OpenVPN adalah perangkat lunak sumber terbuka yang dapat digunakan untuk mengakses internet dengan aman saat terhubung ke jaringan yang tidak tepercaya. OpenVPN memungkinkan Anda untuk menjaga keamanan data online Anda dengan menyalurkannya melalui server terenkripsi. OpenVPN menggunakan SSL/TLS untuk pertukaran kunci dan mampu melintasi penerjemah alamat jaringan. Ada banyak perangkat lunak VPN yang tersedia di pasaran, tetapi semuanya mahal, dan/atau sulit diatur dan dikelola. Meskipun OpenVPN gratis, mudah diatur, dikonfigurasi, dan dikelola.
Dalam tutorial ini, kami akan menjelaskan cara mengatur server OpenVPN di server Debian 10.
Persyaratan
- Dua server menjalankan Debian 10.
- Alamat IP statis 192.168.0.103 dikonfigurasi pada server VPN dan 192.168.0.102 dikonfigurasi pada klien VPN.
- Kata sandi root dikonfigurasi di kedua server.
Instal OpenVPN
Pertama, Anda harus mengaktifkan penerusan IP untuk meneruskan paket jaringan dengan benar. Anda dapat melakukannya dengan mengedit file /etc/sysctl.conf:
nano /etc/sysctl.conf
Ubah baris berikut:
net.ipv4.ip_forward=1
Simpan dan tutup file, ketika Anda selesai. Kemudian, terapkan pengaturan baru dengan menjalankan perintah berikut:
sysctl -p
Selanjutnya, instal paket OpenVPN hanya dengan menjalankan perintah berikut:
apt-get install openvpn -y
Setelah penginstalan selesai, Anda dapat melanjutkan ke langkah berikutnya.
Buat Sertifikat dan Kunci Server
Pertama, Anda perlu menyalin direktori EasyRSA ke /etc/openvpn/. Anda dapat melakukannya dengan perintah berikut:
cp -r /usr/share/easy-rsa /etc/openvpn/
Selanjutnya, ubah direktori menjadi easy-rsa dan ganti nama file vars.example:
cd /etc/openvpn/easy-rsa
mv vars.example vars
Selanjutnya, buka file vars:
nano vars
Tambahkan baris berikut:
export KEY_COUNTRY="INDIA" export KEY_PROVINCE="CA" export KEY_CITY="Junagadh" export KEY_ORG="Howtoforge" export KEY_EMAIL="[email protected]" export KEY_OU="OpenVPN"
Simpan dan tutup file setelah Anda selesai. Kemudian, inisialisasi PKI dengan perintah berikut:
./easyrsa init-pki
Anda akan melihat output berikut:
Note: using Easy-RSA configuration from: ./vars init-pki complete; you may now create a CA or requests. Your newly created PKI dir is: /etc/openvpn/easy-rsa/pki
Selanjutnya, buat CA tanpa kata sandi seperti gambar di bawah ini:
./easyrsa build-ca nopass
Anda akan melihat output berikut:
Note: using Easy-RSA configuration from: ./vars Using SSL: openssl OpenSSL 1.1.1c 28 May 2019 Generating RSA private key, 2048 bit long modulus (2 primes) ...................................+++++ ..............+++++ e is 65537 (0x010001) Can't load /etc/openvpn/easy-rsa/pki/.rnd into RNG 140449484268672:error:2406F079:random number generator:RAND_load_file:Cannot open file:../crypto/rand/randfile.c:98:Filename=/etc/openvpn/easy-rsa/pki/.rnd You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Common Name (eg: your user, host, or server name) [Easy-RSA CA]:server CA creation complete and you may now import and sign cert requests. Your new CA certificate file for publishing is at: /etc/openvpn/easy-rsa/pki/ca.crt
Selanjutnya, buat kunci server dengan perintah berikut:
./easyrsa gen-req server nopass
Anda akan melihat output berikut:
Note: using Easy-RSA configuration from: ./vars Using SSL: openssl OpenSSL 1.1.1c 28 May 2019 Generating a RSA private key ...+++++ ................................................................................................................+++++ writing new private key to '/etc/openvpn/easy-rsa/pki/private/server.key.uQ7rqU8ryK' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Common Name (eg: your user, host, or server name) [server]: Keypair and certificate request completed. Your files are: req: /etc/openvpn/easy-rsa/pki/reqs/server.req key: /etc/openvpn/easy-rsa/pki/private/server.key
Selanjutnya, tandatangani sertifikat server dengan perintah berikut:
./easyrsa sign-req server server
Anda akan melihat output berikut:
Note: using Easy-RSA configuration from: ./vars
Using SSL: openssl OpenSSL 1.1.1c 28 May 2019
You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.
Request subject, to be signed as a server certificate for 1080 days:
subject=
commonName = server
Type the word 'yes' to continue, or any other input to abort.
