LinuxForum.Fans
Тема

[Решено] Сервер на linux Open VPN + клиент на Pocket PC

Автор: leksstav 1 сообщений 3334 просмотров
#17162

Есть настроенный Open VPN сервер клиенты конектятся зер гуд и с линукса и с винды. Необходимо организовать доступ для мобильных клиентов у которых есть кпк. Связь через GPRS и 3G
Есть статья http://silinio.webhost.ru/openvpn-pocketpc.html
Но, она очень сжатая и не раскрытая.

Вот мой конфиг клиента Open VPN для windows или linux подходит ко всем

client
dev tap
proto tcp
remote XXX.XXX.XXX.XXX 1194 # XXX это внешний ip тачки
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert adm.crt
key adm.key
comp-lzo
verb 3


Это конфиг сервера Open VPN

port 1194
proto tcp
dev tap
ca ca.crt
cert trust.crt
key trust.key # This file should be kept secret
dh dh1024.pem
server 192.168.99.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.100.0 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS 192.168.99.1"
push "dhcp-option WINS 192.168.99.1"
keepalive 10 120
comp-lzo
max-clients 10
user nobody
group nobody
persist-key
persist-tun
verb 2

Вот дефолтовый конфиг который появляется на кпк после установки Open VPN

text
#this is a sample configuration file that I have used successfully.  I included it
#as a reference baseline that can be used when testing.

#remote myvpnserver.dyndns.org 443 client proto tcp nobind dev tun comp-lzo

verb 3

resolv-retry infinite persist-key persist-tun

#explicit Windows Connection Manager provider selection; like what is on #the Settings 2 tab, but can be set here in the config file. Use either #the provider name or GUID (if you know it). The 1 indicates 'exclusive'. ;conmgr "Sprint" 1 ;conmgr {F079757F-9357-4000-8305-9CA6B9B6CAEC} 1

#especially if we are using the connection manager 'exclusive', then you'll #need to redirect the gateway since the connection provided by connection #manager will be otherwise unavailable (i.e., 'exclusive'). You'll probably #need to specify an alternate DNS server as well. These can be pushed from #the server, or if you don't want to push them you can explicitly set them #here in the client file ;redirect-gateway def1 ;dhcp-option DNS 192.168.173.1

#crypto certificate stuff================================ #In version 2.1, you can put the files inline using an xml-esque syntax. #Shown here is the syntax (with the equivalent old-style form commented out). #Essentially, you copy the contents of the relevant file here, between #the tags.

#Note, the crypto files included here were generated for the purpose #of demonstration only, and are not valid on any server anywhere.

#tls-auth settings; if needed.=========

ns-cert-type server #tls-auth "\\Program Files\\OpenVPN\\crypto\\testtlsauth.key" 1 <tls-auth> # # 2048 bit OpenVPN static key # -----BEGIN OpenVPN Static key V1----- 561966e5f439fb0cc7f87b4df2d39afb 98b2f47fa1e3321b1802e7396bdd8c6c 8f190792ddc2a3e4d8a6191c376498d8 8d86be0d8618fd2ef8243047dd037925 2eb5300f0f62553e6c6140aa1c1304dc 19e4b0d75a081bed320d7595dfd8c9eb 825dd08870635a63e157a65a0c9040ab d64af30902f1aa0a773285d3037b4121 39c457b3caa2d80754118c5fc37e7d9e bb36fd5a3abedce0de3976a6c40d2790 6802c56427be84c616a6ad7ae26c896f b08efafde0b95d5fdb07b4ec164cd5ee bee059c356c3423b27ccfe3b5df8ba00 7e2cca2150f11a2c2f93b095272c00eb 8f502fa4c9444bf728f22739c8669e57 aa9aa0e910ee0a3b913d886bedd767c4 -----END OpenVPN Static key V1----- </tls-auth> key-direction 1

