Как настроить виртуальную частную сеть (VPN) при подключении через
межсетевой фильтр (proxy, firewall)
Предположим, необходимо создать виртуальную частную сеть в которой один
или несколько компьютеров разделены сетевыми фильтрами,
позволяющими только tcp-соединения с номером порта 80 (стандарт для
www).
В любом случае, для осуществления поставленной задачи необходимо
наличие хотя бы одного общедоступного IP-адреса.
Одним из вариантов для организации виртуальной сети в жестких условиях
является пакет
OpenVPN,
в возможности которого входит "туннельное" соединение по tcp-каналу,
что не возможно,например, с pptp.
Процесс установки варьируется от системы к системе (данный пакет
является переносимым), в связи с чем предлагается выбрать конкретный
вариант
на сайте проекта
http://openvpn.net .
Стоит отметить только, что для большинства Windows-систем
инсталляционная программа сама устанавливает нужные драйверы системы.
В большинстве дистрибутивов Linux поставляемое ядро системы уже
содержит необходимый модуль для поддержки туннельных соединений.
Если, однако, вы самостаятельно выбираете параметры сборки ядра, то
убедитесь, что у вас установлены следующие параметры:
Device Drivers --->
Network device support --->
[*]Network device support
<M> Universal TUN/TAP device driver support
Рассмотрим процесс настройки и использования.
OpenVPN предполагает несимметричную структуру сети, т.е. должен
существовать по крайней мере один серверный компьютер и один или более
клиентских компьютеров.
В целях безопасности для исключения возможности ложного создания
сервера используется авторизационный сертификат (Certificate Authority)
x509.
В gentoo Linux настроечные программы пакета openvpn из системы portage
устанавливается в каталог /usr/share/openvpn/easy-rsa .
Для начала нужно запустить следующие комманды
cd /usr/share/openvpn/easy-rsa
source vars
./clean-all
./build-ca
после которой нужно будет ввести некоторые данные, например:
Generating a 1024 bit RSA private key
.........++++++
.........++++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a
DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:RU
State or Province Name (full name) [CA]:msk
Locality Name (eg, city) [SanFrancisco]:Moscow
Organization Name (eg, company) [Fort-Funston]:bexp
Organizational Unit Name (eg, section) []:programming
Common Name (eg, your name or your server's hostname) [Fort-Funston CA]:tester
Email Address [me@myhost.mydomain]:r.krylov@biznex.ru
./build-key-server server
Generating a 1024 bit RSA private key
................++++++
.++++++
writing new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a
DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:RU
State or Province Name (full name) [CA]:msk
Locality Name (eg, city) [SanFrancisco]:Moscow
Organization Name (eg, company) [Fort-Funston]:bexp
Organizational Unit Name (eg, section) []:prg
Common Name (eg, your name or your server's hostname) [server]:tester
Email Address [me@myhost.mydomain]:r.krylov@biznex.ru
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:abcd
An optional company name []:bexp
Using configuration from /usr/share/openvpn/easy-rsa/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName
:PRINTABLE:'RU'
stateOrProvinceName :PRINTABLE:'msk'
localityName
:PRINTABLE:'Moscow'
organizationName
:PRINTABLE:'bexp'
organizationalUnitName:PRINTABLE:'prg'
commonName
:PRINTABLE:'tester'
emailAddress
:IA5STRING:'r.krylov@biznex.ru'
Certificate is to be certified until Feb 13 18:42:06 2018 GMT (3650
days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
./build-key client1
Generating a 1024 bit RSA private key
......................++++++
...............++++++
writing new private key to 'client1.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a
DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:RU
State or Province Name (full name) [CA]:msk
Locality Name (eg, city) [SanFrancisco]:Moscow
Organization Name (eg, company) [Fort-Funston]:bexp
Organizational Unit Name (eg, section) []:prg
Common Name (eg, your name or your server's hostname) [client1]:
Email Address [me@myhost.mydomain]:vasya@somesite.net
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:12345
An optional company name []:bexp
Using configuration from /usr/share/openvpn/easy-rsa/openssl.cnf
DEBUG[load_index]: unique_subject = "yes"
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName
:PRINTABLE:'RU'
stateOrProvinceName :PRINTABLE:'msk'
localityName
:PRINTABLE:'Moscow'
organizationName
:PRINTABLE:'bexp'
organizationalUnitName:PRINTABLE:'prg'
commonName
:PRINTABLE:'client1'
emailAddress
:IA5STRING:'vasya@somesite.net'
Certificate is to be certified until Feb 13 18:45:58 2018 GMT (3650
days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
./build-dh
Generating DH parameters, 1024 bit long safe prime, generator
2
This is going to take a long time
.........................................................................................................
