_CERT_EXPIRE=3652

ื“ื™ ืคึผืึทืจืึทืžืขื˜ืขืจืก ืคึฟืึทืจ ื“ื™ ืงืึทื ื“ื™ืฉืึทื ืึทืœ ืึธืจื’ืึทื ื™ื–ืึทืฆื™ืข ABC LLC ื–ืขื ืขืŸ ื“ื™ืกืงืจื™ื™ื‘ื“ ื“ืึธ; ืื™ืจ ืงืขื ืขืŸ ืจื™ื›ื˜ื™ืง ื–ื™ื™ ืฆื• ื“ื™ ืคืึทืงื˜ื™ืฉ ืึธื ืขืก ืึธื“ืขืจ ืœืึธื–ืŸ ื–ื™ื™ ืคึฟื•ืŸ ื“ืขื ื‘ื™ื™ึทืฉืคึผื™ืœ. ื“ื™ ืžืขืจืกื˜ ื•ื•ื™ื›ื˜ื™ืง ื–ืึทืš ืื™ืŸ ื“ื™ ืคึผืึทืจืึทืžืขื˜ืขืจืก ืื™ื– ื“ื™ ืœืขืฆื˜ืข ืฉื•ืจื”, ื•ื•ืึธืก ื“ื™ื˜ืขืจืžืึทื ื– ื“ื™ ื’ื™ืœื˜ื™ืงื™ื™ึทื˜ ืฆื™ื™ึทื˜ ืคื•ืŸ ื“ื™ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืื™ืŸ ื˜ืขื’. ื“ืขืจ ื‘ื™ื™ืฉืคึผื™ืœ ื ื™ืฆื˜ ื“ื™ ื•ื•ืขืจื˜ 10 ื™ืืจ (365 * 10 + 2 ืฉืคึผืจื™ื ื’ืขืŸ ื™ืึธืจืŸ). ื“ืขื ื•ื•ืขืจื˜ ื•ื•ืขื˜ ื–ื™ื™ืŸ ืึทื“ื–ืฉืึทืกื˜ื™ื“ ืื™ื™ื“ืขืจ ื‘ืึทื ื™ืฆืขืจ ืกืขืจื˜ื™ืคื™ืงืึทืฅ ื–ืขื ืขืŸ ืืจื•ื™ืก.

ื“ืขืจื ืึธืš, ืžื™ืจ ืงืึทื ืคื™ื’ื™ืขืจ ืึทืŸ ืึธื˜ืึทื ืึทืžืึทืก ืกืขืจื˜ืึทืคืึทืงื™ื™ืฉืึทืŸ ืื•ื™ื˜ืึธืจื™ื˜ืขื˜.

ืกืขื˜ืึทืคึผ ื›ื•ืœืœ ืขืงืกืคึผืึธืจื˜ื™ื ื’ ื•ื•ืขืจื™ืึทื‘ืึทืœื–, ื™ื ื™ื˜ื™ืึทืœื™ื–ื™ื ื’ ื“ื™ CA, ืึทืจื•ื™ืกื’ืขื‘ืŸ ื“ื™ CA ื•ื•ืึธืจืฆืœ ืฉืœื™ืกืœ ืื•ืŸ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ, Diffie-Hellman ืฉืœื™ืกืœ, TLS ืฉืœื™ืกืœ, ืื•ืŸ ืกืขืจื•ื•ืขืจ ืฉืœื™ืกืœ ืื•ืŸ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ. ื“ื™ CA ืฉืœื™ืกืœ ืžื•ื–ืŸ ื–ื™ื™ืŸ ืงืขืจืคืึทืœื™ ืคึผืจืึธื˜ืขืงื˜ืขื“ ืื•ืŸ ื’ืขื”ืืœื˜ืŸ ืกื•ื“! ื›ืœ ืึธื ืคึฟืจืขื’ ืคึผืึทืจืึทืžืขื˜ืขืจืก ืงืขื ืขืŸ ื–ื™ื™ืŸ ืœื™ื ืงืก ื•ื•ื™ ืคืขืœื™ืงื™ื™ึทื˜.

cd /usr/share/easy-rsa/3/
. ./vars
./easyrsa init-pki
./easyrsa build-ca nopass
./easyrsa gen-dh
./easyrsa gen-req myvpngw nopass
./easyrsa sign-req server myvpngw
./easyrsa gen-crl
openvpn --genkey --secret pki/ta.key

ื“ืึธืก ืงืึทืžืคึผืœื™ืฅ ื“ื™ ื”ื•ื™ืคึผื˜ ื˜ื™ื™ืœ ืคื•ืŸ ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ื“ื™ ืงืจื™ืคึผื˜ืึธื’ืจืึทืคื™ืง ืžืขืงืึทื ื™ื–ืึทื.

ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ OpenVPN

ื’ื™ื™ืŸ ืฆื• ื“ื™ OpenVPN ื•ื•ืขื’ื•ื•ื™ื™ึทื–ืขืจ, ืฉืึทืคึฟืŸ ื“ื™ื ืกื˜ ื“ื™ืจืขืงื˜ืขืจื™ื– ืื•ืŸ ืœื™ื™ื’ืŸ ืึท ืœื™ื ืง ืฆื• easy-rsa:

cd /etc/openvpn/
mkdir /var/log/openvpn/ /etc/openvpn/ccd /usr/share/easy-rsa/3/client
ln -s /usr/share/easy-rsa/3/pki/ /etc/openvpn/

ืฉืึทืคึฟืŸ ื“ื™ ื”ื•ื™ืคึผื˜ OpenVPN ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื˜ืขืงืข:

$ sudo vim server.conf

ื•ื•ื™ื™ึทื˜ืขืจื“ื™ืง ืื™ื ื”ืึทืœื˜

port 1194
proto udp
dev tun
ca /etc/openvpn/pki/ca.crt
cert /etc/openvpn/pki/issued/myvpngw.crt
key /etc/openvpn/pki/private/myvpngw.key
crl-verify /etc/openvpn/pki/crl.pem
dh /etc/openvpn/pki/dh.pem
server 172.16.20.0 255.255.254.0
ifconfig-pool-persist ipp.txt
push "route 172.16.0.0 255.255.255.0"
push "route 172.17.0.0 255.255.255.0"
client-config-dir ccd
push "dhcp-option DNS 172.16.16.16"
push "dhcp-option DNS 172.16.17.17"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nobody
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log-append  /var/log/openvpn/openvpn.log
verb 3
explicit-exit-notify 1
username-as-common-name
plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-ldap.so /etc/openvpn/ldap.conf

ืขื˜ืœืขื›ืข ื”ืขืจื•ืช ื•ื•ืขื’ืŸ ื“ื™ ืคึผืึทืจืึทืžืขื˜ืขืจืก:

  • ืื•ื™ื‘ ืึท ืึทื ื“ืขืจืฉ ื ืึธืžืขืŸ ืื™ื– ื’ืขื•ื•ืขืŸ ืกืคึผืขืกื™ืคื™ืขื“ ื•ื•ืขืŸ ื™ืฉื•ื™ื ื’ ื“ื™ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ, ืึธื ื•ื•ื™ื™ึทื–ืŸ ืขืก;
  • ืกืคึผืขืฆื™ืคื™ืฆื™ืจืŸ ื“ื™ ื‘ืขืงืŸ ืคื•ืŸ ืึทื“ืจืขืกืขืก ืฆื• ื“ื™ื™ืŸ ื˜ืึทืกืงืก *;
  • ืขืก ืงืขื ืขืŸ ื–ื™ื™ืŸ ืื™ื™ื ืขืจ ืึธื“ืขืจ ืžืขืจ ืจื•ืฅ ืื•ืŸ ื“ื ืก ืกืขืจื•ื•ืขืจืก;
  • ื“ื™ ืœืขืฆื˜ืข 2 ืฉื•ืจื•ืช ื–ืขื ืขืŸ ื“ืืจืฃ ืฆื• ื™ื ืกื˜ืจื•ืžืขื ื˜ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื™ืŸ AD**.

* ื“ื™ ืงื™ื™ื˜ ืคื•ืŸ ืึทื“ืจืขืกืขืก ืื•ื™ืกื’ืขืงืœื™ื‘ืŸ ืื™ืŸ ื“ืขื ื‘ื™ื™ึทืฉืคึผื™ืœ ื•ื•ืขื˜ ืœืึธื–ืŸ ืึทืจื•ื™ืฃ ืฆื• 127 ืงืœื™ื™ืึทื ืฅ ืฆื• ืคืึทืจื‘ื™ื ื“ืŸ ืกื™ื™ืžืึทืœื˜ื™ื™ื ื™ืึทืกืœื™ ื•ื•ื™ื™ึทืœ ื“ื™ / 23 ื ืขืฅ ืื™ื– ืื•ื™ืกื’ืขืงืœื™ื‘ืŸ, ืื•ืŸ OpenVPN ืงืจื™ื™ื™ืฅ ืึท ืกื•ื‘ื ืขื˜ ืคึฟืึทืจ ื™ืขื“ืขืจ ืงืœื™ืขื ื˜ ื ื™ืฆืŸ ื“ื™ / 30 ืžืึทืกืงืข.
ืื•ื™ื‘ ืกืคึผืขืฆื™ืขืœ ื ื•ื™ื˜ื™ืง, ื“ื™ ืคึผืึธืจื˜ ืื•ืŸ ืคึผืจืึธื˜ืึธืงืึธืœ ืงืขื ืขืŸ ื–ื™ื™ืŸ ื˜ืฉื™ื™ื ื“ื–ืฉื“, ืึธื‘ืขืจ, ืขืก ื–ืึธืœ ื–ื™ื™ืŸ ื’ืขื˜ืจืื’ืŸ ืื•ื™ืก ืึทื– ื˜ืฉืึทื ื’ื™ื ื’ ื“ื™ ืคึผืึธืจื˜ ืคึผืึธืจื˜ ื ื•ืžืขืจ ื•ื•ืขื˜ ื–ื™ื™ืŸ ืงืึทื ืคื™ื’ื™ืขืจื“ SELinux, ืื•ืŸ ื“ื™ ื ื•ืฆืŸ ืคื•ืŸ ื“ื™ tcp ืคึผืจืึธื˜ืึธืงืึธืœ ื•ื•ืขื˜ ืคืึทืจื’ืจืขืกืขืจืŸ ืึธื•ื•ื•ืขืจื›ืขื“, ื•ื•ื™ื™ึทืœ TCP ืคึผืึทืงืึทื˜ ืขืงืกืคึผืจืขืก ืงืึธื ื˜ืจืึธืœ ืื™ื– ืฉื•ื™ืŸ ื“ื•ืจื›ื’ืขืงืึธื›ื˜ ืื™ืŸ ื“ืขืจ ืžื“ืจื’ื” ืคื•ืŸ ืคึผืึทืงื™ืฅ ืขื ืงืึทืคึผืกืึทืœื™ื™ื˜ื™ื“ ืื™ืŸ ื“ืขื ื˜ื•ื ืขืœ.

