Difference between revisions of "OpenVPN: IPv4 /32 single client"

From OnnoWiki
Jump to navigation Jump to search
Line 90: Line 90:
 
  openvpn --config client.ovpn
 
  openvpn --config client.ovpn
  
−
Sample output:
+
Akan keluar kira-kira
−
 
 
−
Now, check if tun0(VPN interface) is created, and check the VPN interface IP address using ‘ip addr’ command:
 
  
−
  ip addr
+
  Sat Feb 16 08:24:44 2019 Unrecognized option or missing or extra parameter(s) in client.ovpn:14: block-outside-dns (2.4.4)
 +
Sat Feb 16 08:24:44 2019 OpenVPN 2.4.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 10 2018
 +
Sat Feb 16 08:24:44 2019 library versions: OpenSSL 1.1.0g  2 Nov 2017, LZO 2.08
 +
Sat Feb 16 08:24:44 2019 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
 +
Sat Feb 16 08:24:44 2019 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
 +
Sat Feb 16 08:24:44 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]192.168.0.239:1194
 +
Sat Feb 16 08:24:44 2019 Socket Buffers: R=[212992->212992] S=[212992->212992]
 +
Sat Feb 16 08:24:44 2019 UDP link local: (not bound)
 +
Sat Feb 16 08:24:44 2019 UDP link remote: [AF_INET]192.168.0.239:1194
 +
Sat Feb 16 08:24:44 2019 TLS: Initial packet from [AF_INET]192.168.0.239:1194, sid=5ece0ce6 888b9e5b
 +
Sat Feb 16 08:24:44 2019 VERIFY OK: depth=1, CN=ChangeMe
 +
Sat Feb 16 08:24:44 2019 VERIFY KU OK
 +
Sat Feb 16 08:24:44 2019 Validating certificate extended key usage
 +
Sat Feb 16 08:24:44 2019 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
 +
Sat Feb 16 08:24:44 2019 VERIFY EKU OK
 +
Sat Feb 16 08:24:44 2019 VERIFY OK: depth=0, CN=server
 +
Sat Feb 16 08:24:44 2019 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
 +
Sat Feb 16 08:24:44 2019 [server] Peer Connection Initiated with [AF_INET]192.168.0.239:1194
 +
Sat Feb 16 08:24:45 2019 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
 +
Sat Feb 16 08:24:45 2019 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 192.168.0.222,route-gateway  10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM '
 +
Sat Feb 16 08:24:45 2019 OPTIONS IMPORT: timers and/or timeouts modified
 +
Sat Feb 16 08:24:45 2019 OPTIONS IMPORT: --ifconfig/up options modified
 +
Sat Feb 16 08:24:45 2019 OPTIONS IMPORT: route options modified
 +
Sat Feb 16 08:24:45 2019 OPTIONS IMPORT: route-related options modified
 +
Sat Feb 16 08:24:45 2019 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
 +
Sat Feb 16 08:24:45 2019 OPTIONS IMPORT: peer-id set
 +
Sat Feb 16 08:24:45 2019 OPTIONS IMPORT: adjusting link_mtu to 1624
 +
Sat Feb 16 08:24:45 2019 OPTIONS IMPORT: data channel crypto options modified
 +
Sat Feb 16 08:24:45 2019 Data Channel: using negotiated cipher 'AES-256-GCM'
 +
Sat Feb 16 08:24:45 2019 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
 +
Sat Feb 16 08:24:45 2019 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
 +
Sat Feb 16 08:24:45 2019 ROUTE_GATEWAY 192.168.0.222/255.255.255.0 IFACE=enp0s3 HWADDR=08:00:27:16:69:ed
 +
Sat Feb 16 08:24:45 2019 TUN/TAP device tun0 opened
 +
Sat Feb 16 08:24:45 2019 TUN/TAP TX queue length set to 100
 +
Sat Feb 16 08:24:45 2019 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
 +
Sat Feb 16 08:24:45 2019 /sbin/ip link set dev tun0 up mtu 1500
 +
Sat Feb 16 08:24:45 2019 /sbin/ip addr add dev tun0 10.8.0.2/24 broadcast 10.8.0.255
 +
Sat Feb 16 08:24:45 2019 /sbin/ip route add 192.168.0.239/32 dev enp0s3
 +
Sat Feb 16 08:24:45 2019 /sbin/ip route add 0.0.0.0/1 via 10.8.0.1
 +
Sat Feb 16 08:24:45 2019 /sbin/ip route add 128.0.0.0/1 via 10.8.0.1
 +
Sat Feb 16 08:24:45 2019 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
 +
Sat Feb 16 08:24:45 2019 Initialization Sequence Completed
  
−
Sample output:
+
Cek interface, akan muncul tun0
  
−
  1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
+
  ifconfig
−
  link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
 
