Debian buster lxc vpn: Unterschied zwischen den Versionen
Aus Vosp.info
V (Diskussion | Beiträge) |
F (Diskussion | Beiträge) (→TLS Error: TLS handshake failed) |
||
| (12 dazwischenliegende Versionen von 2 Benutzern werden nicht angezeigt) | |||
| Zeile 1: | Zeile 1: | ||
== VPN LXC Container Config== | == VPN LXC Container Config== | ||
| − | ## | + | |
| + | evtl muss tun noch geladen werden | ||
| + | |||
| + | <source lang="bash"> | ||
| + | modprobe tun | ||
| + | #bzw zu hinzufügen | ||
| + | /etc/modules | ||
| + | |||
| + | </source> | ||
| + | |||
| + | |||
| + | <source lang="bash"> | ||
| + | # | ||
lxc.mount.entry = /sys/kernel/debug sys/kernel/debug none bind,optional 0 0 | lxc.mount.entry = /sys/kernel/debug sys/kernel/debug none bind,optional 0 0 | ||
lxc.mount.entry = /sys/kernel/security sys/kernel/security none bind,optional 0 0 | lxc.mount.entry = /sys/kernel/security sys/kernel/security none bind,optional 0 0 | ||
| Zeile 20: | Zeile 32: | ||
lxc.apparmor.profile = unconfined | lxc.apparmor.profile = unconfined | ||
lxc.cgroup.devices.allow = c 10:200 rwm | lxc.cgroup.devices.allow = c 10:200 rwm | ||
| + | lxc.mount.entry = /dev/net/tun dev/net/tun none bind,create=file | ||
| + | </source> | ||
== VPN IN LXC Container == | == VPN IN LXC Container == | ||
=== Script === | === Script === | ||
wget https://raw.githubusercontent.com/Angristan/openvpn-install/master/openvpn-install.sh -O debian10-vpn.sh | wget https://raw.githubusercontent.com/Angristan/openvpn-install/master/openvpn-install.sh -O debian10-vpn.sh | ||
| + | |||
| + | === Server installieren === | ||
| + | ./debian10-vpn.sh | ||
| + | |||
==== Linux Networkmanager Problem ==== | ==== Linux Networkmanager Problem ==== | ||
Ändere Script | Ändere Script | ||
| − | < | + | <source lang="bash"> |
if [[ $CUSTOMIZE_ENC == "n" ]];then | if [[ $CUSTOMIZE_ENC == "n" ]];then | ||
# Use default, sane and fast parameters | # Use default, sane and fast parameters | ||
| Zeile 33: | Zeile 51: | ||
#TLS_SIG="1" # tls-crypt | #TLS_SIG="1" # tls-crypt | ||
TLS_SIG="2" # tls-auth | TLS_SIG="2" # tls-auth | ||
| − | </ | + | </source> |
| + | |||
| + | === Server Config mit client-to-client === | ||
| + | <source lang="bash"> | ||
| + | port 1194 | ||
| + | proto udp | ||
| + | dev tun | ||
| + | user nobody | ||
| + | group nogroup | ||
| + | persist-key | ||
| + | persist-tun | ||
| + | keepalive 10 120 | ||
| + | client-to-client | ||
| + | topology subnet | ||
| + | server 10.8.0.0 255.255.255.0 | ||
| + | ifconfig-pool-persist ipp.txt | ||
| + | push "dhcp-option DNS 8.8.8.8" | ||
| + | push "dhcp-option DNS 1.1.1.1" | ||
| + | push "redirect-gateway def1 bypass-dhcp" | ||
| + | dh none | ||
| + | ecdh-curve prime256v1 | ||
| + | tls-auth tls-auth.key 0 | ||
| + | crl-verify crl.pem | ||
| + | ca ca.crt | ||
| + | cert server_m57DrXUnLIw1lKfL.crt | ||
| + | key server_m57DrXUnLIw1lKfL.key | ||
| + | auth SHA256 | ||
| + | cipher AES-128-GCM | ||
| + | ncp-ciphers AES-128-GCM | ||
| + | tls-server | ||
| + | tls-version-min 1.2 | ||
| + | tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 | ||
| + | status /var/log/openvpn/status.log | ||
| + | verb 3 | ||
| + | client-config-dir ccd | ||
| + | </source> | ||
| + | |||
| + | === Neuen Client oder clients entfernen === | ||
| + | ./debian10-vpn.sh | ||
| + | |||
| + | |||
| + | === Den Clients statische Ips geben === | ||