** ืื•ื™ื‘ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืื™ืŸ AD ืื™ื– ื ื™ื˜ ื“ืืจืฃ, ื‘ืึทืžืขืจืงืŸ ื–ื™ื™, ื”ืึธืคึผืงืขืŸ ื“ื™ ื•ื•ื™ื™ึทื˜ืขืจ ืึธืคึผื˜ื™ื™ืœื•ื ื’ ืื•ืŸ ืื™ืŸ ื“ื™ ืžื•ืกื˜ืขืจ ืึทืจืึธืคึผื ืขืžืขืŸ ื“ื™ ืึทื•ื˜-ื‘ืึทื ื™ืฆืขืจ-ืคึผืึทืก ืฉื•ืจื”.

AD ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ

ืฆื• ืฉื˜ื™ืฆืŸ ื“ื™ ืจื’ืข ืคืึทืงื˜ืึธืจ, ืžื™ืจ ื•ื•ืขืœืŸ ื ื•ืฆืŸ ื—ืฉื‘ื•ืŸ ื•ื•ืขืจืึทืคืึทืงื™ื™ืฉืึทืŸ ืื™ืŸ AD.

ืžื™ืจ ื“ืึทืจืคึฟืŸ ืึท ื—ืฉื‘ื•ืŸ ืื™ืŸ ื“ื™ ืคืขืœื“ ืžื™ื˜ ื“ื™ ืจืขื›ื˜ ืคื•ืŸ ืึท ืคึผืจืึธืกื˜ ื‘ืึทื ื™ืฆืขืจ ืื•ืŸ ืึท ื’ืจื•ืคึผืข, ืžื™ื˜ื’ืœื™ื“ืขืจืฉืึทืคื˜ ืื™ืŸ ื•ื•ืึธืก ื•ื•ืขื˜ ื‘ืึทืฉืœื™ืกืŸ ื“ื™ ืคื™ื™ื™ืงื™ื™ึทื˜ ืฆื• ืคืึทืจื‘ื™ื ื“ืŸ.

ืฉืึทืคึฟืŸ ืึท ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ื˜ืขืงืข:

/etc/openvpn/ldap.conf

ื•ื•ื™ื™ึทื˜ืขืจื“ื™ืง ืื™ื ื”ืึทืœื˜

<LDAP>
        URL             "ldap://ldap.abc.ru"
        BindDN          "CN=bindUsr,CN=Users,DC=abc,DC=ru"
        Password        b1ndP@SS
        Timeout         15
        TLSEnable       no
        FollowReferrals yes
</LDAP>
<Authorization>
        BaseDN          "OU=allUsr,DC=abc,DC=ru"
        SearchFilter    "(sAMAccountName=%u)"
        RequireGroup    true
        <Group>
                BaseDN          "OU=myGrp,DC=abc,DC=ru"
                SearchFilter    "(cn=myVPNUsr)"
                MemberAttribute "member"
        </Group>
</Authorization>

ืฉืœื™ืกืœ ืคึผืึทืจืึทืžืขื˜ืขืจืก:

