ืึทื ืึทืจืืืงื ืืืขืื ืืื ืืื ืืขืจืืื ืฆื ืืืืคื ืึท VPN ืกืขืจืืืขืจ ืืื ืืขืจ ืื NAT โโืคืื ืืืื ืืืื ืฉืคึผืืึทืืขืจ (ืึธื ืึท ืืืืึทืก IP ืึทืืจืขืก). ืืึธืื ืืืจ ืืึทืื ืึท ืจืขืืขืจืืืึทืฆืืข ืืืืื: ืึทื ืื ืคืึธืจืฉืืขืืื ื ืคืื ืืขื ืืืคึผืืึทืืขื ืืืืฉืึทื ืืืืึทื ืืขืคึผืขื ืืก ืืืืฃ ืื ืืืคึผ ืคืื NAT ืืขื ืืฆื ืืืจื ืืืื ืฉืคึผืืึทืืขืจ, ืืื ืืขืืื ื ืืื ืื ืจืึทืืืขืจ.
ืึทืืื, ืืื ืืืจืฃ ืฆื ืคืึทืจืืื ืื ืคืื ืืืื ืึทื ืืจืืื ืกืืึทืจืืคืึธื ืข ืฆื ืืืื ืืืื ืงืึธืืคึผืืืืขืจ, ืืืืืข ืืขืืืืกืขืก ืืขื ืขื ืงืึธื ื ืขืงืืขื ืฆื ืื ืืื ืืขืจื ืขื ืืืจื ืคึผืจืึทืืืืืืขืจ NATs, ืคึผืืืก ืื ืงืึธืืคึผืืืืขืจ ืืื ืงืึธื ื ืขืงืืขื ืืืจื ืึท ืืืื ืจืึทืืืขืจ, ืืืึธืก ืืืื NAT ืงืึทื ืขืงืฉืึทื ื.
ืืขืจ ืงืืึทืกืืฉ ืกืืขืืข ื ืืฆื ืึท ืืืกื VPS / VDS ืืื ืึท ืืืืึทืก IP ืึทืืจืขืก, ืืื ืืขืืื ื ืืื ืจืขื ืืื ื ืึท ืืืืึทืก IP ืึทืืจืขืก ืคืื ืึท ืฉืคึผืืึทืืขืจ, ืืื ื ืืฉื ืงืึทื ืกืืืขืจื ืคึฟืึทืจ ืขืืืขืืข ืกืืืืช.
ืืขื ืืืขื ืืื ืืฉืืื , ืืืืื ืืขืคืืจื ืขืืืขืืข ืืงืกืคึผืขืจืึทืืึทื ืฅ ืืื STUNs ืืื NATs ืคืื ืคึผืจืึทืืืืืืขืจื. ืืื ืืึทืฉืืึธืกื ืฆื ืืึธื ืึท ืืืกื ืขืงืกืคึผืขืจืืืขื ื ืืืจื ืืืืคื ืื ืืึทืคึฟืขื ืืืืฃ ืึท ืืืื ืจืึทืืืขืจ ืืื OpenWRT ืคืืจืืืืึทืจืข:
$ stun stun.sipnet.ruืืึทืงืืืขื ืื ืจืขืืืืืึทื:
STUN ืงืืืขื ื ืืืขืจืกืืข 0.97
ืขืจืฉืืืง: ืืืืึธืคึผืืขื ืืืง ืืึทืคึผืื ื, ืืืืึธืคึผืืขื ืืืง ืคึฟืืืืจืืจ, ืืจืึทืค ืคึผืึธืจื, ืืืขื ืืืื ืืึทืืจืคึผืื
ืฆืืจืืงืงืืืขื ืืืขืจื ืืื 0x000002
ืืืืขืจืึทืืข ืืืืขืจืืขืฆืื ื:
ืคืจืืึท ืืึทืคึผืื ื - ืคืจืืึท ืืึทืคึผืื ื
ืคืจืืึท ืคืืืืขืจ - ืคืจืืึท ืคืืืืขืจ
ืืจืึทืค ืคึผืึธืจื - ืืจืึทืค - ืคึผืึธืจื
ืึดืฉึฐืืจึธืึตื ืึดืฉึฐืืจึธืึตื - ืึดืึฐืึถื ืึถืช ืึทืฉึฐึผืืจึดืืคึธื
ืืืขื ืืื ืืืืคื ืึท ืขื ืืขื ืืึทืคึฟืขื ืืืืฃ ืืืื ืคึผืืกื, ืืื ืืึทื:
STUN ืงืืืขื ื ืืืขืจืกืืข 0.97
ืขืจืฉืืืง: ืืืืึธืคึผืืขื ืืืง ืืึทืคึผืื ื, ืคึผืึธืจื ืึธืคืขื ืืืง ืคึฟืืืืจืืจ, ืืจืึทืค - ืคึผืึธืจื, ืืึทืืจืคึผืื
ืฆืืจืืงืงืืืขื ืืืขืจื ืืื 0x000006
ืคึผืึธืจื ืึธืคืขื ืืืง ืคืืืืขืจ - ืคึผืึธืจื ืึธืคืขื ืืืง ืคืืืืขืจ
ืืขืจ ืืืืืง ืืื ืื ืจืขืืืืืืื ืคืื ืื ืืึทืคึฟืขื ืจืขืืืืืึทื ืืื ืื ืืขืืืืื ืึทื ืืขืจ ืืืื ืจืึทืืืขืจ ืืื ืืขืืืขื "ืืืึทื ืฆืืฉืืืึทืขืจ" ืฆื ืืขื ืคึผืจืึธืฆืขืก ืคืื ืืจืึทื ืกืืืืื ื ืคึผืึทืงืืฅ ืคึฟืื ืืขืจ ืืื ืืขืจื ืขืฅ; ืืึธืก ืืื ืืขืืืขื ืืจืืืกืืขืืืืื ืืื ืื ืคืึทืงื ืึทื ืืืขื ืขืงืกืึทืงืืืืื ื ืื ืืึทืคึฟืขื ืืืืฃ ืื ืงืึธืืคึผืืืืขืจ:
stun stun.sipnet.ru -p 11111 -vืืื ืืื ืืืงืืืขื ืื ืชืืฆืื:
...
ืืึทืคึผืืึทื ืึทืืจืขืก = XX.1XX.1X4.2XX:4398
...
ืืื ืืขื ืืึธืืขื ื, ืึท ืืืคึผ ืกืขืกืืข ืืื ืืขืืืขื ืึธืคึผืขื ืขื ืคึฟืึทืจ ืขืืืขืืข ืืึธื, ืืืื ืืื ืืขื ืืึธืืขื ื ืืืจ ืฉืืงื ืึท ืืืคึผ ืืขืื (ืืืฉื: netcat XX.1XX.1X4.2XX 4398 -u), ืืขืืึธืื ืืขืจ ืืงืฉื ืืขืงืืืขื ืฆื ืื ืืืื ืจืึทืืืขืจ, ืืืึธืก ืืื ืืขืืืขื ืืืฉืืขืืืงื ืืืจื TCPDump ืคืืืกื ืืืง ืืืืฃ ืขืก, ืึธืืขืจ ืื ืืงืฉื ืืื ื ืืฉื ืืขืจืืจืืืื ืืขื ืงืึธืืคึผืืืืขืจ - IPtables, ืืื ืึท NAT ืืืืขืจืืขืฆืขืจ ืืืืฃ ืื ืจืึทืืืขืจ, ืืจืึทืคึผื ืขืก.