#The CA's certificate==================

#ca "\\Program Files\\OpenVPN\\crypto\\test_ca.crt" <ca> -----BEGIN CERTIFICATE----- MIIDcjCCAtugAwIBAgIBATANBgkqhkiG9w0BAQQFADBzMRAwDgYDVQQDFAd0ZXN0 X2NhMQswCQYDVQQGEwJVUzERMA8GA1UEBxMIQW55d2hlcmUxCzAJBgNVBAgTAlBB MRAwDgYDVQQKEwd0ZXN0b3JnMSAwHgYJKoZIhvcNAQkBFhFqcWRvZUB0ZXN0b3Jn Lm9yZzAeFw0wNjExMjYwMDAwMDBaFw0xNjExMjMyMzU5NTlaMHMxEDAOBgNVBAMU B3Rlc3RfY2ExCzAJBgNVBAYTAlVTMREwDwYDVQQHEwhBbnl3aGVyZTELMAkGA1UE CBMCUEExEDAOBgNVBAoTB3Rlc3RvcmcxIDAeBgkqhkiG9w0BCQEWEWpxZG9lQHRl c3Rvcmcub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPCS1knzlKbF9A atth2mKzPNppWL8XyYMVtTD95BIsK1Rv0aV/tzjDCOByWDO11n/JhOHGgDuRr1TJ PQGUgXbImVSMtv975lowZbHW8Hi12XXAr5ab8wGRtBy4UwHG4AdUGVZHonGrwbes Fe2oTGGwImUMjeFwGKGi3jdi+tYPawIDAQABo4IBFDCCARAwDwYDVR0TAQH/BAUw AwEB/zAdBgNVHQ4EFgQU8U6O+/4K3bKx9ne0q5nIkPCG54AwgZ0GA1UdIwSBlTCB koAU8U6O+/4K3bKx9ne0q5nIkPCG54Chd6R1MHMxEDAOBgNVBAMUB3Rlc3RfY2Ex CzAJBgNVBAYTAlVTMREwDwYDVQQHEwhBbnl3aGVyZTELMAkGA1UECBMCUEExEDAO BgNVBAoTB3Rlc3RvcmcxIDAeBgkqhkiG9w0BCQEWEWpxZG9lQHRlc3Rvcmcub3Jn ggEBMAsGA1UdDwQEAwIBBjARBglghkgBhvhCAQEEBAMCAAcwHgYJYIZIAYb4QgEN BBEWD3hjYSBjZXJ0aWZpY2F0ZTANBgkqhkiG9w0BAQQFAAOBgQAoAOldlLjDsedO GSQyISqe4J6E87Y7azgy7x3qtkMkAK4Fs3CYRU4SIgLYefUXm0xV3G8vC0bl+wie eEhf+YJlShHMbQnU2MiAz9gGegsnWJPDdCFUZZWKl3uC6QDHJDeKXRTuvPlYs90i 9fZnB9ed4fWyDFkOCgzGNmZOb/7Gmg== -----END CERTIFICATE----- </ca>

#The vpn client's certificate==========

#cert "\\Program Files\\OpenVPN\\crypto\\OpenVPNClient.crt" <cert> -----BEGIN CERTIFICATE----- MIIDlzCCAwCgAwIBAgIBAzANBgkqhkiG9w0BAQQFADBzMRAwDgYDVQQDFAd0ZXN0 X2NhMQswCQYDVQQGEwJVUzERMA8GA1UEBxMIQW55d2hlcmUxCzAJBgNVBAgTAlBB MRAwDgYDVQQKEwd0ZXN0b3JnMSAwHgYJKoZIhvcNAQkBFhFqcWRvZUB0ZXN0b3Jn Lm9yZzAeFw0wNjExMjYxODM2NTJaFw0xMTExMjUxODM2NTJaMHsxFjAUBgNVBAMT DU9wZW5WUE5DbGllbnQxCzAJBgNVBAYTAlRYMREwDwYDVQQHEwhBbnl3aGVyZTEL MAkGA1UECBMCUEExEDAOBgNVBAoTB3Rlc3RvcmcxIjAgBgkqhkiG9w0BCQEWE2ph bmVkb2VAdGVzdG9yZy5vcmcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMWi RsIa+rTOsJMExqqhBl5GDLqxrIlfjTN6AdBiJ6qNSrPu1ClB6ymADWSLQbolI2Ga WV/riw28yfNN4lWXGOBAtJRcXc1jrv+5l2Vu2pBbkQMTEVb9X4n84svO8XNA8toH x0Bplaaam651rzDcdNjH9okWNLNW3CZzXEFUCjr3AgMBAAGjggExMIIBLTAMBgNV HRMBAf8EAjAAMB0GA1UdDgQWBBRGMzHbHCod81m8dCwSPvoHclUiNDCBnQYDVR0j BIGVMIGSgBTxTo77/grdsrH2d7SrmciQ8IbngKF3pHUwczEQMA4GA1UEAxQHdGVz dF9jYTELMAkGA1UEBhMCVVMxETAPBgNVBAcTCEFueXdoZXJlMQswCQYDVQQIEwJQ QTEQMA4GA1UEChMHdGVzdG9yZzEgMB4GCSqGSIb3DQEJARYRanFkb2VAdGVzdG9y Zy5vcmeCAQEwCwYDVR0PBAQDAgSwMB4GA1UdEQQXMBWBE2phbmVkb2VAdGVzdG9y Zy5vcmcwEQYJYIZIAYb4QgEBBAQDAgWgMB4GCWCGSAGG+EIBDQQRFg94Y2EgY2Vy dGlmaWNhdGUwDQYJKoZIhvcNAQEEBQADgYEADgon5tGiZKspNLXGLh4w4fx1+fql HNC8xbjUGs+apOkjQMIHVLX1un95eaO3X2tcJdIomaN7fsbvHpvPFdyEJERCHjQP zA5Vsg+Yis2FR+oJSlwF+N2jLZPWn4Y1YzxsBvj5FA/hwZYFmN++qdAWXPtPgEZG h7fHIOoFpiuKQ+o= -----END CERTIFICATE----- </cert>