  • URL "ldap://ldap.abc.ru" - ืคืขืœื“ ืงืึธื ื˜ืจืึธืœืœืขืจ ืึทื“ืจืขืก;
  • BindDN "CN=bindUsr,CN=Users,DC=abc,DC=ru" - ืงืึทื ืึธื ื™ืงืึทืœ ื ืึธืžืขืŸ ืคึฟืึทืจ ื‘ื™ื™ื ื“ื™ื ื’ ืฆื• LDAP (UZ - bindUsr ืื™ืŸ ื“ื™ abc.ru/Users ืงืึทื ื˜ื™ื™ื ืขืจ);
  • ืฉืคึผืจื™ื›ื•ื•ืึธืจื˜ b1ndP@SS โ€” ื‘ืึทื ื™ืฆืขืจ ืคึผืึทืจืึธืœ ืคึฟืึทืจ ื‘ื™ื™ื ื“ื™ื ื’;
  • BaseDN "OU = allUsr, DC = abc, DC = ru" - ื“ืขืจ ื“ืจืš ืคื•ืŸ ื•ื•ืึธืก ืฆื• ืึธื ื”ื™ื™ื‘ืŸ ื–ื•ื›ืŸ ืคึฟืึทืจ ื“ื™ ื‘ืึทื ื™ืฆืขืจ;
  • BaseDN "OU = myGrp, DC = abc, DC = ru" - ืงืึทื ื˜ื™ื™ื ืขืจ ืคื•ืŸ ื“ื™ ืึทืœืึทื•ื™ื ื’ ื’ืจื•ืคึผืข (ื’ืจื•ืคึผืข myVPNUsr ืื™ืŸ ื“ืขื ืงืึทื ื˜ื™ื™ื ืขืจ abc.rumyGrp);
  • SearchFilter "(cn = myVPNUsr)" ืื™ื– ื“ืขืจ ื ืึธืžืขืŸ ืคื•ืŸ ื“ื™ ืึทืœืึทื•ื™ื ื’ ื’ืจื•ืคึผืข.

ืกื˜ืึทืจื˜ืึทืคึผ ืื•ืŸ ื“ื™ืึทื’ื ืึธืกื˜ื™ืงืก

ืื™ืฆื˜ ืžื™ืจ ืงืขื ืขืŸ ืคึผืจื•ื‘ื™ืจืŸ ืฆื• ื’ืขื‘ืŸ ืื•ืŸ ืึธื ื”ื™ื™ื‘ืŸ ืื•ื ื“ื–ืขืจ ืกืขืจื•ื•ืขืจ:

$ sudo systemctl enable [email protected]
$ sudo systemctl start [email protected]

ืกื˜ืึทืจื˜ืึทืคึผ ื˜ืฉืขืง:

systemctl status [email protected]
journalctl -xe
cat /var/log/messages
cat /var/log/openvpn/*log

ืกืขืจื˜ื™ืคื™ืงืึทื˜ ืึทืจื•ื™ืกื’ืขื‘ืŸ ืื•ืŸ ืจืขื•ื•ืึธืงืึทื˜ื™ืึธืŸ

ื•ื•ื™ื™ึทืœ ืื™ืŸ ืึทื“ื™ืฉืึทืŸ ืฆื• ื“ื™ ืกืขืจื˜ื™ืคื™ืงืึทืฅ ื–ื™ืš, ืื™ืจ ื“ืึทืจืคึฟืŸ ืฉืœื™ืกืœืขืŸ ืื•ืŸ ืื ื“ืขืจืข ืกืขื˜ื˜ื™ื ื’ืก; ืขืก ืื™ื– ื–ื™ื™ืขืจ ื‘ืึทืงื•ื•ืขื ืฆื• ื™ื™ึทื ื•ื•ื™ืงืœืขืŸ ืึทืœืข ื“ืขื ืื™ืŸ ืื™ื™ืŸ ืคึผืจืึธืคื™ืœ ื˜ืขืงืข. ื“ืขืจ ื˜ืขืงืข ืื™ื– ื˜ืจืึทื ืกืคืขืจื“ ืฆื• ื“ืขืจ ื‘ืึทื ื™ืฆืขืจ ืื•ืŸ ื“ืขืจ ืคึผืจืึธืคื™ืœ ืื™ื– ื™ืžืคึผืึธืจื˜ื™ื“ ืื•ื™ืฃ ื“ื™ OpenVPN ืงืœื™ืขื ื˜. ืฆื• ื˜ืึธืŸ ื“ืึธืก, ืžื™ืจ ื•ื•ืขืœืŸ ืžืึทื›ืŸ ืึท ืกืขื˜ื˜ื™ื ื’ืก ืžื•ืกื˜ืขืจ ืื•ืŸ ืึท ืฉืจื™ืคื˜ ื•ื•ืึธืก ื“ื–ืฉืขื ืขืจื™ื™ืฅ ื“ืขื ืคึผืจืึธืคื™ืœ.

ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ืœื™ื™ื’ืŸ ื“ื™ ืื™ื ื”ืึทืœื˜ ืคื•ืŸ ื“ื™ ื•ื•ืึธืจืฆืœ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ (ca.crt) ืื•ืŸ TLS key (ta.key) ื˜ืขืงืขืก ืฆื• ื“ืขื ืคึผืจืึธืคื™ืœ.