ืึธืืขืจ ืืขืจ ืคืึทืงื ืึทื ืื UDP ืืขืื ืืืจืืืขืืื ืืขื ืืืจื ืื NAT โโืคืื ืื ืฉืคึผืืึทืืขืจ ืืื ืืึธืคืขื ืื ื ืคึฟืึทืจ ืืฆืืื. ืืื ื ืืขืจ ืจืึทืืืขืจ ืืื ืืืื ืืื ืืืื ืืืฉืืจืืกืืืงืฉืึทื, ืืื ืกืึทืืืื ืืขื ืคึผืจืึธืืืขื ืืืจื ืจืืืขืจืขืงืืื ื ืื UDP/11111 ืคึผืึธืจื ืฆื ืื ืงืึธืืคึผืืืืขืจ:
iptables -t nat -A PREROUTING -i eth1 -p udp -d 10.1XX.2XX.XXX --dport 11111 -j DNAT --to-destination 192.168.X.XXXืืืื, ืืื ืืื ืืขืืืขื ืืืืืืช ืฆื ืึธื ืืืืื ืึท UDP ืกืขืกืืข ืืื ืืึทืงืืืขื ืจืืงืืืขืก ืคึฟืื ืื ืืื ืืขืจื ืขื ืคึฟืื ืงืืื IP ืึทืืจืขืก. ืืื ืืขื ืืึธืืขื ื, ืืื ืืึธื ืืฉื OpenVPN-ืกืขืจืืืขืจ (ืืื ืคืจืืขืจ ืงืึทื ืคืืืืขืจื ืขืก) ืฆืืืขืืขืจื ืฆื UDP/11111 ืคึผืึธืจื, ืื ืืขืืืืื ืื ืคืื ืืจืืืกื ืืืง IP ืึทืืจืขืก ืืื ืคึผืึธืจื (XX.1XX.1X4.2XX:4398) ืืืืฃ ืื ืกืืึทืจืืคืึธื ืข ืืื ืืฆืืื ืงืึธื ื ืขืงืืขื ืคึฟืื ืื ืกืืึทืจืืคืึธื ืข ืฆื ืื ืงืึธืืคึผืืืืขืจ. ืึธืืขืจ ืืื ืืขื ืืืคึผืืึทืืขื ืืืืฉืึทื, ืึท ืคึผืจืึธืืืขื ืืื ืืืืคืืขืฉืืื ืขื: ืขืก ืืื ื ืืืืืง ืฆื ืขืคืขืก ืืึทืืื ืื UDP ืกืขืกืืข ืืื ืื OpenVPN ืงืืืขื ื ืืื ืงืึธื ื ืขืงืืขื ืฆื ืื ืกืขืจืืืขืจ; ืืื ืืึธื ื ืื ืืื ืื ืึธืคึผืฆืืข ืคืื โโืคึผืืจืืึทืืืงืื ืงืึทืืขืจ ืื STUN ืงืืืขื ื - ืืื ืืึธื ื ืืฉื ืืืขืื ืฆื ืืืืกื ืื ืืึทืกืข ืืืืฃ ืื STUN ืกืขืจืืืขืจืก.
ืืื ืืืื ืืืืขืจืงื ืื ืคึผืึธืืืฆืืข "", ืืขื ืืึธืืข
ืืึทืืจืคึผืื ื ืื ื ืึทืืึทืื ืืืื ืืึทืฉืื ืืืืฃ ืึท ืืืืข ื ืขืฅ ืืื ืืขืจ ืึท NAT ืฆื ืึทืงืกืขืก ืื ืื ืืขืจ ืืึทืฉืื ืืืืฃ ืืขืจ ืืขืืืืงืขืจ ื ืขืฅ ืืื ืื ืคืื ืืจืืืกื ืืืง ืึทืืจืขืก ืคืื ืื ืจืึทืืืขืจ.
ืืื ืึท ืจืขืืืืืึทื, ืืื ืคืฉืื ืกืึทืืืื ืื ืคึผืจืึธืืืขื ืคืื ืืืื ืืืื ืื ื ืึท ืืืคึผ ืกืขืกืืข - ืืื ืืึธื ืืฉื ืืขื ืงืืืขื ื ืืืืฃ ืืขืจ ืืขืืืืงืขืจ ืงืึธืืคึผืืืืขืจ ืืื ืื ืกืขืจืืืขืจ.
