OpenWRT 10.03 라우터의 OpenVPN에 대한 단계별 가이드가 있습니다: (wl500gpv2)

필수 패키지

opkg install openvpn_2.1.1-1_brcm-2.4.ipk kmod-tun_2.4.37.9-1_brcm-2.4.ipk libopenssl_0.9.8m-3_brcm-2.4.ipk liblzo_2.03-3_brcm-2.4.ipk openssl-util_0.9.8m-3_brcm-2.4.ipk ntpd_4.2.6-4_brcm-2.4.ipk

인증서 생성

# 0)
mkdir -p /etc/ssl/certs/demoCA/newcerts /etc/ssl/certs/demoCA/private /etc/ssl/private; touch /etc/ssl/certs/demoCA/index.txt; echo "01" >> /etc/ssl/certs/demoCA/serial; cd /etc/ssl/certs

# 1)
# cakey.pem: CA's private key - needed by key signing machine only, purpose: Root CA key, keep it in SECRET!!
# cacert.pem: CA's cert - needed by server + all clients, purpose: Root CA certificate, not secret
# common name: "vpnserver" - in every other case just hit enter
time openssl req -nodes -new -x509 -days 3650 -keyout /etc/ssl/certs/demoCA/private/cakey.pem -out demoCA/cacert.pem

# 2)
# server.key: needed by server only, purpose: Server Key, keep it in SECRET!!
# server.csr: [???]
# common name: "vpnserver" - in every other case just hit enter
time openssl req -nodes -new -keyout /etc/ssl/private/server.key -out server.csr # password not advised - only if you're paranoic..

# 3)
# server.crt: needed by server only, purpose: Server Certificate, not secret
# Sign the certificate? [y/n]:y
# 1 out of 1 certificate requests certified, commit? [y/n]y
time openssl ca -cert demoCA/cacert.pem -keyfile /etc/ssl/certs/demoCA/private/cakey.pem -out server.crt -in server.csr -days 3650

# 4)
# shared.key: [???]
time openvpn --genkey --secret shared.key

# 5)
# dh.pem: Diffie-Hellman file for secure SSL/TLS negotiation, identical on the server and all clients
time openssl dhparam -out dh.pem 1024

# 6)
# give a common name! it will be the user name
# client1.key: needed at client1 only, purpose: Client1 Key, keep it in SECRET!
# client1.csr: [???]
# client1.crt: needed at client1 only, purpose: Client1 Certificate, not secret
# Give the client's key file a password for better security.
time openssl req -nodes -new -keyout /etc/ssl/private/client1.key -out client1.csr
# Sign the certificate? [y/n]:y
# 1 out of 1 certificate requests certified, commit? [y/n]y
time openssl ca -out client1.crt -in client1.csr

인증서 복사

# on the router
mkdir -p /etc/ssl/certs/client1; cp demoCA/cacert.pem client1.crt /etc/ssl/private/client1.key shared.key dh.pem client1; tar -cvf /root/client1.tar client1; rm -fr /etc/ssl/certs/client1

# on the pc [with a normal user]
mkdir ~/.cert/; rm ~/.cert/*; cd ~/.cert/; scp [email protected]:/root/client1.tar ~/.cert/; tar -xvf ~/.cert/client1.tar; mv ~/.cert/client1/* .; rm -fr client1; chmod 600 ~/.cert/*

# if you're using e.g.: Fedora/SELinux, then
restorecon -Rv ~/.cert*

OpenVPN 서버 구성

mkdir /etc/openvpn; vim /etc/openvpn/server.conf

port 1194
proto udp
dev tun
ca /etc/ssl/certs/demoCA/cacert.pem
cert /etc/ssl/certs/server.crt
key /etc/ssl/private/server.key
dh /etc/ssl/certs/dh.pem
tls-auth /etc/ssl/certs/shared.key 0
server 192.168.80.0 255.255.255.0
push "redirect-gateway"
comp-lzo
keepalive 10 120
status /tmp/openvpn.status

OpenWrt 라우터의 방화벽

vim /etc/firewall.user

iptables -t nat -A prerouting_wan -p udp --dport 1194 -j ACCEPT
iptables -A input_wan -p udp --dport 1194 -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A OUTPUT -o tun+ -j ACCEPT
iptables -A FORWARD -o tun+ -j ACCEPT