ืื™ื™ื“ืขืจ ืืจื•ื™ืกื’ืขื‘ืŸ ื‘ืึทื ื™ืฆืขืจ ืกืขืจื˜ื™ืคื™ืงืึทืฅ ื˜ืึธืŸ ื ื™ื˜ ืคืึทืจื’ืขืกืŸ ืฆื• ืฉื˜ืขืœืŸ ื“ื™ ืคืืจืœืื ื’ื˜ ื’ื™ืœื˜ื™ืงื™ื™ึทื˜ ืฆื™ื™ึทื˜ ืคึฟืึทืจ ืกืขืจื˜ื™ืคื™ืงืึทืฅ ืื™ืŸ ื“ื™ ืคึผืึทืจืึทืžืขื˜ืขืจืก ื˜ืขืงืข. ืื™ืจ ื–ืึธืœ ื ื™ืฉื˜ ืžืึทื›ืŸ ืขืก ืฆื• ืœืึทื ื’; ืื™ืš ืจืขืงืึธืžืขื ื“ื™ืจืŸ ืœื™ืžื™ื˜ืขื“ ื–ื™ืš ืฆื• ืึท ืžืึทืงืกื™ืžื•ื ืคื•ืŸ 180 ื˜ืขื’.

vim /usr/share/easy-rsa/3/vars

...
export EASYRSA_CERT_EXPIRE=180


vim /usr/share/easy-rsa/3/client/template.ovpn

client
dev tun
proto udp
remote gw.abc.ru 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-CBC
verb 3
auth-user-pass

<ca>
-----BEGIN CERTIFICATE-----
PUT YOUR CA CERT (ca.crt) HERE
-----END CERTIFICATE-----
</ca>

key-direction 1
<tls-auth>
-----BEGIN OpenVPN Static key V1-----
PUT YOUR TA KEY (ta.key) HERE
-----END OpenVPN Static key V1-----
</tls-auth>

ื”ืขืจื•ืช:

  • ืฉื•ืจื•ืช ืฉื˜ืขืœืŸ ื“ื™ื™ืŸ ... ื˜ื•ื™ืฉืŸ ืฆื• ืื™ื ื”ืึทืœื˜ ื–ื™ื™ืขืจ ืกืขืจื˜ื™ืคื™ืงืึทืฅ;
  • ืื™ืŸ ื“ื™ ื•ื•ื™ื™ึทื˜ ื“ื™ืจืขืงื˜ื™ื•ื•, ืกืคึผืขืฆื™ืคื™ืฆื™ืจืŸ ื“ื™ ื ืึธืžืขืŸ / ืึทื“ืจืขืก ืคื•ืŸ ื“ื™ื™ืŸ ื’ื™ื™ื˜ื•ื•ื™ื™;
  • ื“ื™ ืึทื•ื˜-ื‘ืึทื ื™ืฆืขืจ-ืคึผืึทืก ื“ื™ืจืขืงื˜ื™ื•ื• ืื™ื– ื’ืขื ื™ืฆื˜ ืคึฟืึทืจ ื ืึธืš ืคื•ื ื“ืจื•ื™ืกื ื“ื™ืง ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ.

ืื™ืŸ ื“ื™ ื”ื™ื™ื ื•ื•ืขื’ื•ื•ื™ื™ึทื–ืขืจ (ืึธื“ืขืจ ืื ื“ืขืจืข ื‘ืึทืงื•ื•ืขื ืึธืจื˜) ืžื™ืจ ืžืึทื›ืŸ ืึท ืฉืจื™ืคื˜ ืคึฟืึทืจ ืจื™ืงื•ื•ืขืกื˜ื™ื ื’ ืึท ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืื•ืŸ ืฉืึทืคึฟืŸ ืึท ืคึผืจืึธืคื™ืœ:

vim ~/make.profile.sh

#!/bin/bash

if [ -z "$1" ] ; then
 echo Missing mandatory client name. Usage: $0 vpn-username
 exit 1
fi

#Set variables
basepath=/usr/share/easy-rsa/3
clntpath=$basepath/client
privpath=$basepath/pki/private
certpath=$basepath/pki/issued
profile=$clntpath/$1.ovpn

#Get current year and lowercase client name
year=`date +%F`
client=${1,,}
echo Processing $year year cert for user/device $client

cd $basepath

if [  -f client/$client* ]; then
    echo "*** ERROR! ***"
    echo "Certificate $client already issued!"
    echo "*** ERROR! ***"
    exit 1
fi

. ./vars
./easyrsa --batch --req-cn=$client gen-req $client nopass
./easyrsa --batch sign-req client $client

#Make profile
cp $clntpath/template.ovpn $profile

echo "<key>" >> $profile
cat $privpath/$1.key >> $profile
echo "</key>" >> $profile

echo -e "n" >> $profile
openssl x509 -in $certpath/$1.crt -out $basepath/$1.crt

echo "<cert>" >> $profile
cat $basepath/$1.crt >> $profile
echo "</cert>" >> $profile
echo -e "n" >> $profile

#remove tmp file
rm -f $basepath/$1.crt

echo Complete. See $profile file.

cd ~

ืžืึทื›ืŸ ื“ื™ ื˜ืขืงืข ืขืงืกืขืงื•ื˜ืึทื‘ืœืข:

chmod a+x ~/make.profile.sh

ืื•ืŸ ืžื™ืจ ืงืขื ืขืŸ ืึทืจื•ื™ืกื’ืขื‘ืŸ ืื•ื ื“ื–ืขืจ ืขืจืฉื˜ืขืจ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ.

