#IT #router Remote Access VPN (FIN)
Alexey ArharovОглавление
1.1 Конфигурация экземпляра custom_config
2.3 Маршрутизация (route print)
имеем
Routerich AX3000 (далее РР) с OpenWrt 23.05.5 r24106-10cc5fcd00 / LuCI ef27870 branch git-24.330.77799-feba812 Версия ядра 5.15.167
задача
Remote Access VPN (на OpenVPN для доступа c Windows, Android, IOS)
1. OpenVPN на РР
1.1-Конфигурация экземпляра custom_config
(/etc/openvpn/my-vpn.conf)
******************* начало *******************
port 1197 # Порт по которому будет работать сервер
proto udp # Протокол может быть udp, либо tcp
dev tun # Тип подключения tap, либо tun
#=============================Сертификаты сервера ==================================//
ca /etc/openvpn/keys/ca.crt
key /etc/openvpn/keys/openwrt-ovpn-server.key
cert /etc/openvpn/keys/openwrt-ovpn-server.crt
dh /etc/openvpn/keys/dh.pem
#==================================================================================//
server 10.9.0.0 255.255.255.0 # подсеть для туннеля, может быть любой
#topology subnet # Позволяет использовать все IP адреса в сети Openvpn используемые в файлах ccd
push "route 192.168.10.0 255.255.255.0" # LAN подсеть
#push "redirect-gateway def1 bypass-dhcp" # для заворачивания всего траффика через впн
#client-to-client # позволяет клиентам openvpn подключаться друг к другу
keepalive 10 120
#comp_lzo no # не стартует с этим параметром!?
max-clients 20 # Максимальное количество подключений к серверу
#client-config-dir /etc/openvpn/ccd # директория с индивидуальными настройками клиентов
status /etc/openvpn/logs/openvpn-status.log # Статус подключения клиентов к серверу
log-append /etc/openvpn/logs/openvpn.log # Логи OpenVPN сервера
verb 3 # Качество логирования сервера
mute 20
auth-nocache
tun-mtu 1500
cipher AES-256-GCM # Шифрование
******************* конец *******************
1.2 Лог запуска
2025-04-03 12:54:27 WARNING: --topology net30 support for server configs with IPv4 pools will be removed in a future release. Please migrate to --topology subnet as soon as possible.
2025-04-03 12:54:27 OpenVPN 2.5.8 aarch64-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
2025-04-03 12:54:27 library versions: OpenSSL 3.0.15 3 Sep 2024, LZO 2.10
2025-04-03 12:54:27 net_route_v4_best_gw query: dst 0.0.0.0
2025-04-03 12:54:27 net_route_v4_best_gw result: via 84.248.208.1 dev wan
2025-04-03 12:54:27 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2025-04-03 12:54:27 Diffie-Hellman initialized with 2048 bit key
2025-04-03 12:54:27 net_route_v4_best_gw query: dst 0.0.0.0
2025-04-03 12:54:27 net_route_v4_best_gw result: via 84.248.208.1 dev wan
2025-04-03 12:54:27 TUN/TAP device tun0 opened
2025-04-03 12:54:27 net_iface_mtu_set: mtu 1500 for tun0
2025-04-03 12:54:27 net_iface_up: set tun0 up
2025-04-03 12:54:27 net_addr_ptp_v4_add: 10.9.0.1 peer 10.9.0.2 dev tun0
2025-04-03 12:54:27 /usr/libexec/openvpn-hotplug up custom_config tun0 1500 1621 10.9.0.1 10.9.0.2 init
2025-04-03 12:54:27 net_route_v4_add: 10.9.0.0/24 via 10.9.0.2 dev [NULL] table 0 metric -1
2025-04-03 12:54:27 Could not determine IPv4/IPv6 protocol. Using AF_INET
2025-04-03 12:54:27 Socket Buffers: R=[212992->212992] S=[212992->212992]
2025-04-03 12:54:27 UDPv4 link local (bound): [AF_INET][undef]:1197
2025-04-03 12:54:27 UDPv4 link remote: [AF_UNSPEC]
2025-04-03 12:54:27 MULTI: multi_init called, r=256 v=256
2025-04-03 12:54:27 IFCONFIG POOL IPv4: base=10.9.0.4 size=62
2025-04-03 12:54:27 Initialization Sequence Completed
******************* конец *******************
1.3 Лог подключения клиента
******************* начало *******************
2025-04-03 13:03:33 *.*.*.*:54580 TLS: Initial packet from [AF_INET]93.100.102.30:54580, sid=66c79405 e4a6c437
2025-04-03 13:03:33 *.*.*.*:54580 VERIFY OK: depth=1, CN=Easy-RSA CA
2025-04-03 13:03:33 *.*.*.*:54580 VERIFY OK: depth=0, CN=user1
2025-04-03 13:03:33 *.*.*.*:54580 peer info: IV_VER=2.4.12
2025-04-03 13:03:33 *.*.*.*:54580 peer info: IV_PLAT=win
2025-04-03 13:03:33 *.*.*.*:54580 peer info: IV_PROTO=2
2025-04-03 13:03:33 *.*.*.*:54580 peer info: IV_NCP=2
2025-04-03 13:03:33 *.*.*.*:54580 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM
2025-04-03 13:03:33 *.*.*.*:54580 peer info: IV_LZ4=1
2025-04-03 13:03:33 *.*.*.*:54580 peer info: IV_LZ4v2=1
2025-04-03 13:03:33 *.*.*.*:54580 peer info: IV_LZO=1
2025-04-03 13:03:33 *.*.*.*:54580 peer info: IV_COMP_STUB=1
2025-04-03 13:03:33 *.*.*.*:54580 peer info: IV_COMP_STUBv2=1
2025-04-03 13:03:33 *.*.*.*:54580 peer info: IV_TCPNL=1
2025-04-03 13:03:33 *.*.*.*:54580 peer info: IV_GUI_VER=OpenVPN_GUI_11
2025-04-03 13:03:35 *.*.*.*:54580 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA256
2025-04-03 13:03:35 *.*.*.*:54580 [user1] Peer Connection Initiated with [AF_INET]93.100.102.30:54580
2025-04-03 13:03:35 user1/*.*.*.*:54580 MULTI_sva: pool returned IPv4=10.9.0.6, IPv6=(Not enabled)
2025-04-03 13:03:35 user1/*.*.*.*:54580 MULTI: Learn: 10.9.0.6 -> user1/93.100.102.30:54580
2025-04-03 13:03:35 user1/*.*.*.*:54580 MULTI: primary virtual IP for user1/93.100.102.30:54580: 10.9.0.6
2025-04-03 13:03:35 user1/*.*.*.*:54580 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2025-04-03 13:03:35 user1/*.*.*.*:54580 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2025-04-03 13:03:39 user1/*.*.*.*:54580 PUSH: Received control message: 'PUSH_REQUEST'
2025-04-03 13:03:39 user1/*.*.*.*:54580 SENT CONTROL [user1]: 'PUSH_REPLY,route 192.168.10.0 255.255.255.0,route 10.9.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.9.0.6 10.9.0.5,peer-id 0,cipher AES-256-GCM' (status=1)
******************* конец *******************
2. Клиент user1 (Windows)
2.1 Конфигурация (user1.ovpn)
******************* начало *******************
client
dev tun
proto udp
tun-mtu 1500
float
nobind
cipher AES-256-GCM
# comp-lzo no
auth-nocache
resolv-retry infinite
remote-cert-tls server
persist-key
remote *****.ddns.net 1197
******************* конец *******************
2.2 Лог подключения
Thu Apr 03 13:03:33 2025 OpenVPN 2.4.12 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Mar 17 2022
Thu Apr 03 13:03:33 2025 Windows version 6.2 (Windows 8 or greater) 64bit
Thu Apr 03 13:03:33 2025 library versions: OpenSSL 1.1.1n 15 Mar 2022, LZO 2.10
Thu Apr 03 13:03:34 2025 TCP/UDP: Preserving recently used remote address: [AF_INET]*.*.*.*:1197
Thu Apr 03 13:03:34 2025 UDP link local: (not bound)
Thu Apr 03 13:03:34 2025 UDP link remote: [AF_INET]*.*.*.*:1197
Thu Apr 03 13:03:38 2025 [openwrt-ovpn-server] Peer Connection Initiated with [AF_INET]*.*.*.*:1197
Thu Apr 03 13:03:40 2025 open_tun
Thu Apr 03 13:03:40 2025 TAP-WIN32 device [Подключение по локальной сети] opened: \\.\Global\{D63477FB-21CD-4762-A8DE-A54EC2DB5644}.tap
Thu Apr 03 13:03:40 2025 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.9.0.6/255.255.255.252 on interface {D63477FB-21CD-4762-A8DE-A54EC2DB5644} [DHCP-serv: 10.9.0.5, lease-time: 31536000]
Thu Apr 03 13:03:40 2025 Successful ARP Flush on interface [34] {D63477FB-21CD-4762-A8DE-A54EC2DB5644}
Thu Apr 03 13:03:45 2025 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Apr 03 13:03:45 2025 Initialization Sequence Completed
******************* конец *******************
2.3 Маршрутизация (route print)
******************* начало *******************
Активные маршруты:
Сетевой адрес Маска сети Адрес шлюза Интерфейс Метрика
0.0.0.0 0.0.0.0 192.168.33.1 192.168.33.105 50
10.9.0.1 255.255.255.255 10.9.0.5 10.9.0.6 281
10.9.0.4 255.255.255.252 On-link 10.9.0.6 281
10.9.0.6 255.255.255.255 On-link 10.9.0.6 281
10.9.0.7 255.255.255.255 On-link 10.9.0.6 281
127.0.0.0 255.0.0.0 On-link 127.0.0.1 331
127.0.0.1 255.255.255.255 On-link 127.0.0.1 331
127.255.255.255 255.255.255.255 On-link 127.0.0.1 331
192.168.10.0 255.255.255.0 10.9.0.5 10.9.0.6 281
192.168.33.0 255.255.255.0 On-link 192.168.33.105 306
192.168.33.105 255.255.255.255 On-link 192.168.33.105 306
192.168.33.255 255.255.255.255 On-link 192.168.33.105 306
224.0.0.0 240.0.0.0 On-link 127.0.0.1 331
224.0.0.0 240.0.0.0 On-link 10.9.0.6 281
224.0.0.0 240.0.0.0 On-link 192.168.33.105 306
255.255.255.255 255.255.255.255 On-link 127.0.0.1 331
255.255.255.255 255.255.255.255 On-link 10.9.0.6 281
255.255.255.255 255.255.255.255 On-link 192.168.33.105 306
******************* конец *******************