ืืื ืืืึธืื ืืื ืฆื ืืืืื ืืืื ืืขืจืคืึทืจืื ื ืคืื ืงืึทืืืืื ืื ื ื ืขืืืืึธืจืงืก ืืื ืืจืื ืืืฉืืึทืืจืึทืคืืงืื ืืืืึทื ืึทืคึผืึทืจืืืึทื ืฅ, ืืขืืขืจ ืคืื ืืืึธืก ื ืืฆื ืจืึธืืืขืจืก ืืื OpenWRT ืืื ืึท ืืืืืืืื, ืืื ืืืื ืคึผืจืึธืกื ื ืขืฅ. ืืืขื ืืฉืืืื ื ืึท ืืืคึฟื ืคึฟืึทืจ ืงืึทืืืืื ืื ื ื ืขืืืืึธืจืงืก ืฆืืืืฉื L3 ืืื ืกืืื ืขื ืจืืืื ื ืืื L2 ืืื ืืจืืืืฉืื ื, ืืืขื ืึทืืข ื ืขืฅ ื ืึธืืื ืืืขื ืืืื ืืื ืืขืจ ืืขืืืืงืขืจ ืกืืื ืขื, ืืืืขืจืืึทื ื ืืื ืืขืืขืื ืฆื ืื ืจืืข ืืืคึฟื, ืืืึธืก ืืื ืืขืจ ืฉืืืขืจ ืฆื ืงืึทื ืคืืืืขืจ, ืึธืืขืจ ืืื ืืจืขืกืขืจืข ืึทืคึผืขืจืืื ืึทืืื, ืืื ื ืื ืืจืึทื ืกืคึผืขืจืึทื ื ื ืืฆื ืคืื ืืขืงื ืึทืืึทืืืฉืื ืืื ืืขืืืขื ืคึผืืึทื ื ืขื ืืื ืื ื ืขืฅ ืืืึธืก ืืื ืืืฉืืคื Wake-on-Lan ืืื DLNA.
ืืืื 1: ืืื ืืขืจืืจืื ื
ืืขืจ ืคึผืจืึธืืึธืงืึธื ืืืืกืืขืงืืืื ืฆื ืืืจืืคืืจื ืื ืืึธืืืงืข ืืืืคืืึทืืข ืืื ืืขืืืขื ืึธื ืืืื OpenVPN, ืืืืื, ืขืจืฉืื ืก, ืงืขื ืขืก ืฉืึทืคึฟื ืึท ืฆืึทืคึผื-ืึทืคึผืึทืจืึทื ืืืึธืก ืืขื ืงืขื ืฆืืืืืื ืฆืื ืืจืืง ืึธื ืงืืื ืคึผืจืึธืืืขืืขื, ืืื ืฆืืืืืื ืก, OpenVPN ืขืก ืฉืืืฆื TCP, ืืืึธืก ืืื ืืืื ืืขืืืขื ืืืืืืืง, ืืืืื ืงืืื ืืืื ืข ืคืื โโืื ืืืจืืช ืืื ื ืืฉื ืืขืืื ืงืืื ืืึทืืื ืืขืจืข IP ืึทืืจืขืก. ืืื ืงืขื ื ืืฉื ื ืืฆื STUN ืืืืื ืืืื ISP, ืคึฟืึทืจ ืขืคืขืก ืึท ืกืืื, ืืืึธืงืืจื ืึทืจืฒึทื ืงืืืขื ืืืงืข UDP ืคึฟืึทืจืืื ืืื ืืขื ืคึฟืื ืืืจืข ื ืขืืืืึธืจืงืก. TCP ืืึธื ืืืจ ืืขืจืืืืื ืฆื ืคึฟืึธืจืืืขืจืื ืืขื VPN ืกืขืจืืืขืจ ืคึผืึธืจื ืฆืื ืืขืืื ืืขื ืขื VPS ื ืืฆื ืืืง SSH. ืืึธืืฉ ืืขืจ ืฆืืืึทื ื ืฉืึทืคึฟื ืึท ืืึทืืฒึทืื ืืืงื ืึธืืืืขืจืืขื, ืืืืื ืื ืืึทืื ืืขื ืขื ืืึธืคึผืื-ืขื ืงืจืืคึผืืขื, ืืึธื ืืื ื ืืฉื ืืขืืืึธืื ืืื ืืขืืจืืจื ืืขื VPS ืืื ืืืื ืคึผืจืืืืึทืื ื ืขืืืืึธืจืง, ืืืืื ืขืก ืืื ืืขืืืขื ืึท ืจืืืืงืข ืึทื ืืจืืืข ืคึผืึทืจืืืืขื ืืึธืื ืืึทืงืืืขื ืงืึธื ืืจืึธื ืืืืขืจ ืืื. ืืขืจืืืขืจ, ืืึธืื ืึทืืึท ืึท ืืืื ืืืืฃ ืืืื ืืืื ื ืขืืืืึธืจืง ืืื ืืขืืืขื ืืืืขืจ ื ืืฉื ืืขืืืืื ืืฉื, ืึทืืื ืืื ืืึธื ืืึทืฉืืึธืกื ืฆื ืฆืึธืื ืึท ืืึทืืฒึทืื ืืืงื ืึธืืืืขืจืืขื ืคึฟืึทืจ ืืืืขืจืืืื.
