Pelajari cara menginstal dan mengkonfigurasi OpenVPN Server di Rocky Linux 8 dengan mengikuti tautan di bawah ini;
Siapkan Server OpenVPN di Rocky Linux 8
Instal dan Konfigurasi Klien OpenVPN di Rocky Linux 8
Instal Klien OpenVPN di Rocky Linux 8
Instal klien OpenVPN di Rocky Linux 8 dengan menjalankan perintah di bawah ini;
dnf epel-release -y
dnf info openvpn
Available Packages
Name : openvpn
Version : 2.4.11
Release : 1.el8
Architecture : x86_64
Size : 543 k
Source : openvpn-2.4.11-1.el8.src.rpm
Repository : epel
Summary : A full-featured SSL VPN solution
URL : https://community.openvpn.net/
License : GPLv2
Description : OpenVPN is a robust and highly flexible tunneling application that uses all
: of the encryption, authentication, and certification features of the
: OpenSSL library to securely tunnel IP networks over a single UDP or TCP
: port. It can use the Marcus Franz Xaver Johannes Oberhumers LZO library
: for compression
Anda kemudian dapat menginstal klien OpenVPN dengan menjalankan perintah;
dnf install openvpn
Konfigurasi Klien OpenVPN di Rocky Linux 8
Untuk dapat terhubung ke server OpenVPN, Anda perlu membuat konfigurasi klien yang berisi sertifikat CA, sertifikat server klien, dan kunci.
Jika Anda mengikuti panduan kami tentang menyiapkan server OpenVPN di Rocky Linux 8, kami menjelaskan cara membuat file dan kunci sertifikat klien.
Setelah Anda membuat kunci, salin ke klien dan catat jalur penyimpanannya.
Anda juga perlu menyalin kunci HMAC dan sertifikat CA ke klien.
Anda kemudian dapat membuat konfigurasi klien OpenVPN.
Misalnya, untuk membuat file konfigurasi OpenVPN untuk klien, gentoo , yang memiliki sertifikat dan kunci, gentoo.crt dan gentoo.key;
vim gentoo.ovpn
client tls-client pull dev tun proto udp4 remote 192.168.60.19 1194 resolv-retry infinite nobind #user nobody #group nogroup persist-key persist-tun key-direction 1 remote-cert-tls server auth-nocache comp-lzo verb 3 auth SHA512 tls-auth ta.key 1 ca ca.crt cert gentoo.crt key gentoo.key
Perhatikan bahwa dalam pengaturan ini, sertifikat klien, kunci, sertifikat CA, dan kunci HMAC terletak di jalur yang sama dengan konfigurasi klien OpenVPN itu sendiri, gentoo.ovpn.
ls -1 .
ca.crt
gentoo.crt
gentoo.key
gentoo.ovpn
ta.keyUntuk menghindari masalah dengan jalur ke sertifikat dan kunci, Anda dapat meletakkannya sebaris pada file konfigurasi;
client
tls-client
pull
dev tun
proto udp4
remote 192.168.60.19 1194
resolv-retry infinite
nobind
#user nobody
#group nogroup
persist-key
persist-tun
key-direction 1
remote-cert-tls server
auth-nocache
comp-lzo
verb 3
auth SHA512
<tls-auth>
-----BEGIN OpenVPN Static key V1-----
feb1af5407baa247d4e772c76aed6c75
...
-----END OpenVPN Static key V1-----
</tls-auth>
<ca>
-----BEGIN CERTIFICATE-----
MIIDTjCCAjagAwIBAgIUX0VQrHTgLDabUUIOAf7tD9cGp4YwDQYJKoZIhvcNAQEL
...
WA9BBk2shVWfR849Lmkep+GPyqHpU47dZAz37ARB2Gfu3w==
-----END CERTIFICATE-----
</ca>
<cert>
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
...
/7FvJaeLqmUHnvSs5eBlRZSgtOL19SCFkG0HXdnw3LtBaoHQXxgzOkDPW1+5
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC+DI7kg6MsRoCs
...
6WdLcNtWKAcU294xJEZoOA8/
-----END PRIVATE KEY-----
</key>
Lakukan hal yang sama pada semua server klien untuk setiap pengguna yang perlu terhubung ke vpn.
Jika Anda perhatikan, baris di bawah ini diberi komentar untuk menghindari kesalahan, ERROR:Linux route add command failed:external program exited with error status:2 dengan menghapus rute yang dibuat sebelum menambahkannya lagi saat koneksi ulang.
#user nobody #group nogroup
File konfigurasi klien OpenVPN sekarang siap.