−
  inet 127.0.0.1/8 scope host lo
 
−
  valid_lft forever preferred_lft forever
 
−
  inet6 ::1/128 scope host
 
−
  valid_lft forever preferred_lft forever
 
−
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP  qlen 1000
 
−
  link/ether 08:00:27:28:98:6b brd ff:ff:ff:ff:ff:ff
 
−
  inet 192.168.43.199/24 brd 192.168.43.255 scope global dynamic enp0s3
 
−
  valid_lft 42359sec preferred_lft 42359sec
 
−
  inet6 fe80::a00:27ff:fe28:986b/64 scope link
 
−
  valid_lft forever preferred_lft forever
 
−
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
 
−
  link/none
 
−
  inet 10.8.0.2/24 brd 10.8.0.255 scope global tun0
 
−
  valid_lft forever preferred_lft forever
 
  
−
As you can see in the above output, Our VPN server automatically assigned an IP address 10.8.0.2 to the VPN client.
+
tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
 +
        inet 10.8.0.2  netmask 255.255.255.0  destination 10.8.0.2
 +
        inet6 fe80::28c4:3e38:2497:e12a  prefixlen 64  scopeid 0x20<link>
 +
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
 +
        RX packets 51  bytes 11522 (11.5 KB)
 +
        RX errors 0  dropped 0  overruns 0  frame 0
 +
        TX packets 134  bytes 43524 (43.5 KB)
 +
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
  
−
Now, try to ping the VPN server from your VPN client system:
+
Cek
  
 
  ping -c3 10.8.0.1
 
  ping -c3 10.8.0.1
Line 124: Line 155:
  
 
  PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
 
  PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
−
  64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=1.05 ms
+
  64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=0.539 ms
−
  64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=1.94 ms
+
  64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=1.17 ms
−
  64 bytes from 10.8.0.1: icmp_seq=3 ttl=64 time=2.49 ms
+
  64 bytes from 10.8.0.1: icmp_seq=3 ttl=64 time=0.921 ms
 
   
 
   
 
  --- 10.8.0.1 ping statistics ---
 
  --- 10.8.0.1 ping statistics ---
−
  3 packets transmitted, 3 received, 0% packet loss, time 2001ms
+
  3 packets transmitted, 3 received, 0% packet loss, time 2007ms
−
  rtt min/avg/max/mdev = 1.057/1.832/2.495/0.594 ms
+
  rtt min/avg/max/mdev = 0.539/0.878/1.176/0.264 ms
−
 
 
−
Congratulations! We have now successfully installed and configured OpenVPN server and client in CentOS. This method is same for DEB based systems such as Ubuntu and Linux Mint. Unlike the manual installation, this script makes the the openvpn installation and configuration much easier.
 
  
−
Cheers!
+
Anda sudah tersambung ke VPN dengan IP 10.8.0.0/24
  
 
==Referensi==
 
==Referensi==

Revision as of 08:27, 16 February 2019

sumber: https://www.ostechnix.com/easiest-way-install-configure-openvpn-server-linux/


Topology

CLIENT 1 ------- HOST A ---------------- HOST B --------- CLIENT 2
                 ovpn server             ovpn client



Host A akan berfungsi sebagai OpenVPN Server. 

OS : Ubuntu 18.04
IP : 192.168.0.239/24
hostname : vpnserver


Host B akan berfungsi sebagai OpenVPN client 

OS : Ubuntu 18.04
IP : 192.168.0.237/24

Instal & Konfigurasi OpenVPN Server

Download script openvpn-install dari github 

sudo su
apt install openssh-server openvpn

cd /usr/local/src
wget https://git.io/vpn -O openvpn-install.sh
bash openvpn-install.sh

Jawab pertanyaan: 

IP address: 192.168.0.239
Public IP address / hostname: vpnserver
Protocol [1-2]: 1 -- UDP
Port: 1194
DNS [1-5]: 1
Client name: client
Press any key to continue...  <ENTER>

Maka akan tampak file client.ovpn, di 

/root/client.ovpn

Install openssh-server di client, copykan client.ovpn ke client 

scp client.ovpn root@192.168.0.237:


Reboot 

shutdown -r now

Cek kondisi jaringan 

ifconfig

Akan muncul interface tun0 

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.8.0.1  netmask 255.255.255.0  destination 10.8.0.1
        inet6 fe80::eaaa:77ed:ba02:748  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 6  bytes 288 (288.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Konfigurasi OpenVPN Client