ืฆื ืคืึธืจืืืขืจืื ืืขื ืคึผืึธืจื ืืืืฃ ืืขื ืจืึทืืืขืจ ืืืื ืืขืจ ืกืขืจืืืขืจ ืืื ืืขืืืขื ืคึผืืึทื ืืจื ืฆื ืืืขืจื ืืืคึผืืืืื, ืืึธื ืืื ืืขื ืืฆื ืื sshtunnel ืคึผืจืึธืืจืึทื. ืืื ืืืขื ื ืืฉื ืึทืจืฒึทื ืืืื ืืื ืื ืคืจืืื ืคืื ืืืจ ืงืึธื ืคืืืืจืึทืฆืืข - ืขืก ืืื ืืึทื ืฅ ืืจืื ื. ืืื ืืืขื ื ืึธืจ ืืึทืืขืจืงื ืึทื ืืืจ ืฆืืืขืง ืืื ืืขืืืขื ืฆื ืคืึธืจืืืขืจืื TCP ืคึผืึธืจื 1194 ืคึฟืื ืืขื ืจืึทืืืขืจ ืฆืื VPS. ืืขืจื ืึธื, ืืึธื ืืื ืงืึธื ืคืืืืจืืจื ืืขื ืกืขืจืืืขืจ. OpenVPN ืืืืฃ ืืขื tap0 ืืขืืืืืก, ืืืืก ืืื ืืขืืืขื ืคืืจืืื ืื ืฆืื br-lan ืืจืืง. ื ืืืืขื ืืืืก ืืื ืืื ืืขืืขืกื ืื ืคืืจืืื ืืื ื ืฆืื ื ืื-ืืขืฉืืคืขื ืขื ืกืขืจืืืขืจ ืคืื ืืืื ืืขืคืืืค, ืืื ืขืก ืงืืืจ ืืขืืืืจื ืื ืื ืคืืจื ืคืืจืืืขืจืืื ื ืืขืืื ืง ืืื ืืขืืจืืขื, ืืื ืืืื ืืขืคืืืค ืืื ืืขืืืืจื ื ืืืืืืื ืคืื ืขื ืจืืืืขืจ'ืก ื ืขืืืืืจืง, ืืืืฉ ืขืก ืืื ื ืืฉื ืืขืืืขื ืคืืืืฉ ื ืืืื ืืขืจืคืื.
ืืึธืก ืืืื ืฆืืงืข ืืืึธืก ืืื ืืขืืืืื ืฆื ืืึธื ืืื ืืขืืืขื ืฆื ืคึฟืึทืจืืืืื IP ืึทืืจืขืกื ืืื ืคึฟืึทืจืฉืืืขื ืข ืืืืื ืื ืืขื ืึทืืื ืึทื ืืื ืืึธืื ื ืืฉื ืงืึธื ืคืืืงืืืจื ืืื ืงืึธื ืคึฟืืืืจืืจื ืื ืจืึธืืืขืจืก ืืื OpenVPN-ืงืืืขื ืื.
ืื ืคืืืืขื ืืข ืจืึทืืืขืจ IP ืึทืืจืขืกืขืก ืืื DHCP ืกืขืจืืืขืจ ืจืืื ืืืฉืึทื ืืขื ืขื ืืืืกืืขืงืืืื:
- 192.168.10.1 ืืื ืงืืื 192.168.10.2 - 192.168.10.80 ืคึฟืึทืจ ืื ืกืขืจืืืขืจ
- 192.168.10.100 ืืื ืงืืื 192.168.10.101 - 192.168.10.149 ืคึฟืึทืจ ืื ืจืึทืืืขืจ ืืื ืืืืื ืื ื ื ืื 2
- 192.168.10.150 ืืื ืงืืื 192.168.10.151 - 192.168.10.199 ืคึฟืึทืจ ืื ืจืึทืืืขืจ ืืื ืืืืื ืื ื ื ืื 3
ืขืก ืืื ืืืื ืืขืืืขื ื ืืืืืง ืฆื ืฆืืืืืื ืื ืึทืืจืขืกื ืฆื ืื ืงืืืขื ื ืจืึธืืืขืจืก. OpenVPN-ืกืขืจืืืขืจ, ืืืจื ืฆืืืืืื ืื ืคืืืืขื ืืข ืฉืืจื ืฆื ืืืื ืงืื ืคืืืืจืืฆืืข:
ifconfig-pool-persist /etc/openvpn/ipp.txt 0ืืื ืึทืืื ื ืื ืคืืืืขื ืืข ืฉืืจืืช ืฆื ืื /etc/openvpn/ipp.txt ืืขืงืข:
flat1_id 192.168.10.100
flat2_id 192.168.10.150
ืืืื flat1_id ืืื flat2_id ืืขื ืขื ืื ืืขืืืืืก ื ืขืืขื ืืืืก ืืขื ืขื ืกืคืขืฆืืคืืจื ืืืขื ืืขื ืฉืืคื ืกืขืจืืืคืืงืืื ืคืืจื ืืื ืคืืจืืื ืื ืฆื OpenVPN
ืืขืจื ืื, ืื ืจืึธืืืขืจืก ืืขื ืขื ืงืึธื ืคืืืืจืืจื ืืขืืืึธืจื OpenVPN- ืงืืืขื ืื, tap0 ืืขืืืืืกืขืก ืืืืฃ ืืืืืข ืืขื ืขื ืฆืืืขืืขืื ืืขืืืืจื ืฆืื br-lan ืืจืืง. ืืื ืืขื ืคืื ืงื, ืืื ืืืขืก ืืืืกืืขืืขื ืืื, ืืืืื ืืืข ืืจืื ื ืขืืืืืืจืงืก ืืืื ืืขืงืขื ื ืืขื ืืืื ืขืจ ืืขื ืื ืืขืจื ืืื ืคืื ืงืฆืืื ืืจื ืืืก ืืืื ืืืื ืืืื. ืืืขืจ, ื ืืื ืฅ ืืืืื ืืขื ืขืืข ืืขืืื ืืื ืืจืืืกืืขืงืืืขื: ืืื chmal ืืืื ืืขืืืืืกืขืก ืืืงืืืขื ืื IP ืืืจืขืก ืคืื ืืขื ืืืืจืขืืื ืจืืืืขืจ, ืืื ืืืข ื ืืืคืืืื ืืข ืงืื ืกืขืงืืืขื ืฆื. ืคืืจ ืขืคืขืก ื ืกืืื, ืืื ืืขืจ ืจืืืืขืจ ืืื ืืืื ืข ืคืื โโืื ืืืจืืช ื ืืฉื ืืขืงืขื ื ืจืขืืืืจื ืฆื DHCPDISCOVER ืืื ืฆืืื, ืืื ืืขืจ ืืขืืืืืก ืืื ืืืงืืืขื ืืขื ืืืืจืขืืื ืืืจืขืก. ืืื ืืื ืืืื ืืขืืขื ืื ืืื ืืืจืฃ ืคืืืืขืจื ืืืขืืืข ืคืืจืืื ืืขื ืืื tap0 ืืืืฃ ืืขืื ืจืืืืขืจ, ืืืขืจ ืืื ืขืก ืืื ืืื ืืจืืืกืืขืฉืืขืื, ืงืขื ืขื iptables ื ืืฉื ืืจืืขืื ืืื ื ืืขืืืืืก ืืืื ืขืก ืืื ืืืื ืคืื ื ืืจืืง, ืืื ืืื ืืขืืืจืคื ื ืืฆื ebtables. ืืืืืขืจ, ืืื ืืืื ืคืืจืืืืขืจ ืขืก ื ืืฉื ืืจืืื ืืขื ืืืขื, ืืื ืืื ืืขืืืจืคื ืืืืขืจืืืืขื ืื ืืืืืขืจ ืคืืจ ืืขืื ืืขืืืืืก. ื ืืืืขื ืืืืก ืืื ืืื ืืืก ืืขืืื ืืื ืฆืืืขืืืืื ืื ืคืืืื ืืข ืฉืืจืืช ืฆื /etc/rc.local ืืืืฃ ืืขืื ืจืืืืขืจ, ืืื ืื ืคืจืืืืขื ืืขืืขืื ืืขืืืืจื:
ebtables -A INPUT --in-interface tap0 --protocol ipv4 --ip-protocol udp --ip-destination-port 67:68 -j DROP
ebtables -A INPUT --in-interface tap0 --protocol ipv4 --ip-protocol udp --ip-source-port 67:68 -j DROP
ebtables -A FORWARD --out-interface tap0 --protocol ipv4 --ip-protocol udp --ip-destination-port 67:68 -j DROP
ebtables -A FORWARD --out-interface tap0 --protocol ipv4 --ip-protocol udp --ip-source-port 67:68 -j DROP
ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืึทืกืืื ืคึฟืึทืจ ืืจืืึท ืืืจ.