재시작

sync; sync; sync
reboot

시작하고 확인하세요

openvpn --daemon --config /etc/openvpn/server.conf

root@OpenWrt:/etc/ssl/certs# ps aux | fgrep -i openvpn
941 root      2876 S    openvpn --daemon --config /etc/openvpn/server.conf 
root@OpenWrt:/etc/ssl/certs# netstat -tulpn | fgrep -i 1194
udp        0      0 0.0.0.0:1194            0.0.0.0:*                           941/openvpn
root@OpenWrt:/etc/ssl# 

클라이언트 구성

yum install openvpn
vim /etc/openvpn/client.conf

client
dev tun
proto udp
remote 192.168.1.1 1194
nobind
ca /home/USERNAME/.cert/cacert.pem
cert /home/USERNAME/.cert/client1.crt
key /home/USERNAME/.cert/client1.key
dh /home/USERNAME/.cert/dh.pem
tls-auth /home/USERNAME/.cert/shared.key 1
comp-lzo

가다!

openvpn /etc/openvpn/client.conf

---

하지만 시도한 후 클라이언트에서 다음과 같은 오류가 발생했습니다. (VPN을 사용할 때 클라이언트에서 google.com을 핑할 수 없습니다. 라우터에서만 가능합니다.)

Sat Jul  9 13:14:19 2011 OpenVPN 2.1.1 i686-redhat-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] built on Jan  5 2010
Sat Jul  9 13:14:19 2011 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sat Jul  9 13:14:19 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sat Jul  9 13:14:19 2011 Control Channel Authentication: using '/home/USERNAME/.cert/shared.key' as a OpenVPN static key file
Sat Jul  9 13:14:19 2011 LZO compression initialized
Sat Jul  9 13:14:19 2011 UDPv4 link local: [undef]
Sat Jul  9 13:14:19 2011 UDPv4 link remote: 192.168.1.1:1194
Sat Jul  9 13:14:19 2011 [vpnserver] Peer Connection Initiated with 192.168.1.1:1194
Sat Jul  9 13:14:21 2011 TUN/TAP device tun0 opened
Sat Jul  9 13:14:21 2011 /sbin/ip link set dev tun0 up mtu 1500
Sat Jul  9 13:14:21 2011 /sbin/ip addr add dev tun0 local 192.168.80.6 peer 192.168.80.5
Sat Jul  9 13:14:21 2011 OpenVPN ROUTE: omitted no-op route: 192.168.1.1/255.255.255.255 -> 192.168.1.1

Sat Jul  9 13:14:21 2011 WARNING: potential route subnet conflict between local LAN [192.168.80.0/255.255.255.0] and remote VPN [192.168.80.1/255.255.255.255]

Sat Jul  9 13:14:21 2011 Initialization Sequence Completed
^CSat Jul  9 13:16:10 2011 event_wait : Interrupted system call (code=4)
RTNETLINK answers: No such process
Sat Jul  9 13:16:10 2011 ERROR: Linux route delete command failed: external program exited with error status: 2
Sat Jul  9 13:16:10 2011 /sbin/ip addr del dev tun0 local 192.168.80.6 peer 192.168.80.5
Sat Jul  9 13:16:10 2011 SIGINT[hard,] received, process exiting

문제는 내가 뭘 잘못하고 있는 걸까요? 왜 작동하지 않나요? 내가 잘못된 서브넷을 제공했나요? 우리는 어떻게 좋은 사람들에게 줄 수 있습니까? (예: "openvpn 서버 구성"의 잘못된 "서버" 줄?)

---

토폴로지:

ISP -> OPENWRT ROUTER(192.168.1.0/24 제공) -> MYPC(고정 IP가 아닌 dhcp)

도움/팁 감사합니다. . 몇 시간 동안 Google에서 검색하고 많은 전문가에게 문의했지만 운이 없었습니다. 내 의도는 보안 "터널"(인터넷 카페 또는 언급된 토폴로지 등에서)을 얻기 위해 내 PC에서 이 openwrt 라우터로 vpn을 열려는 것입니다. Fedora 14 업데이트를 실행하는 "MYPC"

Q:
이 파일이 무엇인지 설명해 주실 수 있나요? :

서버.csr:[? ? ? ]

공유 비밀: [???]

client1.csr:[? ? ? ]