ืขืก ืืขืืจืืขื ืืื ืืึธืก:
- ืืึธื ืืฉื ืื STUN ืงืืืขื ื ืืืืฃ ืืืืข ืคึผืึธืจื 11111
- ืืืงืืืขื ืึท ืขื ืืคืขืจ ืืื ืึท ืคืื ืืจืืืกื ืืืง IP ืึทืืจืขืก ืืื ืคึผืึธืจื XX.1XX.1X4.2XX:4398
- ืืขืฉืืงื ืืึทืื ืืื ืึท ืคืื ืืจืืืกื ืืืง IP ืึทืืจืขืก ืืื ืคึผืึธืจื ืฆื E- ืืจืืื (ืงืืื ืื ืืขืจืข ืืื ืกื ืืื ืืขืืืขื) ืงืึทื ืคืืืืขืจื ืืืืฃ ืื ืกืืึทืจืืคืึธื ืข
- ืืึธื ืืฉื ืื OpenVPN ืกืขืจืืืขืจ ืืืืฃ ืึท ืงืึธืืคึผืืืืขืจ ืฆืืืขืืขืจื ืฆื UDP/11111 ืคึผืึธืจื
- ืืึธื ืืฉื ืื OpenVPN ืงืืืขื ื ืืืืฃ ืืขื ืงืึธืืคึผืืืืขืจ ืืืึธืก ืกืคึผืขืฆืืคืืฆืืจื XX.1XX.1X4.2XX: 4398 ืคึฟืึทืจ ืงืฉืจ
- ืืื ืงืืื ืฆืืื ืืึธื ืืฉื ืื OpenVPN ืงืืืขื ื ืืืืฃ ืื ืกืืึทืจืืคืึธื ืข ืืืึธืก ืื ืืืงืืืฅ ืื IP ืึทืืจืขืก ืืื ืคึผืึธืจื (ืืื ืืืื ืคืึทื ืื IP ืึทืืจืขืก ืืื ื ืืฉื ืืืืฉื) ืฆื ืคืึทืจืืื ืื
ืืขื ืืืขื ืืื ืืื ืืขืืืขื ืืืืืืช ืฆื ืคืึทืจืืื ืื ืฆื ืืืื ืงืึธืืคึผืืืืขืจ ืคึฟืื ืืืื ืกืืึทืจืืคืึธื ืข. ืื ืืืคึผืืึทืืขื ืืืืฉืึทื ืึทืืึทืื ืืืจ ืฆื ืคืึทืจืืื ืื ืงืืื OpenVPN ืงืืืขื ื.
ืคืืจ
ืืืจ ืืืขื ืืึทืจืคึฟื:
# apt install openvpn stun-client sendemailืืืจ ืืึธืื ืืขืฉืจืืื ืึท ืคึผืึธืจ ืคืื ืกืงืจืืคึผืก, ืึท ืคึผืึธืจ ืคืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืขืก ืืื ืืืฉืขื ืขืจืืืืึทื ืื ื ืืืืืง ืกืขืจืืืคืืงืึทืฅ (ืืื ื ืืขืจ ืงืืืขื ื ืืืืฃ ืึท ืกืืึทืจืืคืึธื ืข ืึทืจืืขื ืืืืื ืืื ืกืขืจืืืคืืงืึทืฅ), ืืืจ ืืึธืื ืื ืืขืืืืื ืืืขื ืืืคึผืืึทืืขื ืืืืฉืึทื ืคืื ืึทื OpenVPN ืกืขืจืืืขืจ.
ืืืืคึผื ืฉืจืืคื ืืืืฃ ืื ืงืึธืืคึผืืืืขืจ
# cat vpn11.sh#!/bin/bash
until [[ -n "$iftosrv" ]]; do echo "$(date) ะะฟัะตะดะตะปัั ัะตัะตะฒะพะน ะธะฝัะตััะตะนั"; iftosrv=`ip route get 8.8.8.8 | head -n 1 | sed 's|.*dev ||' | awk '{print $1}'`; sleep 5; done
ABSOLUTE_FILENAME=`readlink -f "$0"`
DIR=`dirname "$ABSOLUTE_FILENAME"`
localport=11111
until [[ $a ]]; do
address=`stun stun.sipnet.ru -v -p $localport 2>&1 | grep "MappedAddress" | sort | uniq | head -n 1 | sed 's/:/ /g' | awk '{print $3" "$4}'`
ip=`echo "$address" | awk {'print $1'}`
port=`echo "$address" | awk {'print $2'}`
srv="openvpn --config $DIR/server.conf --port $localport --daemon"
$srv
echo "$(date) ะกะตัะฒะตั ะทะฐะฟััะตะฝ ั ะฒะฝะตัะฝะธะผ ะฐะดัะตัะพะผ $ip:$port"
$DIR/sendemail.sh "OpenVPN-Server" "$ip:$port"
sleep 1
openvpn --config $DIR/client.conf --remote $ip --port $port
echo "$(date) Cะพะตะดะธะฝะตะฝะธะต ะบะปะธะตะฝัะฐ ั ัะตัะฒะตัะพะผ ัะฐะทะพัะฒะฐะฝะพ"
for i in `ps xa | grep "$srv" | grep -v grep | awk '{print $1}'`; do
kill $i && echo "$(date) ะะฐะฒะตััะตะฝ ะฟัะพัะตัั ัะตัะฒะตัะฐ $i ($srv)"