ืืืื 2: ืืึทืงืขื ืขื ืืื WireGuard
ืืขืฆืื ืก ืืืขืจื ืืขืจ ืืขืจืขืื ืืืืฃ'ื ืืื ืืขืจื ืขืฅ ืืืขืื WireGuard, ืืึทืืืืื ืืขืจื ืืืง ืืฒึทื ืืจืื ืืงืืื ืคืื ืงืึธื ืคืืืืจืึทืฆืืข, ืืืืืข ืืจืึทื ืกืคืขืจ ืืืืงืืื, ื ืืืขืจืืงืข ืคืื ื, ืืื ืคืึทืจืืืฒึทืืืขืืข ืืืืขืจืืืื. ื ืืืืขื ืืฉ ืคึฟืึทืจ ื ืึธื ืืื ืคึฟืึธืจืืึทืฆืืข ืืืขืื ืืื ืืึธื ืึทื ืืคึผืืขืงื ืึทื ืขืก ืฉืืืฆื ื ืืฉื ืงืืื ืืจืืง ืืืืืืื ืึธืืขืจ TCP ืคึผืจืึธืืึธืงืึธื ืฉืืืฆืข, ืืืึธืก ืืึธื ืืื ืืขืคึฟืืจื ืฆื ืืืืืื ืึทื ืขืก ืืื ื ืืฉืืึธ ืงืืื ืึทืืืขืจื ืึทืืืื. OpenVPN ืคึฟืึทืจ ืืืจ ืืื ืขืก ื ืึธื ืึทืืฅ ื ืืฉื ืืึธืจื. ืึทืืื ืืื ืืึธื ืึธืคึผืืขืฉืืขืื ืฆื ืืึทืงืขื ืขื ืืื WireGuard.
ืคืืจ ื ืคืืจ ืืขื ืฆืืจืืง, ืืืื ืืื ื ืืืขืก ืคืืจืฉืคืจืืื ืืืจื ืจืขืกืืจืกื ืคืืจืืื ืื ืืื ืืื ืคืืจืืืฆืืข ืืขืื ืืืืืืข ืืืืฃ ืืืื ืืืขืจ ืื ืืขืจื ืืืขื, ืื WireGuard ืืืขื ืขื ืืืขื ืืจืืื ืืขืจืขืื ื ืืืขืจื ืืื ืืขื ืงืขืจื ืขื Linux, ืึธื ืืืืื ืืืง ืืื ืืืขืจืกืืข 5.6. ื ืืืขืก ืึทืจืืืงืืขื, ืืื ืฉืืขื ืืืง, ืืขื ืขื ืืขืืืืื ืืขืืืึธืจื. WireGuardืืื ืืื ื ืืืืืื ืืจืืื ืืขืคืืื ืืื ืืืื ืืืขืื ืฆื ืคืืจืืจืขืื ืืืก ืืืืข ืืืืข OpenVPNืืืก ืืึธื ืืื ืืื ืืจืืื ืืขืืืคื ืืื . ืขืก ืืึธื ืืขืจืขืื ืืืขืื ืงืจืืืืืื ื ืึทื ืขืืืขืจื ืขื ืืื ืขื ืืืืขืจ L3 ื ืืฆื GRE. ืืขืจ ืึทืจืืืงื ืืื ืืืจ ืืึธืคืขื ืื ื. ืขืก ืืื ืืขืืืืื ืืืงืืึธืจ ืืืึธืก ืฆื ืืึธื ืืื ืื UDP ืคึผืจืึธืืึธืงืึธื. ืื ืืืื ืืขืคืืจื ืืืจ ืฆื ืึทืจืืืงืืขื ืืืขืื ื ืืฆื ืกืึธืงืึทื ืืื ืงืึทื ืืืฉืึทื ืืงืฉืึทื ืืื ืึท SSH ืืื ืขื ืฆื ืคืึธืจืืืก ืึท UDP ืคึผืึธืจื, ืึธืืขืจ, ืืื ืืืืขืจืงื ืึทื ืืขืจ ืฆืืืึทื ื ืึทืจืืขื ืืืืื ืืื ืืืื ืงืฉืจ ืืึธืืข, ืืึธืก ืืื, ืื ืึทืจืืขื ืคืื ืขืืืขืืข VPN ืงืืืืึทื ืฅ ืืืึธืื ืืืื ืืืืืขืืืขื. ืืื ืืขืงืืืขื ืืื ืืขื ืืขืืึทื ืง ืคืื ืื ืกืืึธืืื ื ืึท ืืืคึผื ืกืขืจืืืขืจ ืืืืฃ ืึท ืืืคึผืก ืืื ืืึทืฉืืขืืืงื GRE ืคึฟืึทืจ ืงืืืืึทื ืฅ, ืึธืืขืจ ืืื ืขืก ืคืืจืงืขืจื ืืืืก, GRE ืฉืืืฆื ื ืืฉื ืขื ืงืจืืคึผืฉืึทื, ืืืึธืก ืืืขื ืคืืจื ืฆื ืื ืคืึทืงื ืึทื ืืืื ืืจืื ืคึผืึทืจืืืขืก ืืึทืงืืืขื ืึทืงืกืขืก ืฆื ืื ืกืขืจืืืขืจ , ืึทืืข ืคืึทืจืงืขืจ ืฆืืืืฉื ืืืื ื ืขืืืืึธืจืงืก ืืืขื ืืืื ืืื ืืืืขืจ ืืขื ื, ืืืึธืก ืืื ื ืืฉื ืคึผืึทืกื ืืืจ ืืืึท ืึทืืข.
