Debian buster lxc vpn: Unterschied zwischen den Versionen

Aus Vosp.info
Wechseln zu:Navigation, Suche
(Server Config mit client-to-client)
(TLS Error: TLS handshake failed)
 
(10 dazwischenliegende Versionen von 2 Benutzern werden nicht angezeigt)
Zeile 1: Zeile 1:
 
== VPN LXC Container Config==
 
== VPN LXC Container Config==
##
+
 
 +
evtl muss tun noch geladen werden
 +
 
 +
<source lang="bash">
 +
modprobe tun
 +
#bzw zu hinzufügen
 +
/etc/modules
 +
 
 +
</source>
 +
 
 +
 
 +
<source lang="bash">
 +
#
 
lxc.mount.entry = /sys/kernel/debug sys/kernel/debug none bind,optional 0 0
 
lxc.mount.entry = /sys/kernel/debug sys/kernel/debug none bind,optional 0 0
 
lxc.mount.entry = /sys/kernel/security sys/kernel/security none bind,optional 0 0
 
lxc.mount.entry = /sys/kernel/security sys/kernel/security none bind,optional 0 0
Zeile 20: Zeile 32:
 
lxc.apparmor.profile = unconfined
 
lxc.apparmor.profile = unconfined
 
lxc.cgroup.devices.allow = c 10:200 rwm
 
lxc.cgroup.devices.allow = c 10:200 rwm
 +
lxc.mount.entry = /dev/net/tun dev/net/tun none bind,create=file
 +
</source>
  
 
== VPN IN LXC Container ==
 
== VPN IN LXC Container ==
Zeile 31: Zeile 45:
 
==== Linux Networkmanager Problem ====
 
==== Linux Networkmanager Problem ====
 
Ändere Script  
 
Ändere Script  
<code lang=bash>
+
<source lang="bash">
 
         if [[ $CUSTOMIZE_ENC == "n" ]];then
 
         if [[ $CUSTOMIZE_ENC == "n" ]];then
 
                 # Use default, sane and fast parameters
 
                 # Use default, sane and fast parameters
Zeile 37: Zeile 51:
 
                 #TLS_SIG="1" # tls-crypt
 
                 #TLS_SIG="1" # tls-crypt
 
                 TLS_SIG="2" # tls-auth
 
                 TLS_SIG="2" # tls-auth
</code>
+
</source>
=== Server Config mit client-to-client ===
 
<code lang=bash>
 
  
</code>
 
 
=== Server Config mit client-to-client ===
 
=== Server Config mit client-to-client ===
<code lang="bash">
+
<source lang="bash">
 
port 1194
 
port 1194
 
proto udp
 
proto udp
Zeile 75: Zeile 86:
 
verb 3
 
verb 3
 
client-config-dir ccd
 
client-config-dir ccd
</code>
+
</source>
  
 
=== Neuen Client oder clients entfernen ===
 
=== Neuen Client oder clients entfernen ===
Zeile 83: Zeile 94:
 
=== Den Clients statische Ips geben ===
 
=== Den Clients statische Ips geben ===
 
Namen der KONFIGURATIONNAME.opvn
 
Namen der KONFIGURATIONNAME.opvn
<code lang=bash>
+
<source lang=bash>
 
mkdir /etc/openvpn/ccd/
 
mkdir /etc/openvpn/ccd/
 
cd /etc/openvpn/ccd/
 
cd /etc/openvpn/ccd/
 
touch /etc/openvpn/ccd/KONFIGURATIONNAME
 
touch /etc/openvpn/ccd/KONFIGURATIONNAME
</code>
+
</source>
  
 
/etc/openvpn/ccd/KONFIGURATIONNAME
 
/etc/openvpn/ccd/KONFIGURATIONNAME
<code lang=bash>
+
<source lang=bash>
 
   ifconfig-push 10.8.0.2 255.255.255.0
 
   ifconfig-push 10.8.0.2 255.255.255.0
</code>
+
</source>
 +
 
 +
 
 +
== openvpn clients ==
 +
[[Windows#openvpn]]
 +
 
 +
 
 +
== Probleme ==
 +
 
 +
=== TLS Error: TLS handshake failed ===
 +
 
 +
<source>
 +
2021-07-20 12:11:57 us=614467 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
 +
2021-07-20 12:11:57 us=614591 TLS Error: TLS handshake failed
 +
</source>
 +
* https://openvpn.net/faq/tls-error-tls-key-negotiation-failed-to-occur-within-60-seconds-check-your-network-connectivity/
 +
 
 +
<source lang=bash>
 +
journalctl  _COMM=openvpn -f
 +
</source>

Aktuelle Version vom 20. Juli 2021, 11:01 Uhr

VPN LXC Container Config

evtl muss tun noch geladen werden

modprobe tun
#bzw zu hinzufügen
/etc/modules


#
lxc.mount.entry = /sys/kernel/debug sys/kernel/debug none bind,optional 0 0
lxc.mount.entry = /sys/kernel/security sys/kernel/security none bind,optional 0 0
lxc.mount.entry = /sys/fs/pstore sys/fs/pstore none bind,optional 0 0
lxc.mount.entry = mqueue dev/mqueue mqueue rw,relatime,create=dir,optional 0 0
##
lxc.arch = linux64
lxc.mount.entry = /dev/net/tun dev/net/tun none bind,create=file
lxc.rootfs.path = dir:/var/lib/lxc/xxxx/rootfs
lxc.uts.name = xxxx
## Network configuration
lxc.net.0.type = veth
lxc.net.0.hwaddr = xx:xx:xx:xx:xx:xx
lxc.net.0.link = vmbr1
lxc.net.0.flags = up
lxc.net.0.ipv4.address = XXX.XXX.XXX.2/32
lxc.net.0.ipv4.gateway = XXX.XXX.XXX.1
##vpn specific
lxc.apparmor.profile = unconfined
lxc.cgroup.devices.allow = c 10:200 rwm
lxc.mount.entry = /dev/net/tun dev/net/tun none bind,create=file

VPN IN LXC Container

Script

wget https://raw.githubusercontent.com/Angristan/openvpn-install/master/openvpn-install.sh -O debian10-vpn.sh

Server installieren

./debian10-vpn.sh


Linux Networkmanager Problem

Ändere Script

        if [[ $CUSTOMIZE_ENC == "n" ]];then
                # Use default, sane and fast parameters
                ...
                #TLS_SIG="1" # tls-crypt
                TLS_SIG="2" # tls-auth

Server Config mit client-to-client

port 1194
proto udp
dev tun
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
client-to-client
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 1.1.1.1"
push "redirect-gateway def1 bypass-dhcp"
dh none
ecdh-curve prime256v1
tls-auth tls-auth.key 0
crl-verify crl.pem
ca ca.crt
cert server_m57DrXUnLIw1lKfL.crt
key server_m57DrXUnLIw1lKfL.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
status /var/log/openvpn/status.log
verb 3
client-config-dir ccd

Neuen Client oder clients entfernen

./debian10-vpn.sh


Den Clients statische Ips geben

Namen der KONFIGURATIONNAME.opvn

mkdir /etc/openvpn/ccd/
cd /etc/openvpn/ccd/
touch /etc/openvpn/ccd/KONFIGURATIONNAME

/etc/openvpn/ccd/KONFIGURATIONNAME

   ifconfig-push 10.8.0.2 255.255.255.0


openvpn clients

Windows#openvpn


Probleme

TLS Error: TLS handshake failed

2021-07-20 12:11:57 us=614467 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2021-07-20 12:11:57 us=614591 TLS Error: TLS handshake failed
journalctl  _COMM=openvpn -f