Pastikan openvpn terinstalsi 

sudo su
apt install openssh-server openvpn

Edit /etc/hosts isi dengan nama OpenVPN server 

192.168.0.239 vpnserver


Jalankan OpenVPN client 

cd ~
sudo su
openvpn --config client.ovpn

Akan keluar kira-kira 

Sat Feb 16 08:24:44 2019 Unrecognized option or missing or extra parameter(s) in client.ovpn:14: block-outside-dns (2.4.4)
Sat Feb 16 08:24:44 2019 OpenVPN 2.4.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 10 2018
Sat Feb 16 08:24:44 2019 library versions: OpenSSL 1.1.0g  2 Nov 2017, LZO 2.08
Sat Feb 16 08:24:44 2019 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Sat Feb 16 08:24:44 2019 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Sat Feb 16 08:24:44 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]192.168.0.239:1194
Sat Feb 16 08:24:44 2019 Socket Buffers: R=[212992->212992] S=[212992->212992]
Sat Feb 16 08:24:44 2019 UDP link local: (not bound)
Sat Feb 16 08:24:44 2019 UDP link remote: [AF_INET]192.168.0.239:1194
Sat Feb 16 08:24:44 2019 TLS: Initial packet from [AF_INET]192.168.0.239:1194, sid=5ece0ce6 888b9e5b
Sat Feb 16 08:24:44 2019 VERIFY OK: depth=1, CN=ChangeMe
Sat Feb 16 08:24:44 2019 VERIFY KU OK
Sat Feb 16 08:24:44 2019 Validating certificate extended key usage
Sat Feb 16 08:24:44 2019 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sat Feb 16 08:24:44 2019 VERIFY EKU OK
Sat Feb 16 08:24:44 2019 VERIFY OK: depth=0, CN=server
Sat Feb 16 08:24:44 2019 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Sat Feb 16 08:24:44 2019 [server] Peer Connection Initiated with [AF_INET]192.168.0.239:1194
Sat Feb 16 08:24:45 2019 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Feb 16 08:24:45 2019 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 192.168.0.222,route-gateway  10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM '
Sat Feb 16 08:24:45 2019 OPTIONS IMPORT: timers and/or timeouts modified
Sat Feb 16 08:24:45 2019 OPTIONS IMPORT: --ifconfig/up options modified
Sat Feb 16 08:24:45 2019 OPTIONS IMPORT: route options modified
Sat Feb 16 08:24:45 2019 OPTIONS IMPORT: route-related options modified
Sat Feb 16 08:24:45 2019 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sat Feb 16 08:24:45 2019 OPTIONS IMPORT: peer-id set
Sat Feb 16 08:24:45 2019 OPTIONS IMPORT: adjusting link_mtu to 1624
Sat Feb 16 08:24:45 2019 OPTIONS IMPORT: data channel crypto options modified
Sat Feb 16 08:24:45 2019 Data Channel: using negotiated cipher 'AES-256-GCM'
Sat Feb 16 08:24:45 2019 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sat Feb 16 08:24:45 2019 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sat Feb 16 08:24:45 2019 ROUTE_GATEWAY 192.168.0.222/255.255.255.0 IFACE=enp0s3 HWADDR=08:00:27:16:69:ed
Sat Feb 16 08:24:45 2019 TUN/TAP device tun0 opened
Sat Feb 16 08:24:45 2019 TUN/TAP TX queue length set to 100
Sat Feb 16 08:24:45 2019 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Sat Feb 16 08:24:45 2019 /sbin/ip link set dev tun0 up mtu 1500
Sat Feb 16 08:24:45 2019 /sbin/ip addr add dev tun0 10.8.0.2/24 broadcast 10.8.0.255
Sat Feb 16 08:24:45 2019 /sbin/ip route add 192.168.0.239/32 dev enp0s3
Sat Feb 16 08:24:45 2019 /sbin/ip route add 0.0.0.0/1 via 10.8.0.1
Sat Feb 16 08:24:45 2019 /sbin/ip route add 128.0.0.0/1 via 10.8.0.1
Sat Feb 16 08:24:45 2019 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sat Feb 16 08:24:45 2019 Initialization Sequence Completed

Cek interface, akan muncul tun0 

ifconfig

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.8.0.2  netmask 255.255.255.0  destination 10.8.0.2
        inet6 fe80::28c4:3e38:2497:e12a  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 51  bytes 11522 (11.5 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 134  bytes 43524 (43.5 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Cek 

ping -c3 10.8.0.1

Sample output: 

PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=0.539 ms
64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=1.17 ms
64 bytes from 10.8.0.1: icmp_seq=3 ttl=64 time=0.921 ms

--- 10.8.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2007ms
rtt min/avg/max/mdev = 0.539/0.878/1.176/0.264 ms

Anda sudah tersambung ke VPN dengan IP 10.8.0.0/24

Referensi

Pranala Menarik

Retrieved from "https://onnocenter.or.id/wiki/index.php?title=OpenVPN:_IPv4_/32_single_client&oldid=55349"