~/make.profile.sh my-first-user

ื‘ืึทืžืขืจืงื•ื ื’ืขืŸ

ืื™ืŸ ืคืึทืœ ืคื•ืŸ ืงืึธืžืคึผืจืึธืžื™ืก ืคื•ืŸ ืึท ื‘ืึทื•ื•ื™ื™ึทื–ืŸ (ืึธื ื•ื•ืขืจ, ื’ื ื™ื™ื•ื•ืข), ืขืก ืื™ื– ื ื™ื™ื˜ื™ืง ืฆื• ืึธืคึผืจื•ืคืŸ ื“ืขื ื‘ืึทื•ื•ื™ื™ึทื–ืŸ:

cd /usr/share/easy-rsa/3/
./easyrsa revoke my-first-user
./easyrsa gen-crl

ืงื•ืง ืืจื•ื™ืก ืื•ืŸ ืจื™ื•ื•ืึธื•ืงื˜ ืกืขืจื˜ื™ืคื™ืงืึทืฅ

ืฆื• ื–ืขืŸ ืืจื•ื™ืก ืื•ืŸ ืจื™ื•ื•ืึธื•ืงื˜ ืกืขืจื˜ื™ืคื™ืงืึทืฅ, ืคืฉื•ื˜ ืงื•ืง ื“ื™ ืื™ื ื“ืขืงืก ื˜ืขืงืข:

cd /usr/share/easy-rsa/3/
cat pki/index.txt

ื“ืขืจืงืœืขืจื•ื ื’ืขืŸ:

  • ื“ืขืจ ืขืจืฉื˜ืขืจ ืฉื•ืจื” ืื™ื– ื“ื™ ืกืขืจื•ื•ืขืจ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ;
  • ืขืจืฉื˜ืขืจ ื›ืึทืจืึทืงื˜ืขืจ
    • V (ื•ื•ืึทืœื™ื“) - ื’ื™ืœื˜ื™ืง;
    • ืจ (ืจืขื•ื•ืึธืงืขื“) - ืจื™ืงืึธืœื“.

ื ืขืฅ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ

ื“ื™ ืœืขืฆื˜ืข ืกื˜ืขืคึผืก ื–ืขื ืขืŸ ืฆื• ืงืึทื ืคื™ื’ื™ืขืจ ื“ื™ ื˜ืจืึทื ืกืžื™ืกื™ืข ื ืขืฅ - ืจื•ื˜ื™ื ื’ ืื•ืŸ ืคื™ืจืขื•ื•ืึทืœืœืก.

ืึทืœืึทื•ื™ื ื’ ืงืึทื ืขืงืฉืึทื ื– ืื™ืŸ ื“ื™ ื”ื™ื’ืข ืคื™ื™ืจื•ื•ืึทืœ:

$ sudo firewall-cmd --add-service=openvpn
$ sudo firewall-cmd --add-service=openvpn --permanent

ื“ืขืจื ืึธืš, ื’ืขื‘ืŸ IP ืคืึทืจืงืขืจ ืจื•ื˜ื™ื ื’:

$ sudo sysctl net.ipv4.ip_forward=1
$ sudo echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/50-sysctl.conf

ืื™ืŸ ืึท ืคึฟื™ืจืžืข ืกื•ื•ื™ื•ื•ืข, ืขืก ืื™ื– ืžืกืชึผืžื ืฆื• ื–ื™ื™ืŸ ืกื•ื‘ื ืขื˜ื˜ื™ื ื’ ืื•ืŸ ืžื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ื–ืึธื’ืŸ ื“ื™ ืจืึทื•ื˜ืขืจ (s) ื•ื•ื™ ืฆื• ืฉื™ืงืŸ ืคึผืึทืงื™ืฅ ื‘ืึทืฉืขืจื˜ ืคึฟืึทืจ ืื•ื ื“ื–ืขืจ ื•ื•ืคึผืŸ ืงืœื™ื™ืึทื ืฅ. ืื•ื™ืฃ ื“ื™ ื‘ืึทืคึฟืขืœืŸ ืฉื•ืจื” ืžื™ืจ ื•ื™ืกืคื™ืจืŸ ื“ืขื ื‘ืึทืคึฟืขืœ ืื™ืŸ ื“ืขื ืฉื˜ื™ื™ื’ืขืจ (ื“ื™ืคึผืขื ื“ื™ื ื’ ืื•ื™ืฃ ื“ื™ ืขืงื•ื•ื™ืคึผืžืขื ื˜ ื’ืขื ื™ืฆื˜):

# ip route 172.16.20.0 255.255.254.0 172.16.19.123

ืื•ืŸ ืจืึทื˜ืขื•ื•ืขืŸ ื“ื™ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ.

ืื™ืŸ ืึทื“ื™ืฉืึทืŸ, ืื•ื™ืฃ ื“ื™ ื’ืจืขื ืขืฅ ืจืึทื•ื˜ืขืจ ืฆื•ื‘ื™ื ื“ ื•ื•ื• ื“ื™ ืคื•ื ื“ืจื•ื™ืกื ื“ื™ืง ืึทื“ืจืขืก gw.abc.ru ืื™ื– ื’ืขื“ื™ื ื˜, ืขืก ืื™ื– ื ื™ื™ื˜ื™ืง ืฆื• ืœืึธื–ืŸ ื“ื™ ื“ื•ืจื›ืคืึธืจ ืคื•ืŸ ื•ื“ืคึผ/1194 ืคึผืึทืงื™ืฅ.