ืึทืืึธื ืืืืืขืจ, ืืขืจ ืืึทืฉืืืก ืืื ืืขืืืื ืืื ืืืืืืข ืคืื โโืืืขืจืืง ืขื ืงืจืืคึผืฉืึทื, ืืืจื ื ืืฆื VPN ืืืืขืจ VPN ื ืืฆื ืื ืคืืืืขื ืืข ืกืืขืืข:
ืฉืืึทืคึผื XNUMX VPN:
ืืืคึผืก ืืื ืกืขืจืืืขืจ ืืื ืื ืขืจืืขื ืึทืืจืขืก 192.168.30.1
MC ืืื ืงืืืขื ื ืืืคึผืก ืืื ืื ืขืจืืขื ืึทืืจืขืก 192.168.30.2
MK2 ืืื ืงืืืขื ื ืืืคึผืก ืืื ืื ืขืจืืขื ืึทืืจืขืก 192.168.30.3
MK3 ืืื ืงืืืขื ื ืืืคึผืก ืืื ืื ืขืจืืขื ืึทืืจืขืก 192.168.30.4
ืฆืืืืืืข ืืืจืื VPN:
MC ืืื ืกืขืจืืืขืจ ืืื ืคืื ืืจืืืกื ืืืง ืึทืืจืขืก 192.168.30.2 ืืื ืื ืขืจืืขื 192.168.31.1
MK2 ืืื ืงืืืขื ื MC ืืื ืื ืึทืืจืขืก 192.168.30.2 ืืื ืึทื ืื ืขืจืืขื IP 192.168.31.2
MK3 ืืื ืงืืืขื ื MC ืืื ืื ืึทืืจืขืก 192.168.30.2 ืืื ืึทื ืื ืขืจืืขื IP 192.168.31.3
* MC - ืจืึทืืืขืจ ืกืขืจืืืขืจ ืืื ืืืืื ืื ื 1, MK2 - ืจืึทืืืขืจ ืืื ืืืืื ืื ื 2, MK3 - ืจืึทืืืขืจ ืืื ืืืืื ืื ื 3
* ืืืื ืงืึทื ืคืืืืขืจืืืฉืึทื ื ืืขื ืขื ืืจืืืก ืืื ืื ืกืคึผืืืืขืจ ืืื ืื ืกืืฃ ืคืื ืืขื ืึทืจืืืงื.
ืืื ืึทืืื, ืคึผืื ืืก ืืืืคื ืฆืืืืฉื ื ืขืฅ ื ืึธืืื 192.168.31.0/24, ืขืก ืืื ืฆืืื ืฆื ืืึทื ืืืืฃ ืฆื ืืึทืฉืืขืืืงื ืึท GRE ืืื ืขื. ืืืืืขืจ ืืขื, ืึผืื ื ืืฉื ืฆื ืคืึทืจืืืจื ืึทืงืกืขืก ืฆื ืจืึธืืืขืจืก, ืขืก ืืื ืืืขืจื ืฆื ืฉืืขืื SSH ืืึทื ืึทืื ืฆื ืคืึธืจืืืขืจืืื ืคึผืึธืจื 22 ืฆื ืื ืืืคึผืก, ืึทืืื ืึทื, ืืืฉื, ืื ืจืึทืืืขืจ ืคืื ืืืืื ืื ื 10022 ืืืขื ืืืื ืฆืืืจืืืืขื ืืืืฃ ืคึผืึธืจื 2 ืคืื ืื ืืืคึผืก, ืืื ืจืึทืืืขืจ ืคืื ืืืืื ืื ื 11122 ืืืขื ืืืื ืฆืืืจืืืืขื ืืืืฃ ืคึผืึธืจื 3 ืจืึทืืืขืจ ืคืื ืืืืื ืื ื XNUMX. ืขืก ืืื ืืขืกืืขืจ ืฆื ืงืึทื ืคืืืืขืจ ืคืึธืจืืืขืจืืื ื ื ืืฆื ืื ืืขืืืข ืฉืฉืืื ื ืขื, ืืืืึทื ืขืก ืืืขื ืืืงืขืจื ืืขื ืืื ืขื ืืืื ืขืก ืคืืืื.
