리눅스에 VPN 만들기

준비물

우분투에 OpenVPN으로 만드는 방법입니다.

1. sudo apt-get install openvpn  OpenVPN package를 설치하는 명령어를 칩니다.
2. sudo 비밀번호 입력하고 Enter.
3. 설치 진행.

그리고 다음 패키지를 인스톨하세요.

1. sudo apt-get install bridge-utils.
2. edit /etc/network/interfaces 하세요.
3. 재부팅하세요. 명령어: sudo /etc/init.d/networking restart .

 /etc/network/interfaces 파일을 열어 아래처럼 수정하세요:

 

auto lo
iface lo inet loopback

auto br0
iface br0 inet static
        address 192.168.100.10
        network 192.168.100.0
        netmask 255.255.255.0
        broadcast 192.168.100.255
        gateway 192.168.100.1
        bridge_ports eth0
        bridge_fd 9
        bridge_hello 2
        bridge_maxage 12
        bridge_stp off

 

서버내 인증서 만들기

1. sudo mkdir /etc/openvpn/easy-rsa/.
2. cp -r /usr/share/doc/openvpn/examples/easy-rsa/2.0/* /etc/openvpn/easy-rsa/.
3. sudo chown -R $USER /etc/openvpn/easy-rsa/.
4. /etc/openvpn/easy-rsa/vars 아래 키값 입력.

키값:

 
export KEY_COUNTRY="US"
export KEY_PROVINCE="KY"
export KEY_CITY="Louisville"
export KEY_ORG="Monkeypantz"
export KEY_EMAIL="a@a.com"


다음 커맨드입력:

• cd /etc/openvpn/easy-rsa/
• source vars
• ./clean-all
• ./build-dh
• ./pkitool --initca
• ./pkitool --server server
• cd keys
• sudo openvpn --genkey --secret ta.key
• sudo cp server.crt server.key ca.crt dh1024.pem ta.key /etc/openvpn/

클라이언트 인증서 만들기 (PC)

다음 명령어 입력:

1. cd /etc/openvpn/easy-rsa/
2. source vars
3. ./pkitool hostname

hostname 은VPN에 연결할 PC이름.

다음과 같이 입력:

• /etc/openvpn/ca.crt
• /etc/openvpn/ta.key
• /etc/openvpn/easy-rsa/keys/hostname.crt (클라이언트 호스트네임이 파일명).
• /etc/openvpn/easy-rsa/keys/hostname.key (클라이언트 호스트네임이 파일명).

다음폴더에 카피 /etc/openvpn

VPN Server 설정

It is time to configure the actual VPN server. The first step is to copy a sample configuration file to work with. This is done with the command sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/. Now decompress the server.conf.gz file with the command sudo gzip -d /etc/openvpn/server.conf.gz. The configuration options to edit are in this file. Open server.conf up in a text editor (with administrative privileges) and edit the following options:

local 192.168.100.10
dev tap0
up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"
server-bridge 192.168.100.101 255.255.255.0 192.168.100.105 192.168.100.200
push "route 192.168.100.1 255.255.255.0"
push "dhcp-option DNS 192.168.100.201"
push "dhcp-option DOMAIN example.com"
tls-auth ta.key 0 # This file is secret
user nobody
group nogroup

If you're unsure of any of the options, here:

• The local address is the IP address of the bridged interface.
• The server-bridge is needed in the case of a bridged interface.
• The server will push out the IP address range of 192.168.100.105-200 to clients.
• The push directives are options sent to clients.

Bringing The VPN Up And Down

Before the VPN is started (or restarted) a couple of scripts will be necessary to add the tap interface to the bridge (If bridged networking is not being used, these scripts are not necessary.) These scripts will then be used by the executable for OpenVPN. The scripts are /etc/openvpn/up.sh and /etc/openvpn/down.sh.

#!/bin/sh
#This is /etc/openvpn/up.sh

BR=$1
DEV=$2
MTU=$3
/sbin/ifconfig $DEV mtu $MTU promisc up
/usr/sbin/brctl addif $BR $DEV

#!/bin/sh
#This is/etc/openvpn/down.sh


BR=$1
DEV=$2


/usr/sbin/brctl delif $BR $DEV
/sbin/ifconfig $DEV down

 

Both of the scripts will need to be executable, which is done with the chmod command:

• sudo chmod 755 /etc/openvpn/down.sh
• sudo chmod 755 /etc/openvpn/up.sh

Finally, restart OpenVPN with the command sudo /etc/init.d/openvpn restart. The VPN server is now ready to accept connections from clients (the topic of my next tutorial.)

Details, Details

One thing that is a must for a VPN is that the machine hosting the VPN has to be accessible to the outside world — assuming users are coming in from the outside world. This can be done by either giving the server an external IP address or by routing traffic from the outside in with NAT rules (which can be accomplished in various ways). It will also be critical to employ best security practices (especially if the server has an external IP address) to prevent any unwanted traffic or users from getting into the server.

 

뒤에는 귀찮아서 번역안함.....ㅋㅋ