Debian buster lxc vpn: Unterschied zwischen den Versionen
V (Diskussion | Beiträge) |
V (Diskussion | Beiträge) |
||
| Zeile 24: | Zeile 24: | ||
=== Script === | === Script === | ||
wget https://raw.githubusercontent.com/Angristan/openvpn-install/master/openvpn-install.sh -O debian10-vpn.sh | wget https://raw.githubusercontent.com/Angristan/openvpn-install/master/openvpn-install.sh -O debian10-vpn.sh | ||
| + | |||
| + | === Server installieren === | ||
| + | ./debian10-vpn.sh | ||
| + | |||
==== Linux Networkmanager Problem ==== | ==== Linux Networkmanager Problem ==== | ||
| Zeile 33: | Zeile 37: | ||
#TLS_SIG="1" # tls-crypt | #TLS_SIG="1" # tls-crypt | ||
TLS_SIG="2" # tls-auth | TLS_SIG="2" # tls-auth | ||
| + | </code> | ||
| + | === Server Config mit client-to-client === | ||
| + | <code lang=bash> | ||
| + | |||
| + | </code> | ||
| + | === Server Config mit client-to-client === | ||
| + | <code lang=bash> | ||
| + | port 1194 | ||
| + | proto udp | ||
| + | dev tun | ||
| + | user nobody | ||
| + | group nogroup | ||
| + | persist-key | ||
| + | persist-tun | ||
| + | keepalive 10 120 | ||
| + | client-to-client | ||
| + | topology subnet | ||
| + | server 10.8.0.0 255.255.255.0 | ||
| + | ifconfig-pool-persist ipp.txt | ||
| + | push "dhcp-option DNS 8.8.8.8" | ||
| + | push "dhcp-option DNS 1.1.1.1" | ||
| + | push "redirect-gateway def1 bypass-dhcp" | ||
| + | dh none | ||
| + | ecdh-curve prime256v1 | ||
| + | tls-auth tls-auth.key 0 | ||
| + | crl-verify crl.pem | ||
| + | ca ca.crt | ||
| + | cert server_m57DrXUnLIw1lKfL.crt | ||
| + | key server_m57DrXUnLIw1lKfL.key | ||
| + | auth SHA256 | ||
| + | cipher AES-128-GCM | ||
| + | ncp-ciphers AES-128-GCM | ||
| + | tls-server | ||
| + | tls-version-min 1.2 | ||
| + | tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 | ||
| + | status /var/log/openvpn/status.log | ||
| + | verb 3 | ||
| + | client-config-dir ccd | ||
| + | </code> | ||
| + | |||
| + | === Neuen Client oder clients entfernen === | ||
| + | ./debian10-vpn.sh | ||
| + | |||
| + | |||
| + | === Den Clients statische Ips geben === | ||
| + | Namen der KONFIGURATIONNAME.opvn | ||
| + | <code lang=bash> | ||
| + | mkdir /etc/openvpn/ccd/ | ||
| + | cd /etc/openvpn/ccd/ | ||
| + | touch /etc/openvpn/ccd/KONFIGURATIONNAME | ||
| + | </code> | ||
| + | |||
| + | /etc/openvpn/ccd/KONFIGURATIONNAME | ||
| + | <code lang=bash> | ||
| + | ifconfig-push 10.8.0.2 255.255.255.0 | ||
</code> | </code> | ||
Version vom 25. März 2020, 16:31 Uhr
Inhaltsverzeichnis
VPN LXC Container Config
lxc.mount.entry = /sys/kernel/debug sys/kernel/debug none bind,optional 0 0 lxc.mount.entry = /sys/kernel/security sys/kernel/security none bind,optional 0 0 lxc.mount.entry = /sys/fs/pstore sys/fs/pstore none bind,optional 0 0 lxc.mount.entry = mqueue dev/mqueue mqueue rw,relatime,create=dir,optional 0 0
lxc.arch = linux64 lxc.mount.entry = /dev/net/tun dev/net/tun none bind,create=file lxc.rootfs.path = dir:/var/lib/lxc/xxxx/rootfs lxc.uts.name = xxxx
- Network configuration
lxc.net.0.type = veth lxc.net.0.hwaddr = xx:xx:xx:xx:xx:xx lxc.net.0.link = vmbr1 lxc.net.0.flags = up lxc.net.0.ipv4.address = XXX.XXX.XXX.2/32 lxc.net.0.ipv4.gateway = XXX.XXX.XXX.1
- vpn specific
lxc.apparmor.profile = unconfined lxc.cgroup.devices.allow = c 10:200 rwm
VPN IN LXC Container
Script
wget https://raw.githubusercontent.com/Angristan/openvpn-install/master/openvpn-install.sh -O debian10-vpn.sh
Server installieren
./debian10-vpn.sh
Linux Networkmanager Problem
Ändere Script
if $CUSTOMIZE_ENC == "n" ;then
# Use default, sane and fast parameters
...
#TLS_SIG="1" # tls-crypt
TLS_SIG="2" # tls-auth
Server Config mit client-to-client
Server Config mit client-to-client
port 1194
proto udp
dev tun
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
client-to-client
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 1.1.1.1"
push "redirect-gateway def1 bypass-dhcp"
dh none
ecdh-curve prime256v1
tls-auth tls-auth.key 0
crl-verify crl.pem
ca ca.crt
cert server_m57DrXUnLIw1lKfL.crt
key server_m57DrXUnLIw1lKfL.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
status /var/log/openvpn/status.log
verb 3
client-config-dir ccd
Neuen Client oder clients entfernen
./debian10-vpn.sh
Den Clients statische Ips geben
Namen der KONFIGURATIONNAME.opvn
mkdir /etc/openvpn/ccd/
cd /etc/openvpn/ccd/
touch /etc/openvpn/ccd/KONFIGURATIONNAME
/etc/openvpn/ccd/KONFIGURATIONNAME
ifconfig-push 10.8.0.2 255.255.255.0