ืืขืจ ืืื ืขื ืืื ืงืึทื ืคืืืืขืจื, ืืืจ ืงืขื ืขื ืคืึทืจืืื ืื ืฆื SSH ืืืจื ืื ืคืึธืจืืืขืจืืื ืคึผืึธืจื:
ssh root@ะะะ_VPS -p 10022ืืืืืืขืจ ืืึธืืกืื ืืืืกืืขืฉื OpenVPN:
/etc/init.d/openvpn stopืืืฆื ืืึธืืืจ ืฉืืขืื ืึท GRE ืืื ืขื ืืืืฃ ืื ืจืึทืืืขืจ ืคึฟืื ืืืืื ืื ื 2:
ip link add grelan0 type gretap remote 192.168.31.1 local 192.168.31.2
ip link set grelan0 up
ืืื ืืืื ืื ืืืฉืืคื ืฆืืืื ื ืฆื ืื ืืจืืง:
brctl addif br-lan grelan0
ืืึธืืืจ ืืืจืืคืืจื ืึท ืขื ืืขื ืคึผืจืึธืฆืขืืืจ ืืืืฃ ืื ืกืขืจืืืขืจ ืจืึทืืืขืจ:
ip link add grelan0 type gretap remote 192.168.31.2 local 192.168.31.1
ip link set grelan0 up
ืืื ืืืื ืืืืื ืื ืืืฉืืคื ืฆืืืื ื ืฆื ืื ืืจืืง:
brctl addif br-lan grelan0
ืกืืึทืจืืื ื ืคืื ืืขื ืืึธืืขื ื, ืคึผืื ืืก ืึธื ืืืืื ืฆื ืืฆืืื ืืืื ืฆื ืื ื ืืึท ื ืขืฅ ืืื ืืื, ืืื ืฆืืคึฟืจืืื ืงืืื, ืืืื ืฆื ืืจืื ืงืขื ืงืึทืืืข. ืืขืจื ืึธื, ืฆื ืึธืคึผืฉืึทืฆื ืืื ืื ื ืขืฅ ืึทืจืืขื ืืืืฃ ืื ืื ืืขืจืข ืกืืฃ ืคืื ืื ืฉืืจื, ืืื ืคึผืจืืืืจื ืฆื SSH ืืื ืืืื ืขืจ ืคืื ืื ืงืึธืืคึผืืืืขืจืก ืืื ืืืืื ืื ื 2, ืึธืืขืจ ืืขืจ ssh ืงืืืขื ื ืคืจืืืื ืึธื ืคึผืจืึทืืคึผืืื ื ืึท ืคึผืึทืจืึธื. ืืื ืคึผืจืึผืืื ืฆื ืคืึทืจืืื ืื ืฆื ืืขื ืงืึธืืคึผืืืืขืจ ืืืจื ืืขืื ืขื ืืืืฃ ืคึผืึธืจื 22 ืืื ืืื ืืขื ืึท ืฉืืจื ืคืื ืืืึธืก ืืื ืงืขื ืขื ืคึฟืึทืจืฉืืืื ืึทื ืื ืงืฉืจ ืืื ืืขืืจืื ืืขื, ืื SSH ืกืขืจืืืขืจ ืจืืกืคึผืึทื ืื, ืึธืืขืจ ืคึฟืึทืจ ืขืืืขืืข ืกืืื ืขืก ื ืึธืจ ื ืืฉื ืคืจืขืื ืืืจ ืฆื ืงืืึธืฅ. ืืื.
$ telnet 192.168.10.110 22
SSH-2.0-OpenSSH_8.1
ืืื ืืื ืืจืืื ื ืฆื ืคืึทืจืืื ืื ืฆื ืขืก ืืืจื VNC ืืื ืืขื ืึท ืฉืืืึทืจืฅ ืคืึทืจืฉืืขืื. ืืื ืืืืขืจืฆืืืื ืืื ืึทื ืื ืคึผืจืึธืืืขื ืืื ืืื ืื ืืืืึทื ืงืึธืืคึผืืืืขืจ, ืืืืึทื ืืื ืงืขื ืขื ืืืืื ืคืึทืจืืื ืื ืฆื ืื ืจืึทืืืขืจ ืคืื ืืขื ืืืืื ืื ื ืืื ืื ืื ืขืจืืขื ืึทืืจืขืก. ืึธืืขืจ, ืืื ืืึทืฉืืืกื ืฆื ืคืึทืจืืื ืื ืฆื ืื SSH ืคืื ืืขื ืงืึธืืคึผืืืืขืจ ืืืจื ืื ืจืึทืืืขืจ ืืื ืืื ืืื ืกืึทืคึผืจืืืื ืฆื ืืขืคึฟืื ืขื ืึทื ืื ืงืฉืจ ืืื ืืขืจืึธืื, ืืื ืื ืืืืึทื ืงืึธืืคึผืืืืขืจ ืึทืจืืขื ืืึทื ืฅ ื ืึธืจืืึทื, ืึธืืขืจ ืขืก ืงืขื ื ืืฉื ืคืึทืจืืื ืื ืฆื ืืืื ืงืึธืืคึผืืืืขืจ.
ืืื ื ืขืขื ืืจืืืก ืืขื grelan0 ืืขืืืืืก ืคืื ืขื ืืจืืง ืืื ืืื ืขืก ืืืืคื OpenVPN ืืืืคื ืจืืืืขืจ ืืื ืืืจื 2, ืืื ืืื ืืืฉืืขืืืงื ืื ืื ื ืขืฅ ืืจืืขื ืืืืืขืจ ืจืืืืื ืืื ืื ืงืื ืขืงืฉืื ืก ืคืืื ื ืืฉื ืืค. ืืืืขื ืืื, ืืื ืืื ืืขืืจืืคื ืคืืจืืืก ืืืื ืืขื ืืฉื ืืืื ืืื ืืืงืืืื ืืืืฃ ืื ืืขืืืข ืคืจืืืืขืืขื, ืืื ืืืื ืืขื ืืื ืืื ืืขืจืืื ืฆื ืืขืืขืจื ืื MTU. ืงืืื ืืขืืืื ืืื ืืขืืื. ืืืขืจ, ืืื ืื MTU ืืื ืืขืืืขื ืืขืฉืืขืื ืืืื ืืขื ืื - 7000 ืคืืจ ืืจืขืืืค ืืขืืืืืกืขืก - ืืื ืืื ืืขืจืคืืจื ืืืขืจ ืคืืจืืืืจืขื ืข TCP ืงืื ืขืงืฉืื ืก ืืืขืจ ื ืืืขืจืืืข ืืจืื ืกืคืขืจ ืืืืงืืืื. ืฆืืืื ืื ืืืืืข MTU ืคืืจ ืืจืขืืืค, ืื MTU ืคืืจ ืงืื ืขืงืฉืื ืก... WireGuard ืื ืขืจืฉืืข ืืื ืฆืืืืืืข ืืขืืืขืืก ืืขื ืขื ืืึทืฉืืืื ืืขืืืึธืจื ืืืืฃ 8000 ืืื 7500 ืืืชืืื.