done
echo "ะะดั 15 ัะตะบ"
sleep 15
doneืฉืจืืคื ืคึฟืึทืจ ืฉืืงื ืืึทืื ืืืจื ืืืืฆืคึผืึธืกื:
# cat sendemail.sh #!/bin/bash
from="ะั ะบะพะณะพ"
pass="ะะฐัะพะปั"
to="ะะพะผั"
theme="$1"
message="$2"
server="smtp.yandex.ru:587"
sendEmail -o tls=yes -f "$from" -t "$to" -s "$server" -xu "$from" -xp "$pass" -u "$theme" -m "$message"ืกืขืจืืืืจืขืจ ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข:
# cat server.confproto udp
dev tun
ca /home/vpn11-srv/ca.crt
cert /home/vpn11-srv/server.crt
key /home/vpn11-srv/server.key
dh /home/vpn11-srv/dh2048.pem
server 10.2.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
tls-server
tls-auth /home/vpn11-srv/ta.key 0
tls-timeout 60
auth SHA256
cipher AES-256-CBC
client-to-client
keepalive 10 30
comp-lzo
max-clients 10
user nobody
group nogroup
persist-key
persist-tun
log /var/log/vpn11-server.log
verb 3
mute 20ืงืืืขื ื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข:
# cat client.confclient
dev tun
proto udp
ca "/home/vpn11-srv/ca.crt"
cert "/home/vpn11-srv/client1.crt"
key "/home/vpn11-srv/client1.key"
tls-client
tls-auth "/home/vpn11-srv/ta.key" 1
auth SHA256
cipher AES-256-CBC
auth-nocache
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
log /var/log/vpn11-clent.log
verb 3
mute 20
ping 10
ping-exit 30
ืกืขืจืืืคืืงืึทืฅ ืืขื ืขื ืืืฉืขื ืขืจืืืืึทื ื ืืฆื .
ืืืืคื ืื ืฉืจืืคื:
# ./vpn11.shืืืจื ืขืจืฉืืขืจ ืืืื ืขืก ืขืงืกืขืงืืืึทืืืข
# chmod +x vpn11.shืืืืฃ ืื ืกืืึทืจืืคืึธื ืข ืืืึทื
ืืืจื ืื ืกืืึธืืื ื ืื ืึทืคึผืืึทืงืืืฉืึทื OpenVPN ืคึฟืึทืจ ืึทื ืืจืืื, ื ืึธื ืงืึทืคึผืื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข, ืกืขืจืืืคืืงืึทืฅ ืืื ืงืึทื ืคืืืืขืจื ืขืก, ืขืก ืคืืจืงืขืจื ืืืืก ืืื ืืึธืก:
ืืื ืืฉืขืง ืืืื ืืืืขืื ืืืืฃ ืืืื ืกืืึทืจืืคืึธื ืข
ืืื ืจืขืืึทืืืจื ืื ืคึผืึธืจื ื ืืืขืจ ืืื ืื ืกืขืืืื ืืก
ืืื ืงืึทืืขืจ ืืขื ืงืืืขื ื ืืื ืคืึทืจืืื ืื
ืืฉืขืช ืฉืจืืืื ืืขื ืึทืจืืืงื, ืืื ืืจืึทื ืกืคืขืจื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืคืื ืืืื ืงืึธืืคึผืืืืขืจ ืฆื ืื Raspberry Pi 3 ืืื ืืขืคืจืืืื ืฆื ืืืืคื ืื ืืื ืฆืข ืืึทื ืืืืฃ ืึท ืืืข ืืึธืืขื, ืึธืืขืจ ืขืก ืืื ื ืืฉื ืึทืจืืขืื! ืืึทืคึฟืขื ืจืขืืืืืึทื
# stun stun.ekiga.net -p 11111STUN ืงืืืขื ื ืืืขืจืกืืข 0.97
ืขืจืฉืืืง: ืืืืึธืคึผืืขื ืืืง ืืึทืคึผืื ื, ืคึผืึธืจื ืึธืคืขื ืืืง ืคึฟืืืืจืืจ, ืืจืึทืค - ืคึผืึธืจื, ืืึทืืจืคึผืื
ืฆืืจืืงืงืืืขื ืืืขืจื ืืื 0x000006
ืืืขืจื ืคึผืึธืจื ืึธืคืขื ืืืง ืคืืืืขืจ ืืื ื ืืฉื ืืึธืื ืื ืกืืกืืขื ืฆื ืึธื ืืืืื.