| + | Namen der KONFIGURATIONNAME.opvn | ||
| + | <source lang=bash> | ||
| + | mkdir /etc/openvpn/ccd/ | ||
| + | cd /etc/openvpn/ccd/ | ||
| + | touch /etc/openvpn/ccd/KONFIGURATIONNAME | ||
| + | </source> | ||
| + | |||
| + | /etc/openvpn/ccd/KONFIGURATIONNAME | ||
| + | <source lang=bash> | ||
| + | ifconfig-push 10.8.0.2 255.255.255.0 | ||
| + | </source> | ||
| + | |||
| + | |||
| + | == openvpn clients == | ||
| + | [[Windows#openvpn]] | ||
| + | |||
| + | |||
| + | == Probleme == | ||
| + | |||
| + | === TLS Error: TLS handshake failed === | ||
| + | |||
| + | <source> | ||
| + | 2021-07-20 12:11:57 us=614467 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) | ||
| + | 2021-07-20 12:11:57 us=614591 TLS Error: TLS handshake failed | ||
| + | </source> | ||
| + | * https://openvpn.net/faq/tls-error-tls-key-negotiation-failed-to-occur-within-60-seconds-check-your-network-connectivity/ | ||
| + | |||
| + | <source lang=bash> | ||
| + | journalctl _COMM=openvpn -f | ||
| + | </source> | ||
Aktuelle Version vom 20. Juli 2021, 11:01 Uhr
Inhaltsverzeichnis
VPN LXC Container Config
evtl muss tun noch geladen werden
modprobe tun
#bzw zu hinzufügen
/etc/modules
#
lxc.mount.entry = /sys/kernel/debug sys/kernel/debug none bind,optional 0 0
lxc.mount.entry = /sys/kernel/security sys/kernel/security none bind,optional 0 0
lxc.mount.entry = /sys/fs/pstore sys/fs/pstore none bind,optional 0 0
lxc.mount.entry = mqueue dev/mqueue mqueue rw,relatime,create=dir,optional 0 0
##
lxc.arch = linux64
lxc.mount.entry = /dev/net/tun dev/net/tun none bind,create=file
lxc.rootfs.path = dir:/var/lib/lxc/xxxx/rootfs
lxc.uts.name = xxxx
## Network configuration
lxc.net.0.type = veth
lxc.net.0.hwaddr = xx:xx:xx:xx:xx:xx
lxc.net.0.link = vmbr1
lxc.net.0.flags = up
lxc.net.0.ipv4.address = XXX.XXX.XXX.2/32
lxc.net.0.ipv4.gateway = XXX.XXX.XXX.1
##vpn specific
lxc.apparmor.profile = unconfined
lxc.cgroup.devices.allow = c 10:200 rwm
lxc.mount.entry = /dev/net/tun dev/net/tun none bind,create=file
VPN IN LXC Container
Script
wget https://raw.githubusercontent.com/Angristan/openvpn-install/master/openvpn-install.sh -O debian10-vpn.sh
Server installieren
./debian10-vpn.sh
Linux Networkmanager Problem
Ändere Script
if [[ $CUSTOMIZE_ENC == "n" ]];then
# Use default, sane and fast parameters
...
#TLS_SIG="1" # tls-crypt
TLS_SIG="2" # tls-auth
Server Config mit client-to-client
port 1194
proto udp
dev tun
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
client-to-client
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 1.1.1.1"
push "redirect-gateway def1 bypass-dhcp"
dh none
ecdh-curve prime256v1
tls-auth tls-auth.key 0
crl-verify crl.pem
ca ca.crt
cert server_m57DrXUnLIw1lKfL.crt
key server_m57DrXUnLIw1lKfL.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
status /var/log/openvpn/status.log
verb 3
client-config-dir ccd
Neuen Client oder clients entfernen
./debian10-vpn.sh
Den Clients statische Ips geben
Namen der KONFIGURATIONNAME.opvn
mkdir /etc/openvpn/ccd/
cd /etc/openvpn/ccd/
touch /etc/openvpn/ccd/KONFIGURATIONNAME
/etc/openvpn/ccd/KONFIGURATIONNAME
ifconfig-push 10.8.0.2 255.255.255.0
openvpn clients
Probleme
TLS Error: TLS handshake failed
2021-07-20 12:11:57 us=614467 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2021-07-20 12:11:57 us=614591 TLS Error: TLS handshake failedjournalctl _COMM=openvpn -f