+...................................+.....................................+..............................
.......................+.................................................................................
............................+..........+..................+.............+................+...............
.........+..............................................+......................+.........................
...................................+....................+................................................
................................+...............++*++*++*
В текущем каталоге должен появиться под-каталог keys, содержащий
результаты проделанной работы.
Теперь необходимо переслать клиенту, которого мы обозначили как
client1
файлы
ca.crt
client1.crt
client1.csr
client1.key
и создать для него конфигурационный файл
client1.ovpn
на
основе примеров
http://openvpn.net/index.php/documentation/howto.html#examples
примерно так:
##############################################
# Sample client-side OpenVPN 2.0 config
file #
# for connecting to multi-client
server. #
#
#
# This configuration can be used by
multiple #
# clients, however each client should
have #
# its own cert and key
files.
#
#
#
# On Windows, you might want to rename
this #
# file so it has a .ovpn
extension
#
##############################################
# Specify that we are a client and that
we
# will be pulling certain config file
directives
# from the server.
client
# Use the same setting as you are using
on
# the server.
# On most systems, the VPN will not
function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun
# Windows needs the TAP-Win32 adapter
name
# from the Network Connections panel
# if you have more than one.
On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap
# Are we connecting to a TCP or
# UDP server? Use the same
setting as
# on the server.
proto tcp
;proto udp
# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote 10.100.4.112 80
;remote my-server-1 1194
;remote my-server-2 1194
# Choose a random host from the remote
# list for load-balancing.
Otherwise
# try hosts in the order specified.
;remote-random
# Keep trying indefinitely to resolve the
# host name of the OpenVPN
server. Very useful
# on machines which are not permanently
connected
# to the internet such as laptops.
resolv-retry infinite
# Most clients don't need to bind to
# a specific local port number.
nobind
# Downgrade privileges after
initialization (non-Windows only)
;user nobody
;group nobody
# Try to preserve some state across
restarts.
persist-key
persist-tun
# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here. See the
man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection
failures
;http-proxy [proxy server] [proxy port #]
# Wireless networks often produce a lot
# of duplicate packets. Set
this flag
# to silence duplicate packet warnings.
;mute-replay-warnings
# SSL/TLS parms.
# See the server config file for more
# description. It's best to use
# a separate .crt/.key file pair
# for each client. A single ca
# file can be used for all clients.
ca client1.crt
cert client1.crt
key client1.key
# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server". This
is an
# important precaution to protect against
# a potential attack discussed here:
# http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to
generate
# your server certificates with the
nsCertType
# field set to "server". The
build-key-server
# script in the easy-rsa folder will do
this.
;ns-cert-type server
# If a tls-auth key is used on the server
# then every client must also have the
key.
;tls-auth ta.key 1
# Select a cryptographic cipher.
# If the cipher option is used on the
server
# then you must also specify it here.
;cipher x
# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo
# Set log file verbosity.
verb 3
# Silence repeating messages
;mute 20
tun-mtu 1000
Сервер в большинстве дистрибутивов запускается скриптом
/etc/init.d/openvpn start
но в случае многих независимых конфигураций это не приветствуется.
Вместо этого для каждой виртуальной сети отдельно запускается
openvpn server.conf
где
server.conf - файл конфигурации для данной
виртуальной
сети.
На клиентской стороне туннель запускается командой
openvpn client1.ovpn
в
unix
.
В Windows правой кнопкой мыши по client1.ovpn вызывается контекстное
меню и
выбирается "Start OpenVPN on this config file".
