Debian buster lxc vpn: Unterschied zwischen den Versionen
V (Diskussion | Beiträge) (→Server Config mit client-to-client) |
V (Diskussion | Beiträge) |
||
| Zeile 31: | Zeile 31: | ||
==== Linux Networkmanager Problem ==== | ==== Linux Networkmanager Problem ==== | ||
Ändere Script | Ändere Script | ||
| − | < | + | <source lang="bash"> |
if [[ $CUSTOMIZE_ENC == "n" ]];then | if [[ $CUSTOMIZE_ENC == "n" ]];then | ||
# Use default, sane and fast parameters | # Use default, sane and fast parameters | ||
| Zeile 37: | Zeile 37: | ||
#TLS_SIG="1" # tls-crypt | #TLS_SIG="1" # tls-crypt | ||
TLS_SIG="2" # tls-auth | TLS_SIG="2" # tls-auth | ||
| − | </ | + | </source> |
=== Server Config mit client-to-client === | === Server Config mit client-to-client === | ||
| − | < | + | <source lang=bash> |
| − | </ | + | </source> |
=== Server Config mit client-to-client === | === Server Config mit client-to-client === | ||
| − | < | + | <source lang="bash"> |
port 1194 | port 1194 | ||
proto udp | proto udp | ||
| Zeile 75: | Zeile 75: | ||
verb 3 | verb 3 | ||
client-config-dir ccd | client-config-dir ccd | ||
| − | </ | + | </source> |
=== Neuen Client oder clients entfernen === | === Neuen Client oder clients entfernen === | ||
| Zeile 83: | Zeile 83: | ||
=== Den Clients statische Ips geben === | === Den Clients statische Ips geben === | ||
Namen der KONFIGURATIONNAME.opvn | Namen der KONFIGURATIONNAME.opvn | ||
| − | < | + | <source lang=bash> |
mkdir /etc/openvpn/ccd/ | mkdir /etc/openvpn/ccd/ | ||
cd /etc/openvpn/ccd/ | cd /etc/openvpn/ccd/ | ||
touch /etc/openvpn/ccd/KONFIGURATIONNAME | touch /etc/openvpn/ccd/KONFIGURATIONNAME | ||
| − | </ | + | </source> |
/etc/openvpn/ccd/KONFIGURATIONNAME | /etc/openvpn/ccd/KONFIGURATIONNAME | ||
| − | < | + | <source lang=bash> |
ifconfig-push 10.8.0.2 255.255.255.0 | ifconfig-push 10.8.0.2 255.255.255.0 | ||
| − | </ | + | </source> |
Version vom 25. März 2020, 16:32 Uhr
Inhaltsverzeichnis
VPN LXC Container Config
lxc.mount.entry = /sys/kernel/debug sys/kernel/debug none bind,optional 0 0 lxc.mount.entry = /sys/kernel/security sys/kernel/security none bind,optional 0 0 lxc.mount.entry = /sys/fs/pstore sys/fs/pstore none bind,optional 0 0 lxc.mount.entry = mqueue dev/mqueue mqueue rw,relatime,create=dir,optional 0 0
lxc.arch = linux64 lxc.mount.entry = /dev/net/tun dev/net/tun none bind,create=file lxc.rootfs.path = dir:/var/lib/lxc/xxxx/rootfs lxc.uts.name = xxxx
- Network configuration
lxc.net.0.type = veth lxc.net.0.hwaddr = xx:xx:xx:xx:xx:xx lxc.net.0.link = vmbr1 lxc.net.0.flags = up lxc.net.0.ipv4.address = XXX.XXX.XXX.2/32 lxc.net.0.ipv4.gateway = XXX.XXX.XXX.1
- vpn specific
lxc.apparmor.profile = unconfined lxc.cgroup.devices.allow = c 10:200 rwm
VPN IN LXC Container
Script
wget https://raw.githubusercontent.com/Angristan/openvpn-install/master/openvpn-install.sh -O debian10-vpn.sh
Server installieren
./debian10-vpn.sh
Linux Networkmanager Problem
Ändere Script
if [[ $CUSTOMIZE_ENC == "n" ]];then
# Use default, sane and fast parameters
...
#TLS_SIG="1" # tls-crypt
TLS_SIG="2" # tls-auth
Server Config mit client-to-client
Server Config mit client-to-client
port 1194
proto udp
dev tun
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
client-to-client
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 1.1.1.1"
push "redirect-gateway def1 bypass-dhcp"
dh none
ecdh-curve prime256v1
tls-auth tls-auth.key 0
crl-verify crl.pem
ca ca.crt
cert server_m57DrXUnLIw1lKfL.crt
key server_m57DrXUnLIw1lKfL.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
status /var/log/openvpn/status.log
verb 3
client-config-dir ccd
Neuen Client oder clients entfernen
./debian10-vpn.sh
Den Clients statische Ips geben
Namen der KONFIGURATIONNAME.opvn
mkdir /etc/openvpn/ccd/
cd /etc/openvpn/ccd/
touch /etc/openvpn/ccd/KONFIGURATIONNAME
/etc/openvpn/ccd/KONFIGURATIONNAME
ifconfig-push 10.8.0.2 255.255.255.0