ืืื ืืึธื ืืืจืืืขืงืึธืื ืึทื ืขื ืืขืืข ืกืขืืึทืคึผ ืืืืฃ ืื ืจืึทืืืขืจ ืคึฟืื ืืืืื ืื ื 3, ืืื ืืขืจ ืืืืื ืืืืืง ืืื ืึทื ืึท ืฆืืืืื ืืจืขืืึทืคึผ ืฆืืืื ื ืืขืืืืกื grelan1 ืืื ืฆืืืขืืขืื ืฆื ืื ืกืขืจืืืขืจ ืจืึทืืืขืจ, ืืืึธืก ืืื ืืืื ืฆืืืขืืขืื ืฆื ืื br-lan ืืจืืง.
ืึทืืฅ ืึทืจืืขื. ืืืฆื ืืืจ ืงืขื ืขื ืฉืืขืื ืื ืืจืขืืึทืคึผ ืคึฟืึทืจืืึทืืืื ื ืืื ืกืืึทืจืืึทืคึผ. ืคึฟืึทืจ ืืขื:
ืืื ืฉืืขืื ืื ืฉืืจืืช ืืื /etc/rc.local ืืืืฃ ืื ืจืึทืืืขืจ ืืื ืืืืื ืื ื 2:
ip link add grelan0 type gretap remote 192.168.31.1 local 192.168.31.2
ip link set dev grelan0 mtu 7000
ip link set grelan0 up
brctl addif br-lan grelan0
ืฆืืืขืืขืื ืืขื ืฆื /etc/rc.local ืืืืฃ ืื ืจืึทืืืขืจ ืืื ืืืืื ืื ื 3:
ip link add grelan0 type gretap remote 192.168.31.1 local 192.168.31.3
ip link set dev grelan0 mtu 7000
ip link set grelan0 up
brctl addif br-lan grelan0
ืืื ืืืืฃ ืื ืกืขืจืืืขืจ ืจืึทืืืขืจ:
ip link add grelan0 type gretap remote 192.168.31.2 local 192.168.31.1
ip link set dev grelan0 mtu 7000
ip link set grelan0 up
brctl addif br-lan grelan0
ip link add grelan1 type gretap remote 192.168.31.3 local 192.168.31.1
ip link set dev grelan1 mtu 7000
ip link set grelan1 up
brctl addif br-lan grelan1
ื ืืืืขื ืืืืก ืืื ืืื ืจืืกืืืจื ืื ืงืืืขื ื ืจืืืืขืจืก, ืืื ืืื ืื ืืืขืงื ืื ืคืืจ ืขืคืขืก ื ืกืืื ืืืื ืืื ืืื ื ืืฉื ืคืืจืืื ืื ืฆืื ืกืขืจืืืขืจ. ื ืืืืขื ืืืืก ืืื ืืื ืืื ืคืืจืืื ืื ืฆื ืืืืขืจ SSH (ืฆืื ืืืืง, ืืื ืืื ืคืจืืขืจ ืงืื ืคืืืืจืืจื sshtunnel ืืขืจืคืืจ), ืืื ืืื ืื ืืืขืงื ืื WireGuard ืคึฟืึทืจ ืขืคืขืก ืึท ืกืืื, ืฉืึทืคึฟื ืขืก ืึท ืจืื ืคึฟืึทืจ ืืขื ืขื ืืคึผืื ืงื, ืึธืืขืจ ืขืก ืืื ื ืืฉื ืจืืืืืง. ืืืฉื, ืคึฟืึทืจ 192.168.30.2, ืืึธื ืื ืจืื ืืึทืืขืืข ืกืคึผืขืฆืืคึฟืืฆืืจื ืึท ืจืื ืืืจื ืืขื pppoe-wan ืืื ืืขืจืคึฟืืืก, ื.ื. ืืืจื ืืขื ืืื ืืขืจื ืขื, ืืึธืืฉ ืืขืจ ืจืื ืฆื ืืื ืืึธื ืืึธืื ืืขืคืืจื ืืขืืืึธืจื ืืืจื ืืขื wg0 ืืื ืืขืจืคึฟืืืก. ื ืึธื ืืขื ืืื ืืื ืืึธื ืืืืกืืขืืขืงื ืืขื ืจืื, ืืื ืื ืคึฟืึทืจืืื ืืื ื ืฆืืจืืงืืขืฉืืขืื ืืขืืืึธืจื. ืงืขื ืืื ืืขืคึฟืื ืขื ืืื ืกืืจืืงืฆืืขืก ืขืจืืขืฅ ืืื ืึทืืื ืฆื ืฆืืืื ืืขื WireGuard ืืื ืืึธื ื ืืฉื ืืขืงืขื ื ืืืืกืืืืื ืฆื ืฉืึทืคึฟื ืื ืจืืืขืก. ืืขืจืฆื, ืืึธื ืืื ื ืื ืึทืคึฟืืื ืคึฟืึทืจืฉืืึทื ืขื ืฆื ืืึธืก ืืื ืึท ืคึฟืื ืงืฆืืข ืคึฟืื OpenWRT ืฆื ืคึฟืื ืื WireGuardืึธื ืฆื ืคึฟืึทืจืืจืขื ืืขื ืึท ืกื ืฆืฒึทื ืฆื ืคึฟืึทืจืฉืืืื ืืึธืก ืคึผืจืึธืืืขื, ืืึธื ืืื ืคืฉืื ืฆืืืขืืขืื ืึท ืฉืืจื ืฆืื ืืฒึทืืขืจ-ืืืคึผ ืกืงืจืืคึผื ืืืืฃ ืืืืืข ืจืึธืืืขืจืก ืืืึธืก ืืึธืื ืืืืกืืขืืขืงื ืืขื ืจืื:
route del 192.168.30.2
ืกืึทืืขืจืืืืื ื
ืืึทื ืฅ ืึธืคึผืืืึทืจืฃ OpenVPN ืืื ืืื ืืืก ื ืืื ืืฉื ืืขืจืืจืืืื, ืืืืื ืืื ืืืจืฃ ืืื chmal ืืื ืคืืจืืื ืื ืฆื ื ื ืืืขื ื ืขืืืืืจืง ืคืื ื ืืขืคืืืค ืืืขืจ ืืขืืขืคืื, ืืื ืืืืคืฉืืขืื ื ืืจืขืืืคึผ ืืขืืืืืก ืืืืฃ ืืื ืืื ืืืื ื ืืฉื ืืขืืืขื. ืืืขืจ, ืืจืืฅ ืืขื, ืืื ืืื ืืืงืืืขื ื ืคืืจืืืื ืืื ืืืื ืืจืื ืกืคืขืจ ืืืืงืืื ืฆืืืืฉื ืืืจืืช, ืืื ื ืืฆื VNC, ืืืฉื, ืืื ืืขืฆื ืื ืงืืื ืคืจืืืืขืืขื. ืคืื ื ืืื ืืืืกื ืืขืคืืื ืืืขืจ ืืื ืืขืืืืจื ืืขืจ ืกืืืืื:
ืืืขื ื ืืฆื OpenVPN:
[r0ck3r@desktop ~]$ ping -c 20 192.168.10.110
PING 192.168.10.110 (192.168.10.110) 56(84) bytes of data.
