Debian buster lxc vpn: Unterschied zwischen den Versionen
V (Diskussion | Beiträge) |
V (Diskussion | Beiträge) (→Server Config mit client-to-client) |
||
| Zeile 43: | Zeile 43: | ||
</code> | </code> | ||
=== Server Config mit client-to-client === | === Server Config mit client-to-client === | ||
| − | <code lang=bash> | + | <code lang="bash"> |
port 1194 | port 1194 | ||
proto udp | proto udp | ||
Version vom 25. März 2020, 16:31 Uhr
Inhaltsverzeichnis
VPN LXC Container Config
lxc.mount.entry = /sys/kernel/debug sys/kernel/debug none bind,optional 0 0 lxc.mount.entry = /sys/kernel/security sys/kernel/security none bind,optional 0 0 lxc.mount.entry = /sys/fs/pstore sys/fs/pstore none bind,optional 0 0 lxc.mount.entry = mqueue dev/mqueue mqueue rw,relatime,create=dir,optional 0 0
lxc.arch = linux64 lxc.mount.entry = /dev/net/tun dev/net/tun none bind,create=file lxc.rootfs.path = dir:/var/lib/lxc/xxxx/rootfs lxc.uts.name = xxxx
- Network configuration
lxc.net.0.type = veth lxc.net.0.hwaddr = xx:xx:xx:xx:xx:xx lxc.net.0.link = vmbr1 lxc.net.0.flags = up lxc.net.0.ipv4.address = XXX.XXX.XXX.2/32 lxc.net.0.ipv4.gateway = XXX.XXX.XXX.1
- vpn specific
lxc.apparmor.profile = unconfined lxc.cgroup.devices.allow = c 10:200 rwm
VPN IN LXC Container
Script
wget https://raw.githubusercontent.com/Angristan/openvpn-install/master/openvpn-install.sh -O debian10-vpn.sh
Server installieren
./debian10-vpn.sh
Linux Networkmanager Problem
Ändere Script
if $CUSTOMIZE_ENC == "n" ;then
# Use default, sane and fast parameters
...
#TLS_SIG="1" # tls-crypt
TLS_SIG="2" # tls-auth
Server Config mit client-to-client
Server Config mit client-to-client
port 1194
proto udp
dev tun
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
client-to-client
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 1.1.1.1"
push "redirect-gateway def1 bypass-dhcp"
dh none
ecdh-curve prime256v1
tls-auth tls-auth.key 0
crl-verify crl.pem
ca ca.crt
cert server_m57DrXUnLIw1lKfL.crt
key server_m57DrXUnLIw1lKfL.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
status /var/log/openvpn/status.log
verb 3
client-config-dir ccd
Neuen Client oder clients entfernen
./debian10-vpn.sh
Den Clients statische Ips geben
Namen der KONFIGURATIONNAME.opvn
mkdir /etc/openvpn/ccd/
cd /etc/openvpn/ccd/
touch /etc/openvpn/ccd/KONFIGURATIONNAME
/etc/openvpn/ccd/KONFIGURATIONNAME
ifconfig-push 10.8.0.2 255.255.255.0