Menghubungkan ke Server OpenVPN di Rocky Linux 8
Anda kemudian dapat terhubung ke server OpenVPN sesuai permintaan atau mengonfigurasi server Anda untuk membuat file konfigurasi VPN setiap kali sistem di-boot ulang.
Hubungkan ke OpenVPN di Command Line menggunakan perintah openvpn
Untuk terhubung sesuai permintaan, cukup gunakan openvpn perintah sebagai;
sudo openvpn client-config.ovpn
atau
sudo openvpn --config client-config.ovpn
Dimana client-config adalah file konfigurasi openvpn klien, seperti file gentoo.ovpn di atas.
Jika koneksi ke server OpenVPN berhasil, Anda akan melihat Initialization Sequence Completed .
Wed Jun 30 15:27:16 2021 OpenVPN 2.4.11 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 21 2021 Wed Jun 30 15:27:16 2021 library versions: OpenSSL 1.1.1g FIPS 21 Apr 2020, LZO 2.08 Wed Jun 30 15:27:16 2021 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication Wed Jun 30 15:27:16 2021 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication Wed Jun 30 15:27:16 2021 TCP/UDP: Preserving recently used remote address: [AF_INET]192.168.60.19:1194 Wed Jun 30 15:27:16 2021 Socket Buffers: R=[212992->212992] S=[212992->212992] Wed Jun 30 15:27:16 2021 UDPv4 link local: (not bound) Wed Jun 30 15:27:16 2021 UDPv4 link remote: [AF_INET]192.168.60.19:1194 Wed Jun 30 15:27:16 2021 TLS: Initial packet from [AF_INET]192.168.60.19:1194, sid=7ec70642 fdcdad40 Wed Jun 30 15:27:16 2021 VERIFY OK: depth=1, CN=Kifarunix-demo CA Wed Jun 30 15:27:16 2021 VERIFY KU OK Wed Jun 30 15:27:16 2021 Validating certificate extended key usage Wed Jun 30 15:27:16 2021 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication Wed Jun 30 15:27:16 2021 VERIFY EKU OK Wed Jun 30 15:27:16 2021 VERIFY OK: depth=0, CN=server Wed Jun 30 15:27:16 2021 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1586', remote='link-mtu 1602' Wed Jun 30 15:27:16 2021 WARNING: 'cipher' is used inconsistently, local='cipher BF-CBC', remote='cipher AES-256-CBC' Wed Jun 30 15:27:16 2021 WARNING: 'keysize' is used inconsistently, local='keysize 128', remote='keysize 256' Wed Jun 30 15:27:16 2021 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA Wed Jun 30 15:27:16 2021 [server] Peer Connection Initiated with [AF_INET]192.168.60.19:1194 Wed Jun 30 15:27:17 2021 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1) Wed Jun 30 15:27:17 2021 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 192.168.10.3,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' Wed Jun 30 15:27:17 2021 OPTIONS IMPORT: timers and/or timeouts modified Wed Jun 30 15:27:17 2021 OPTIONS IMPORT: --ifconfig/up options modified Wed Jun 30 15:27:17 2021 OPTIONS IMPORT: route options modified Wed Jun 30 15:27:17 2021 OPTIONS IMPORT: route-related options modified Wed Jun 30 15:27:17 2021 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified Wed Jun 30 15:27:17 2021 OPTIONS IMPORT: peer-id set Wed Jun 30 15:27:17 2021 OPTIONS IMPORT: adjusting link_mtu to 1625 Wed Jun 30 15:27:17 2021 OPTIONS IMPORT: data channel crypto options modified Wed Jun 30 15:27:17 2021 Data Channel: using negotiated cipher 'AES-256-GCM' Wed Jun 30 15:27:17 2021 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key Wed Jun 30 15:27:17 2021 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key Wed Jun 30 15:27:17 2021 ROUTE_GATEWAY 10.0.2.2/255.255.255.0 IFACE=enp0s3 HWADDR=08:00:27:98:30:73 Wed Jun 30 15:27:17 2021 TUN/TAP device tun0 opened Wed Jun 30 15:27:17 2021 TUN/TAP TX queue length set to 100 Wed Jun 30 15:27:17 2021 /sbin/ip link set dev tun0 up mtu 1500 Wed Jun 30 15:27:17 2021 /sbin/ip addr add dev tun0 10.8.0.2/24 broadcast 10.8.0.255 Wed Jun 30 15:27:17 2021 /sbin/ip route add 192.168.60.19/32 via 10.0.2.2 Wed Jun 30 15:27:17 2021 /sbin/ip route add 0.0.0.0/1 via 10.8.0.1 Wed Jun 30 15:27:17 2021 /sbin/ip route add 128.0.0.0/1 via 10.8.0.1 Wed Jun 30 15:27:17 2021 Initialization Sequence Completed
Untuk memeriksa alamat IP;
ip add show tun0
9: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100
link/none
inet 10.8.0.2/24 brd 10.8.0.255 scope global tun0
valid_lft forever preferred_lft forever
inet6 fe80::697:ce38:b852:540c/64 scope link stable-privacy
valid_lft forever preferred_lft foreverUji konektivitas ke server VPN;
ping 10.8.0.1 -c 3
PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=2.71 ms
64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=2.42 ms
64 bytes from 10.8.0.1: icmp_seq=3 ttl=64 time=1.95 ms
--- 10.8.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 46ms
rtt min/avg/max/mdev = 1.952/2.362/2.713/0.316 msAnda juga harus bisa mendapatkan akses internet tergantung pada pengaturan rute server Anda.