64 bytes from 192.168.10.110: icmp_seq=1 ttl=64 time=133 ms
...
64 bytes from 192.168.10.110: icmp_seq=20 ttl=64 time=125 ms
--- 192.168.10.110 ping statistics ---
20 packets transmitted, 20 received, 0% packet loss, time 19006ms
rtt min/avg/max/mdev = 124.722/126.152/136.907/3.065 ms
ืืืขื ื ืืฆื WireGuard:
[r0ck3r@desktop ~]$ ping -c 20 192.168.10.110
PING 192.168.10.110 (192.168.10.110) 56(84) bytes of data.
64 bytes from 192.168.10.110: icmp_seq=1 ttl=64 time=124 ms
...
64 bytes from 192.168.10.110: icmp_seq=20 ttl=64 time=124 ms
--- 192.168.10.110 ping statistics ---
20 packets transmitted, 20 received, 0% packet loss, time 19003ms
rtt min/avg/max/mdev = 123.954/124.423/126.708/0.675 ms
ืขืก ืืื ืืขืจ ืึทืคืขืงืืึทื ืืืจื ืื ืืืื ืคึผืื ื ืฆื ืื VPS, ืืืึธืก ืืื ืืขืขืจืขื 61.5 ืืื
ืืืขืจ, ืื ืฉื ืขืืงืืื ืืื ืืื ืืืืืืื ื ืคืืจืืจืขืกืขืจื. ืืืื, ืืื ืืขืจ ืืืืืื ืื ื ืืืื ืจืืืืขืจ-ืกืขืจืืืขืจ, ืืื ืืื ืื ืืื ืืขืจื ืขื ืงืื ืขืงืฉืื ืฉื ืขืืงืืื ืคืื 30 ืืขืืืืืืกืืื, ืืื ืืื ืื ืื ืืขืจืข ืืืืืื ืื ืืขื ืืื ืขืก 5 ืืขืืืืืืกืืื. ืืขืจืฆื, ืืขืชื ืืื ืืฅ OpenVPN ืืื ืืื ื ืืฉื ืืขืืืขื ืืืืืืช ืฆื ืืขืจืืจืืืื ื ืืืื ืืจืื ืกืคืขืจ ืืืืงืืื ืฆืืืืฉื ื ืขืืืืึธืจืงืก ืืจืขืกืขืจ ืืื 3,8 Mbps ืืืื iperf ืืืืขื ืื ืืขื, ืืฉืขืช WireGuard "ืืขืคืืืคืขื" ืขืก ืืจืืืฃ ืฆื ืื ืืขืืืข 5 ืืขืืื/ืกืขืง.
ืงืึธื ืคืืืืจืึทืืืึธื WireGuard ืืืืฃ VPS[Interface]
Address = 192.168.30.1/24
ListenPort = 51820
PrivateKey = <ะะะะ ะซะขะซะ_ะะะฎะง_ะะะฏ_VPS>
[ืืึทื ืงืืงื ืืื]
ืคืืืืืง ืงื = <VPN_1_MS_PUBLIC_KEY>
ืึทืืืึธืืืขืืืคึผืก = 192.168.30.2/32
[ืืึทื ืงืืงื ืืื]
ืคืืืืืง ืงื = <VPN_2_MK2_PUBLIC_KEY>
ืึทืืืึธืืืขืืืคึผืก = 192.168.30.3/32
[ืืึทื ืงืืงื ืืื]
ืคืืืืืง ืงื = <VPN_2_MK3_PUBLIC_KEY>
ืึทืืืึธืืืขืืืคึผืก = 192.168.30.4/32
ืงืึธื ืคืืืืจืึทืืืึธื WireGuard ืืืืฃ MS (ืฆืืืขืืืืื ืฆื /etc/config/network)
#VPN ะฟะตัะฒะพะณะพ ััะพะฒะฝั - ะบะปะธะตะฝั
config interface 'wg0'
option proto 'wireguard'
list addresses '192.168.30.2/24'
option private_key 'ะะะะ ะซะขะซะ_ะะะฎะง_VPN_1_ะะก'
option auto '1'
option mtu '8000'
config wireguard_wg0
option public_key 'ะะขะะ ะซะขะซะ_ะะะฎะง_VPN_1_VPS'
option endpoint_port '51820'
option route_allowed_ips '1'
option persistent_keepalive '25'
list allowed_ips '192.168.30.0/24'
option endpoint_host 'IP_ะะะ ะะก_VPS'
#VPN ะฒัะพัะพะณะพ ััะพะฒะฝั - ัะตัะฒะตั
config interface 'wg1'
option proto 'wireguard'
option private_key 'ะะะะ ะซะขะซะ_ะะะฎะง_VPN_2_ะะก'
option listen_port '51821'
list addresses '192.168.31.1/24'
option auto '1'
option mtu '7500'
config wireguard_wg1
option public_key 'ะะขะะ ะซะขะซะ_ะะะฎะง_VPN_2_ะะ2'
list allowed_ips '192.168.31.2'
config wireguard_wg1ip link add grelan0 type gretap remote 192.168.31.1 local 192.168.31.3
option public_key 'ะะขะะ ะซะขะซะ_ะะะฎะง_VPN_2_ะะ3'
list allowed_ips '192.168.31.3'
ืงืึธื ืคืืืืจืึทืืืึธื WireGuard ืืืืฃ MK2 (ืฆืืืขืืืืื ืฆื /etc/config/network)
#VPN ะฟะตัะฒะพะณะพ ััะพะฒะฝั - ะบะปะธะตะฝั
config interface 'wg0'
option proto 'wireguard'
list addresses '192.168.30.3/24'
option private_key 'ะะะะ ะซะขะซะ_ะะะฎะง_VPN_1_ะะ2'
option auto '1'
option mtu '8000'
config wireguard_wg0
option public_key 'ะะขะะ ะซะขะซะ_ะะะฎะง_VPN_1_VPS'
option endpoint_port '51820'
