Debian buster lxc vpn: Unterschied zwischen den Versionen

Aus Vosp.info
Wechseln zu:Navigation, Suche
Zeile 24: Zeile 24:
 
=== Script ===
 
=== Script ===
 
wget https://raw.githubusercontent.com/Angristan/openvpn-install/master/openvpn-install.sh -O debian10-vpn.sh
 
wget https://raw.githubusercontent.com/Angristan/openvpn-install/master/openvpn-install.sh -O debian10-vpn.sh
 +
 +
=== Server installieren ===
 +
./debian10-vpn.sh
 +
  
 
==== Linux Networkmanager Problem ====
 
==== Linux Networkmanager Problem ====
Zeile 33: Zeile 37:
 
                 #TLS_SIG="1" # tls-crypt
 
                 #TLS_SIG="1" # tls-crypt
 
                 TLS_SIG="2" # tls-auth
 
                 TLS_SIG="2" # tls-auth
 +
</code>
 +
=== Server Config mit client-to-client ===
 +
<code lang=bash>
 +
 +
</code>
 +
=== Server Config mit client-to-client ===
 +
<code lang=bash>
 +
port 1194
 +
proto udp
 +
dev tun
 +
user nobody
 +
group nogroup
 +
persist-key
 +
persist-tun
 +
keepalive 10 120
 +
client-to-client
 +
topology subnet
 +
server 10.8.0.0 255.255.255.0
 +
ifconfig-pool-persist ipp.txt
 +
push "dhcp-option DNS 8.8.8.8"
 +
push "dhcp-option DNS 1.1.1.1"
 +
push "redirect-gateway def1 bypass-dhcp"
 +
dh none
 +
ecdh-curve prime256v1
 +
tls-auth tls-auth.key 0
 +
crl-verify crl.pem
 +
ca ca.crt
 +
cert server_m57DrXUnLIw1lKfL.crt
 +
key server_m57DrXUnLIw1lKfL.key
 +
auth SHA256
 +
cipher AES-128-GCM
 +
ncp-ciphers AES-128-GCM
 +
tls-server
 +
tls-version-min 1.2
 +
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
 +
status /var/log/openvpn/status.log
 +
verb 3
 +
client-config-dir ccd
 +
</code>
 +
 +
=== Neuen Client oder clients entfernen ===
 +
./debian10-vpn.sh
 +
 +
 +
=== Den Clients statische Ips geben ===
 +
Namen der KONFIGURATIONNAME.opvn
 +
<code lang=bash>
 +
mkdir /etc/openvpn/ccd/
 +
cd /etc/openvpn/ccd/
 +
touch /etc/openvpn/ccd/KONFIGURATIONNAME
 +
</code>
 +
 +
/etc/openvpn/ccd/KONFIGURATIONNAME
 +
<code lang=bash>
 +
  ifconfig-push 10.8.0.2 255.255.255.0
 
</code>
 
</code>

Version vom 25. März 2020, 16:31 Uhr

VPN LXC Container Config

lxc.mount.entry = /sys/kernel/debug sys/kernel/debug none bind,optional 0 0 lxc.mount.entry = /sys/kernel/security sys/kernel/security none bind,optional 0 0 lxc.mount.entry = /sys/fs/pstore sys/fs/pstore none bind,optional 0 0 lxc.mount.entry = mqueue dev/mqueue mqueue rw,relatime,create=dir,optional 0 0

lxc.arch = linux64 lxc.mount.entry = /dev/net/tun dev/net/tun none bind,create=file lxc.rootfs.path = dir:/var/lib/lxc/xxxx/rootfs lxc.uts.name = xxxx

    1. Network configuration

lxc.net.0.type = veth lxc.net.0.hwaddr = xx:xx:xx:xx:xx:xx lxc.net.0.link = vmbr1 lxc.net.0.flags = up lxc.net.0.ipv4.address = XXX.XXX.XXX.2/32 lxc.net.0.ipv4.gateway = XXX.XXX.XXX.1

    1. vpn specific

lxc.apparmor.profile = unconfined lxc.cgroup.devices.allow = c 10:200 rwm

VPN IN LXC Container

Script

wget https://raw.githubusercontent.com/Angristan/openvpn-install/master/openvpn-install.sh -O debian10-vpn.sh

Server installieren

./debian10-vpn.sh


Linux Networkmanager Problem

Ändere Script

       if $CUSTOMIZE_ENC == "n" ;then
               # Use default, sane and fast parameters
               ...
               #TLS_SIG="1" # tls-crypt
               TLS_SIG="2" # tls-auth

Server Config mit client-to-client

Server Config mit client-to-client

port 1194 proto udp dev tun user nobody group nogroup persist-key persist-tun keepalive 10 120 client-to-client topology subnet server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 1.1.1.1" push "redirect-gateway def1 bypass-dhcp" dh none ecdh-curve prime256v1 tls-auth tls-auth.key 0 crl-verify crl.pem ca ca.crt cert server_m57DrXUnLIw1lKfL.crt key server_m57DrXUnLIw1lKfL.key auth SHA256 cipher AES-128-GCM ncp-ciphers AES-128-GCM tls-server tls-version-min 1.2 tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 status /var/log/openvpn/status.log verb 3 client-config-dir ccd

Neuen Client oder clients entfernen

./debian10-vpn.sh


Den Clients statische Ips geben

Namen der KONFIGURATIONNAME.opvn mkdir /etc/openvpn/ccd/ cd /etc/openvpn/ccd/ touch /etc/openvpn/ccd/KONFIGURATIONNAME

/etc/openvpn/ccd/KONFIGURATIONNAME

  ifconfig-push 10.8.0.2 255.255.255.0