Confirm request details: yes
Using configuration from /etc/openvpn/easy-rsa/pki/safessl-easyrsa.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'server'
Certificate is to be certified until Sep 5 15:43:29 2022 GMT (1080 days)
Write out database with 1 new entries
Data Base Updated
Certificate created at: /etc/openvpn/easy-rsa/pki/issued/server.crt
Selanjutnya, buat pertukaran kunci Diffie-Hellman dengan perintah berikut:
./easyrsa gen-dh
Anda akan melihat output berikut:
Note: using Easy-RSA configuration from: ./vars Using SSL: openssl OpenSSL 1.1.1c 28 May 2019 Generating DH parameters, 2048 bit long safe prime, generator 2 This is going to take a long time ...................+.............................................+..........................................................................................................................................................................................................................................................+.......+................................................................................+................+....................................+..........................+........................................+............................................................................................+.......................................................+............................+......................................................................................................+...................................................................................+.................+............+.+............................+...............................................................................................................................................+............+...............................................+................................................................................................................................................................................+.....................................................................................................................+...................................................................................................................................................................................................+.............................................+..................................................................................................................................+......................................................................................................................................+....................................+..................................................................................................................................................................................+................................................................................................+..............................................................................................+............................................................................................................................................................................................+...........+.................+.....+..........................................................................................................+..........................................................+............+......................................+............................................................................................................................................................................................................................................................................................................+..................................+.................................................................................+.............................+.....................................................................................................................................................................................................................+..........................+.......................................................+......................+.................................+..............................................................+.............................................................................................................................................................+........................................................................+...............................+...............................................................................................................+..............................................+......................................................+.......................+......................................................................................................................................................................................................................+............................................................................................................................+..........................+......................................................................................................................................................................+..........................................................................................+..........................................................++*++*++*++* DH parameters of size 2048 created at /etc/openvpn/easy-rsa/pki/dh.pem
Selanjutnya, buat tanda tangan HMAC dengan perintah berikut:
openvpn --genkey --secret ta.key
Terakhir, salin semua sertifikat dan kunci ke direktori /etc/openvpn:
cp ta.key /etc/openvpn/
cp pki/ca.crt /etc/openvpn/
cp pki/private/server.key /etc/openvpn/
cp pki/issued/server.crt /etc/openvpn/
cp pki/dh.pem /etc/openvpn/
Buat Sertifikat dan Kunci Klien
Selanjutnya, buat sertifikat Klien dengan perintah berikut:
./easyrsa gen-req client nopass
Anda akan melihat output berikut:
Note: using Easy-RSA configuration from: ./vars Using SSL: openssl OpenSSL 1.1.1c 28 May 2019 Generating a RSA private key ..........................................+++++ ...............+++++ writing new private key to '/etc/openvpn/easy-rsa/pki/private/client.key.wU45j6E0Dt' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Common Name (eg: your user, host, or server name) [client]: Keypair and certificate request completed. Your files are: req: /etc/openvpn/easy-rsa/pki/reqs/client.req key: /etc/openvpn/easy-rsa/pki/private/client.key
Selanjutnya, tandatangani sertifikat Klien dengan perintah berikut:
./easyrsa sign-req client client
Anda akan melihat output berikut:
Note: using Easy-RSA configuration from: ./vars
Using SSL: openssl OpenSSL 1.1.1c 28 May 2019
You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.
Request subject, to be signed as a client certificate for 1080 days:
subject=
commonName = client
Type the word 'yes' to continue, or any other input to abort.
Confirm request details: yes
Using configuration from /etc/openvpn/easy-rsa/pki/safessl-easyrsa.cnf
Enter pass phrase for /etc/openvpn/easy-rsa/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'client'
Certificate is to be certified until Sep 5 12:28:25 2022 GMT (1080 days)
Write out database with 1 new entries
Data Base Updated
Certificate created at: /etc/openvpn/easy-rsa/pki/issued/client.crt
Selanjutnya, salin semua sertifikat dan kunci klien ke direktori /etc/openvpn/client/:
cp pki/ca.crt /etc/openvpn/client/
cp pki/issued/client.crt /etc/openvpn/client/
cp pki/private/client.key /etc/openvpn/client/
Konfigurasi Server OpenVPN
Semua sertifikat dan kunci yang diperlukan untuk server dan klien sekarang dibuat. Selanjutnya, Anda perlu membuat file konfigurasi OpenVPN. Anda dapat membuatnya dengan perintah berikut:
nano /etc/openvpn/server.conf
Tambahkan konten berikut:
port 1194 proto udp dev tun ca ca.crt cert server.crt key server.key # This file should be kept secret dh dh.pem server 10.8.0.0 255.255.255.0 push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 208.67.222.222" push "dhcp-option DNS 208.67.220.220" keepalive 10 120 tls-auth ta.key 0 # This file is secret cipher AES-256-CBC user nobody group nogroup persist-key persist-tun status /var/log/openvpn/openvpn-status.log log /var/log/openvpn/openvpn.log log-append /var/log/openvpn/openvpn.log verb 3 explicit-exit-notify 1
Simpan dan tutup file. Kemudian, mulai layanan OpenVPN dengan perintah berikut:
systemctl start [email protected]
Selanjutnya, verifikasi server OpenVPN menggunakan perintah berikut:
systemctl status [email protected]
Keluaran:
? [email protected] - OpenVPN connection to server
Loaded: loaded (/lib/systemd/system/[email protected]; disabled; vendor preset: enabled)
Active: active (running) since Sat 2019-09-21 08:46:47 EDT; 6s ago
Docs: man:openvpn(8)
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
https://community.openvpn.net/openvpn/wiki/HOWTO
Main PID: 5040 (openvpn)
Status: "Initialization Sequence Completed"
Tasks: 1 (limit: 1138)
Memory: 1.7M
CGroup: /system.slice/system-openvpn.slice/[email protected]
??5040 /usr/sbin/openvpn --daemon ovpn-server --status /run/openvpn/server.status 10 --cd /etc/openvpn --config /etc/openvpn/server.