#The vpn client's private! key=========

#key "\\Program Files\\OpenVPN\\crypto\\OpenVPNClient.key" <key> -----BEGIN RSA PRIVATE KEY----- MIICXAIBAAKBgQDFokbCGvq0zrCTBMaqoQZeRgy6sayJX40zegHQYieqjUqz7tQp QespgA1ki0G6JSNhmllf64sNvMnzTeJVlxjgQLSUXF3NY67/uZdlbtqQW5EDExFW /V+J/OLLzvFzQPLaB8dAaZWmmpuuda8w3HTYx/aJFjSzVtwmc1xBVAo69wIDAQAB AoGAboWjoGVKEtcLtAwVtdI7J3lxIO6/mEtRQZpXbVuW5zAAuMM07qWohxrPYozm At1F/g09MgEdUF9laKUDj+3hwHrmybBCCAghp1r06JJpyafp23qeEdtPtG8iZ9ne PRTd7Msm35biSYp+7kaNRpxLNjY41wS6pf2zXyt7BiK+ogECQQDyYtQv9pObRm6Z O72LO/H8mZQ3vfCOuXJr8wsuSyvTCOxoo6bBfurfTsYhunChQv9L53a1fapNwPcP d1qw0guBAkEA0Lv5bdrE+ojz8iEnHljPZMugnVDwJxVoHHoTjSy7xxPBuG1UITIK q6oqcALL7Vda/YZ+FuLMWPaMu1Ekn7/idwJAK1asZd8KyWqwf8mEvI59WBMFw2m8 x2g1I0QTrbVXIqanzpXkTRiqWj81gfZaCRt3llTOjujnOHvWMPfASXllAQJAW1X1 dflleg9VV1zkZiYMUhm8JTpWa3O1g8hzJ7IsVJczjETirEfeXXFvcmX239r6qLci E1eYfVEdEZYXBYQMTwJBAIE502O8anNsVQp28z7sZw5noaGrb68HZsvV+qqRp9Pl JU6XMKyL6pM3YSHVk4CDxF9dyMldzFSU4Fm0mkb/l0w= -----END RSA PRIVATE KEY----- </key>

Кто имеет пример настройки для кпк просьба выложить пример рабочего конфига.
Подробно этапы настройки.

Все получилось :-))))

remote XXX.XXX.XXX.XXX
dev tap
port 1194
tun-mtu 1500
client
proto tcp
nobind
comp-lzo
verb 3
resolv-retry infinite
persist-key
persist-tun
<ca>
-----BEGIN CERTIFICATE-----
Сюда копируем данные из ca.crt
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
Сюда копируем данные из ad.crt
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN RSA PRIVATE KEY-----
Сюда копируем данные из ad.key
-----END RSA PRIVATE KEY-----
</key>";

И все прекрасно работает, а если ваш кпк поддерживает ещё и 3G то счастье получается с хорошей скоростью :-)
Админить по ssh если нет ноута вполне можно :-)

Войдите или зарегистрируйтесь, чтобы ответить.