option persistent_keepalive '25'
list allowed_ips '192.168.30.0/24'
option endpoint_host 'IP_ะะะ ะะก_VPS'
#VPN ะฒัะพัะพะณะพ ััะพะฒะฝั - ะบะปะธะตะฝั
config interface 'wg1'
option proto 'wireguard'
option private_key 'ะะะะ ะซะขะซะ_ะะะฎะง_VPN_2_ะะ2'
list addresses '192.168.31.2/24'
option auto '1'
option listen_port '51821'
option mtu '7500'
config wireguard_wg1
option public_key 'ะะขะะ ะซะขะซะ_ะะะฎะง_VPN_2_ะะก'
option endpoint_host '192.168.30.2'
option endpoint_port '51821'
option persistent_keepalive '25'
list allowed_ips '192.168.31.0/24'
ืงืึธื ืคืืืืจืึทืืืึธื WireGuard ืืืืฃ MK3 (ืฆืืืขืืืืื ืฆื /etc/config/network)
#VPN ะฟะตัะฒะพะณะพ ััะพะฒะฝั - ะบะปะธะตะฝั
config interface 'wg0'
option proto 'wireguard'
list addresses '192.168.30.4/24'
option private_key 'ะะะะ ะซะขะซะ_ะะะฎะง_VPN_1_ะะ3'
option auto '1'
option mtu '8000'
config wireguard_wg0
option public_key 'ะะขะะ ะซะขะซะ_ะะะฎะง_VPN_1_VPS'
option endpoint_port '51820'
option persistent_keepalive '25'
list allowed_ips '192.168.30.0/24'
option endpoint_host 'IP_ะะะ ะะก_VPS'
#VPN ะฒัะพัะพะณะพ ััะพะฒะฝั - ะบะปะธะตะฝั
config interface 'wg1'
option proto 'wireguard'
option private_key 'ะะะะ ะซะขะซะ_ะะะฎะง_VPN_2_ะะ3'
list addresses '192.168.31.3/24'
option auto '1'
option listen_port '51821'
option mtu '7500'
config wireguard_wg1
option public_key 'ะะขะะ ะซะขะซะ_ะะะฎะง_VPN_2_ะะก'
option endpoint_host '192.168.30.2'
option endpoint_port '51821'
option persistent_keepalive '25'
list allowed_ips '192.168.31.0/24'
ืืื ืื ืืึทืฉืจืืืขื ืข ืงืึธื ืคืืืืจืึทืฆืืขืก ืคึฟืึทืจ ืื ืฆืืืืืืข ืืืจืื VPN, ืืืฒึทื ืืื ืึธื ืฆื ืงืืืขื ืื WireGuard ืคึผืึธืจื 51821. ืืึธืก ืืึธื ื ืืฉื ืืืื ื ืืืืืง, ืืืฒึทื ืืขืจ ืงืืืขื ื ืืืขื ืืืืคืฉืืขืื ืึท ืคึฟืึทืจืืื ืืื ื ืคึฟืื ืืขืื ืคึฟืจืฒึทืขื, ื ืืฉื-ืคึผืจืืืืืืขืืืจืื ืคึผืึธืจื, ืึธืืขืจ ืืื ืืึธื ืขืก ืืขืืึธื ืืืืฃ ืืขื ืืืคึฟื ืึผืื ืืื ืืึธื ืงืขื ืขื ืึธืคึผืืึธืื ืึทืืข ืึทืจืฒึทื ืงืืืขื ืืืงืข ืคึฟืึทืจืืื ืืื ืืขื ืืืืฃ ืื wg0 ืืื ืืขืจืคึฟืืืกื ืคึฟืื ืึทืืข ืจืึธืืืขืจืก, ืึทืืืฅ ืึทืจืฒึทื ืงืืืขื ืืืงืข UDP ืคึฟืึทืจืืื ืืื ืืขื ืฆื ืคึผืึธืจื 51821.
ืืื ืืึธืคึฟื ืึทื ืืขืจ ืึทืจืืืงื ืืืขื ืืืื ื ืืฆืืง ืคึฟืึทืจ ืขืืขืฆืขืจ.
ืคึผืก ืืืื, ืืื ืืืืื ืฆื ืืืืื ืืืื ืฉืจืืคื ืืืึธืก ืกืขื ืื ืืืจ ืึท PUSH ืึธื ืืึธื ืฆื ืืืื ืืขืืขืคืึธื ืืื ืื WirePusher ืึทืคึผืืึทืงืืืฉืึทื ืืืขื ืึท ื ืืึทืข ืืืื ืืื ืืจืืืก ืืืืฃ ืืืื ื ืขืฅ. ืืึธ ืืื ืื ืืื ืง ืฆื ืื ืฉืจืืคื: .
ืืขืจืืืึทื ืืืงื: ืงืึธื ืคืืืืจืึทืืืึธื OpenVPNืกืขืจืืืขืจืก ืืื ืงืืืขื ืื
OpenVPN-ืกืขืจืืืขืจ
client-to-client
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/vpn-server.crt
dh /etc/openvpn/server/dh.pem
key /etc/openvpn/server/vpn-server.key
dev tap
ifconfig-pool-persist /etc/openvpn/ipp.txt 0
keepalive 10 60
proto tcp4
server-bridge 192.168.10.1 255.255.255.0 192.168.10.80 192.168.10.254
status /var/log/openvpn-status.log
verb 3
comp-lzoOpenVPNืงืืืขื ื
client
tls-client
dev tap
proto tcp
remote VPS_IP 1194 # Change to your router's External IP
resolv-retry infinite
nobind
ca client/ca.crt
cert client/client.crt
key client/client.key
dh client/dh.pem
comp-lzo
persist-tun
persist-key
verb 3 ืืื ืืขืืืืื ื easy-rsa ืฆื ืืืฉืขื ืขืจืืื ืกืขืจืืืคืืงืึทืฅ
ืืงืืจ: www.habr.com