Sep 21 08:46:47 debian systemd[1]: Starting OpenVPN connection to server...
Sep 21 08:46:47 debian systemd[1]: Started OpenVPN connection to server.
Instal dan Konfigurasi Klien OpenVPN
Selanjutnya, masuk ke sistem klien OpenVPN dan instal paket OpenVPN dengan perintah berikut:
apt-get install openvpn -y
Setelah terinstal, buat file konfigurasi baru untuk Klien OpenVPN:
nano /etc/openvpn/client.conf
Tentukan alamat IP server Anda dan file sertifikat klien seperti yang ditunjukkan di bawah ini:
client dev tun proto udp remote 192.168.0.103 1194 resolv-retry infinite nobind user nobody group nogroup persist-key persist-tun ca ca.crt cert client.crt key client.key remote-cert-tls server tls-auth ta.key 1 cipher AES-256-CBC verb 3
Simpan dan tutup file. Kemudian, salin semua sertifikat klien dan file kunci dari server OpenVPN ke sistem klien OpenVPN dengan perintah berikut:
scp [email protected]:/etc/openvpn/client/ca.crt /etc/openvpn/
scp [email protected]:/etc/openvpn/client/client.crt /etc/openvpn/
scp [email protected]:/etc/openvpn/client/client.key /etc/openvpn/
scp [email protected]:/etc/openvpn/ta.key /etc/openvpn/
Selanjutnya, mulai layanan klien OpenVPN dengan perintah berikut:
systemctl start [email protected]
Sekarang, Anda dapat melihat alamat IP baru yang ditetapkan oleh server OpenVPN dengan perintah berikut:
ifconfig
Anda akan melihat output berikut:
enp0s3: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.0.102 netmask 255.255.255.0 broadcast 192.168.0.255
inet6 fe80::a00:27ff:fe99:dc40 prefixlen 64 scopeid 0x20
ether 08:00:27:99:dc:40 txqueuelen 1000 (Ethernet)
RX packets 447 bytes 42864 (41.8 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 334 bytes 47502 (46.3 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10
loop txqueuelen 1000 (Local Loopback)
RX packets 57 bytes 9754 (9.5 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 57 bytes 9754 (9.5 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1500
inet 10.8.0.6 netmask 255.255.255.255 destination 10.8.0.5
inet6 fe80::52b5:a1d2:fa23:f51e prefixlen 64 scopeid 0x20
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (UNSPEC)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 9 bytes 472 (472.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
Selanjutnya, masuk ke sistem server OpenVPN dan periksa log OpenVPN dengan perintah berikut:
tail -f /var/log/openvpn/openvpn.log
Anda akan mendapatkan output berikut:
Sun Sep 22 19:46:08 2019 192.168.0.103:45700 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA Sun Sep 22 19:46:08 2019 192.168.0.103:45700 [_] Peer Connection Initiated with [AF_INET]192.168.0.103:45700 Sun Sep 22 19:46:08 2019 _/192.168.0.103:45700 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled) Sun Sep 22 19:46:08 2019 _/192.168.0.103:45700 MULTI: Learn: 10.8.0.6 -> _/192.168.0.103:45700 Sun Sep 22 19:46:08 2019 _/192.168.0.103:45700 MULTI: primary virtual IP for _/192.168.0.103:45700: 10.8.0.6 Sun Sep 22 19:46:09 2019 _/192.168.0.103:45700 PUSH: Received control message: 'PUSH_REQUEST' Sun Sep 22 19:46:09 2019 _/192.168.0.103:45700 SENT CONTROL [_]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5,peer-id 0,cipher AES-256-GCM' (status=1) Sun Sep 22 19:46:09 2019 _/192.168.0.103:45700 Data Channel: using negotiated cipher 'AES-256-GCM' Sun Sep 22 19:46:09 2019 _/192.168.0.103:45700 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key Sun Sep 22 19:46:09 2019 _/192.168.0.103:45700 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Selamat! Anda telah berhasil menginstal dan mengonfigurasi server OpenVPN dan Klien di Debian 10.
Cara Menginstal GlassFish dengan Nginx sebagai Reverse Proxy di Debian 10
Cara Install WildFly dengan Nginx sebagai Reverse Proxy di Debian 10