ืื™ืŸ ืคืึทืœ ื“ื™ ืึธืจื’ืึทื ื™ื–ืึทืฆื™ืข ื”ืื˜ ืฉื˜ืจืขื ื’ ื–ื™ื›ืขืจื”ื™ื™ื˜ ื›ึผืœืœื™ื, ืึท ืคื™ื™ืจื•ื•ืึทืœ ืžื•ื–ืŸ ืื•ื™ืš ื–ื™ื™ืŸ ืงืึทื ืคื™ื’ื™ืขืจื“ ืื•ื™ืฃ ืื•ื ื“ื–ืขืจ ื•ื•ืคึผืŸ ืกืขืจื•ื•ืขืจ. ืื™ืŸ ืžื™ื™ืŸ ืžื™ื™ื ื•ื ื’, ื“ื™ ื‘ื™ื’ืึทืกื˜ ื‘ื™ื™ื’ื™ืงื™ื™ึทื˜ ืื™ื– ืฆื•ื’ืขืฉื˜ืขืœื˜ ื“ื•ืจืš ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ื“ื™ Iptables FORWARD ืงื™ื™ื˜ืŸ, ื›ืึธื˜ืฉ ืขืก ืื™ื– ื•ื•ื™ื™ื ื™ืงืขืจ ื‘ืึทืงื•ื•ืขื ืฆื• ืฉื˜ืขืœืŸ ื–ื™ื™. ื ื‘ื™ืกืœ ืžืขืจ ื•ื•ืขื’ืŸ ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ื–ื™ื™. ืฆื• ื˜ืึธืŸ ื“ืึธืก, ืขืก ืื™ื– ืžืขืจืกื˜ ื‘ืึทืงื•ื•ืขื ืฆื• ื ื•ืฆืŸ "ื“ื™ืจืขืงื˜ ื›ึผืœืœื™ื" - ื“ื™ืจืขืงื˜ ื›ึผืœืœื™ื, ืกื˜ืึธืจื“ ืื™ืŸ ืึท ื˜ืขืงืข /etc/firewalld/direct.xml. ื“ื™ ืงืจืึทื ื˜ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ืคื•ืŸ ื“ื™ ื›ึผืœืœื™ื ืงืขื ืขืŸ ื–ื™ื™ืŸ ื’ืขืคึฟื•ื ืขืŸ ื•ื•ื™ ื’ื™ื™ื˜:

$ sudo firewall-cmd --direct --get-all-rule

ืื™ื™ื“ืขืจ ื˜ืฉืึทื ื’ื™ื ื’ ืึท ื˜ืขืงืข, ืžืึทื›ืŸ ืึท ื‘ืึทืงืึทืคึผ ืงืึธืคึผื™ืข ืคื•ืŸ โ€‹โ€‹โ€‹โ€‹ืขืก:

cp /etc/firewalld/direct.xml /etc/firewalld/direct.xml.`date +%F.%T`.bak

ื“ื™ ื“ืขืจื ืขื ื˜ืขืจื  ืื™ื ื”ืึทืœื˜ ืคื•ืŸ ื“ื™ ื˜ืขืงืข ืื™ื–:

<?xml version="1.0" encoding="utf-8"?>
<direct>
 <!--Common Remote Services-->
  <!--DNS-->
    <rule priority="0" table="filter" ipv="ipv4" chain="FORWARD">-i tun0 -o ens192 -p udp --dport 53 -j ACCEPT</rule>
  <!--web-->
    <rule priority="0" table="filter" ipv="ipv4" chain="FORWARD">-i tun0 -o eth0 -p tcp -d 172.16.19.200 --dport 80 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT</rule>
    <rule priority="0" table="filter" ipv="ipv4" chain="FORWARD">-i tun0 -o eth0 -p tcp -d 172.16.19.201 --dport 443 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT</rule>
  <!--Some Other Systems-->
    <rule priority="0" table="filter" ipv="ipv4" chain="FORWARD">-i tun0 -o eth0 -p udp -d 172.16.19.100 --dport 7000 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT</rule>
  <!--just logging-->
    <rule priority="1" table="filter" ipv="ipv4" chain="FORWARD">-i tun0 -o eth0 -j LOG --log-prefix 'forward_fw '</rule>
</direct>

ื“ืขืจืงืœืขืจื•ื ื’ืขืŸ

ื“ืึธืก ื–ืขื ืขืŸ ื‘ื™ื™ืกื™ืงืœื™ ืจืขื’ื•ืœืขืจ ื™ืคึผื˜ืึทื‘ืœืขืก ื›ึผืœืœื™ื, ื“ื™ืคืขืจืขื ื˜ืœื™ ืคึผืึทืงื™ื“ื–ืฉื“ ื ืึธืš ื“ื™ ืึทื“ื•ื•ืขื ื˜ ืคื•ืŸ Firewalld.