ืึธืืขืจ ืืขืจ ืืืื ืฉืคึผืืึทืืขืจ ืขืจืืืืื ืื ืกืืกืืขื ืฆื ืึธื ืืืืื ืืืืฃ ืื Raspberry Pi 3 ืึธื ืงืืื ืคืจืืืืขืืขื.
ืืื ืงืึทื ืืืฉืึทื ืืงืฉืึทื ืืื ืึท ืืืขืืงืึทื, ืืื VLC ืคึฟืึทืจ
ืงืจืืืืืื ื ืึท RTSP ืืืึทื ืคึฟืื ืึท ืืืขืืงืึทื
$ cvlc v4l2:///dev/video0:chroma=h264 :input-slave=alsa://hw:1,0 --sout '#transcode{vcodec=x264,venc=x264{preset=ultrafast,profile=baseline,level=31},vb=2048,fps=12,scale=1,acodec=mpga,ab=128,channels=2,samplerate=44100,scodec=none}:rtp{sdp=rtsp://10.2.0.1:8554/}' --no-sout-all --sout-keepืืื ืืืืง ืืืืฃ ืึท ืกืืึทืจืืคืึธื ืข ืคึฟืึทืจ ืืืืืื ื (ืกืืจืื rtsp://10.2.0.1:8554/), ืขืก ืืื ืืขืืืขื ืึท ืืื ืืืืึทื ืืืืืขื ืกืขืจืืืืืืึทื ืก ืกืืกืืขื, ืืืจ ืงืขื ืขื ืืืื ืื ืกืืึทืืืจื ืกืึทืืืึท, ืืึทืจืฉืจืื ืคืึทืจืงืขืจ ืืืจื ืืืคึผื, ืจืืืึธืืืื ืงืึธื ืืจืึธื ืืืื ืงืึธืืคึผืืืืขืจ ืืื ืคืื. ืืขืจ...
ืจืขืืืืืึทื
ืืื ืคืืจ ืืื ืืขืืืืื, ืฆื ืึธืจืืึทื ืืืืจื ืึท ืืืคึผื ืกืขืจืืืขืจ, ืืืจ ืงืขื ืขื ืืึธื ืึธื ืึท ืคืื ืืจืืืกื ืืืง IP ืึทืืจืขืก ืคึฟืึทืจ ืืืึธืก ืืืจ ืืึทืจืคึฟื ืฆื ืืึทืฆืึธืื, ืคึผืื ืงื ืืื ืคึฟืึทืจ ืึท ืจืขื ืืึทื ืืืคึผืก / ืืืืก. ืืืขืจ ืขืก ืึทืืข ืืขืคึผืขื ืืก ืืืืฃ ืืขืจ ืฉืคึผืืึทืืขืจ. ืืึธื, ืืื ืืขืืืืื ืฆื ืืึทืงืืืขื ืืขืจ ืืื ืคึฟืึธืจืืึทืฆืืข ืืืขืื ืื ืคืึทืจืฉืืืขื ืข ืคึผืจืึทืืืืืืขืจื ืืื ืืืืคึผืก ืคืื NAT ืืขื ืืฆื, ืึธืืขืจ ืืึธืก ืืื ื ืึธืจ ืืขืจ ืึธื ืืืื ...
ืืื ืืืืง!
ืืงืืจ: www.habr.com