Menjalankan Klien OpenVPN sebagai Layanan
Untuk membuat koneksi secara otomatis setiap kali server reboot, Anda dapat mengaktifkan layanan sistem klien OpenVPN.
Sebelum Anda dapat melakukannya, ubah ekstensi file konfigurasi VPN Anda dari .ovpn ke .conf . Ganti nama file yang sesuai.
cp gentoo.{ovpn,conf}
Salin .conf file ke direktori konfigurasi klien OpenVPN, /etc/openvpn/client .
mv gentoo.conf /etc/openvpn/client Selanjutnya, nonaktifkan SELinux (saya tidak menyarankan ini, -:));
setenforce 0 && sed -i 's/=enforcing/=permissive/' /etc/selinux/config
Mulai layanan sistem klien OpenVPN. Ganti nama gentoo dengan nama file konfigurasi .conf Anda.
systemctl start [email protected]
Untuk memeriksa status;
systemctl status [email protected]
● [email protected] - OpenVPN tunnel for gentoo Loaded: loaded (/usr/lib/systemd/system/[email protected]; disabled; vendor preset: disabled) Active: active (running) since Wed 2021-06-30 15:48:47 EDT; 12s ago Docs: man:openvpn(8) https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage https://community.openvpn.net/openvpn/wiki/HOWTO Main PID: 39782 (openvpn) Status: "Initialization Sequence Completed" Tasks: 1 (limit: 11272) Memory: 1.6M CGroup: /system.slice/system-openvpn\x2dclient.slice/[email protected] └─39782 /usr/sbin/openvpn --suppress-timestamps --nobind --config gentoo.conf Jun 30 15:48:48 localhost.localdomain openvpn[39782]: Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key Jun 30 15:48:48 localhost.localdomain openvpn[39782]: ROUTE_GATEWAY 10.0.2.2/255.255.255.0 IFACE=enp0s3 HWADDR=08:00:27:98:30:73 Jun 30 15:48:48 localhost.localdomain openvpn[39782]: TUN/TAP device tun0 opened Jun 30 15:48:48 localhost.localdomain openvpn[39782]: TUN/TAP TX queue length set to 100 Jun 30 15:48:48 localhost.localdomain openvpn[39782]: /sbin/ip link set dev tun0 up mtu 1500 Jun 30 15:48:48 localhost.localdomain openvpn[39782]: /sbin/ip addr add dev tun0 10.8.0.2/24 broadcast 10.8.0.255 Jun 30 15:48:48 localhost.localdomain openvpn[39782]: /sbin/ip route add 192.168.60.19/32 via 10.0.2.2 Jun 30 15:48:48 localhost.localdomain openvpn[39782]: /sbin/ip route add 0.0.0.0/1 via 10.8.0.1 Jun 30 15:48:48 localhost.localdomain openvpn[39782]: /sbin/ip route add 128.0.0.0/1 via 10.8.0.1 Jun 30 15:48:48 localhost.localdomain openvpn[39782]: Initialization Sequence Completed
Untuk mengaktifkannya agar berjalan pada boot sistem;
systemctl enable [email protected]
Anda telah berhasil menginstal dan mengatur klien OpenVPN Rocky Linux 8.
Itu membawa kita ke akhir tutorial tentang cara menginstal dan mengkonfigurasi Klien OpenVPN di Rocky Linux 8.
Tutorial lainnya
Tetapkan Alamat IP Statis untuk Klien OpenVPN
Konfigurasikan Otentikasi Berbasis OpenVPN LDAP