ื“ื™ ื“ืขืกื˜ื™ื ื™ื™ืฉืึทืŸ ืฆื•ื‘ื™ื ื“ ืžื™ื˜ ืคืขืœื™ืงื™ื™ึทื˜ ืกืขื˜ื˜ื™ื ื’ืก ืื™ื– tun0, ืื•ืŸ ื“ื™ ืคื•ื ื“ืจื•ื™ืกื ื“ื™ืง ืฆื•ื‘ื™ื ื“ ืคึฟืึทืจ ื“ืขื ื˜ื•ื ืขืœ ืงืขืŸ ื–ื™ื™ืŸ ืึทื ื“ืขืจืฉ, ืœืžืฉืœ, ens192, ื“ื™ืคึผืขื ื“ื™ื ื’ ืื•ื™ืฃ ื“ื™ ื’ืขื•ื•ื™ื™ื ื˜ ืคึผืœืึทื˜ืคืึธืจืžืข.

ื“ื™ ืœืขืฆื˜ืข ืฉื•ืจื” ืื™ื– ืคึฟืึทืจ ืœืึธื’ื™ื ื’ ื“ืจืึทืคึผื˜ ืคึผืึทืงื™ืฅ. ืคึฟืึทืจ ืœืึธื’ื™ื ื’ ืฆื• ืึทืจื‘ืขื˜ืŸ, ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ื˜ื•ื™ืฉืŸ ื“ื™ ื“ื™ื‘ืึทื’ ืžื“ืจื’ื” ืื™ืŸ ื“ื™ ืคื™ื™ืจื•ื•ืึทืœื“ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ:

vim /etc/sysconfig/firewalld
FIREWALLD_ARGS=--debug=2

ืึทืคึผืœื™ื™ื™ื ื’ ืกืขื˜ื˜ื™ื ื’ืก ืื™ื– ื“ื™ ื’ืขื•ื•ื™ื™ื ื˜ืœืขืš ืคื™ื™ืจื•ื•ืึทืœื“ ื‘ืึทืคึฟืขืœ ืฆื• ืฉื™ื™ึทืขืš-ืœื™ื™ืขื ืขืŸ ื“ื™ ืกืขื˜ื˜ื™ื ื’ืก:

$ sudo firewall-cmd --reload

ืื™ืจ ืงืขื ืขืŸ ื–ืขืŸ ื“ืจืึทืคึผื˜ ืคึผืึทืงื™ืฅ ื•ื•ื™ ื“ืึธืก:

grep forward_fw /var/log/messages

ื•ื•ืึธืก ืก ื•ื•ื™ื™ึทื˜ืขืจ

ื“ืึธืก ืงืึทืžืคึผืœื™ืฅ ื“ื™ ืกืขื˜ืึทืคึผ!

ืึทืœืข ื•ื•ืึธืก ื‘ืœื™ื™ื‘ื˜ ืื™ื– ืฆื• ื™ื ืกื˜ืึทืœื™ืจืŸ ื“ื™ ืงืœื™ืขื ื˜ ื•ื•ื™ื™ื›ื•ื•ืืจื’ ืื•ื™ืฃ ื“ื™ ืงืœื™ืขื ื˜ ื–ื™ื™ึทื˜, ืึทืจื™ื™ึทื ืคื™ืจ ื“ืขื ืคึผืจืึธืคื™ืœ ืื•ืŸ ืคืึทืจื‘ื™ื ื“ืŸ. ืคึฟืึทืจ Windows ืึธืคึผืขืจื™ื™ื˜ื™ื ื’ ืกื™ืกื˜ืขืžืขืŸ, ื“ื™ ืคืึทืจืฉืคึผืจื™ื™ื˜ื•ื ื’ ื™ื ื•ื•ืขื ื˜ืึทืจ ืื™ื– ืœื™ื’ืŸ ืื•ื™ืฃ ื“ืขื•ื•ืขืœืึธืคึผืขืจ ื•ื•ืขื‘ื–ื™ื™ึทื˜ืœ.

ืฆื•ื ืกื•ืฃ, ืžื™ืจ ืคืึทืจื‘ื™ื ื“ืŸ ืื•ื ื“ื–ืขืจ ื ื™ื™ึท ืกืขืจื•ื•ืขืจ ืฆื• ื“ื™ ืžืึธื ื™ื˜ืึธืจื™ื ื’ ืื•ืŸ ืึทืจื˜ืฉื™ื•ื•ื™ื ื’ ืกื™ืกื˜ืขืžืขืŸ, ืื•ืŸ ื˜ืึธืŸ ื ื™ื˜ ืคืึทืจื’ืขืกืŸ ืฆื• ืงืขืกื™ื™ื“ืขืจ ื™ื ืกื˜ืึทืœื™ืจืŸ ื“ืขืจื”ื™ื™ึทื ื˜ื™ืงื•ื ื’ืขืŸ.

ืกื˜ืึทื‘ื™ืœ ืงืฉืจ!

ืžืงื•ืจ: www.habr.com

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’