Search Results for configure openvpn on edgeos

EdgeRouter OpenVPN Connectivity Monitor

VPN protocols are censored and blocked in China. I’ve set up an PPTP client and a Site-to-site OpenVPN connection on my EdgeRouter Lite. PPTP is insecure and is easier to censor, so I’ve removed PPTP client from my router. OpenVPN is better than PPTP, not only secured, but also much more stable. But traffics are … Continue reading “EdgeRouter OpenVPN Connectivity Monitor”

Set up OpenVPN Site-to-Site on UBNT EdgeRouter Lite

参考：https://help.ubnt.com/hc/en-us/articles/204949694-EdgeMAX-OpenVPN-Site-to-Site 不同的是，我一端是Ubuntu Linux，另一端是EdgeRouter Lite。实现的目的也是让EdgeRouter连上远程vpn实现XXXX。 PPTP的方案参考：EdgeOS PPTP VPN客户端配置环境 Ubuntu Linux, 10.99.99.2 EdgeRouter Lite, 10.99.99.1 配置EdgeRouter Lite SSH到Ubnt EdgeRouter Lite 生成共享密钥文件

generate vpn openvpn-key /config/auth/secret

1	generate vpn openvpn-key /config/auth/secret

执行命令创建VPN

configure
set interfaces openvpn vtun0
set interfaces openvpn vtun0 mode site-to-site
set interfaces openvpn vtun0 remote-host 服务器公网地址
set interfaces openvpn vtun0 shared-secret-key-file /config/auth/secret
set interfaces openvpn vtun0 local-address 10.99.99.1 
set interfaces openvpn vtun0 remote-address 10.99.99.2
set interfaces openvpn vtun0 local-port 1194
set interfaces openvpn vtun0 remote-port 1194
set interfaces openvpn vtun0 openvpn-option --comp-lzo
set interfaces openvpn vtun0 openvpn-option --float
set interfaces openvpn vtun0 openvpn-option "--ping 10"
set interfaces openvpn vtun0 openvpn-option "--ping-restart 20"
set interfaces openvpn vtun0 openvpn-option --ping-timer-rem
set interfaces openvpn vtun0 openvpn-option --persist-tun
set interfaces openvpn vtun0 openvpn-option --persist-key
set interfaces openvpn vtun0 openvpn-option "--user nobody"
set interfaces openvpn vtun0 openvpn-option "--group nogroup"
commit
save
exit

configure

set interfaces openvpn vtun0

set interfaces openvpn vtun0 mode site-to-site

set interfaces openvpn vtun0 remote-host 服务器公网地址

set interfaces openvpn vtun0 shared-secret-key-file /config/auth/secret

set interfaces openvpn vtun0 local-address 10.99.99.1

set interfaces openvpn vtun0 remote-address 10.99.99.2

set interfaces openvpn vtun0 local-port 1194

set interfaces openvpn vtun0 remote-port 1194

set interfaces openvpn vtun0 openvpn-option --comp-lzo

set interfaces openvpn vtun0 openvpn-option --float

set interfaces openvpn vtun0 openvpn-option "--ping 10"

set interfaces openvpn vtun0 openvpn-option "--ping-restart 20"

set interfaces openvpn vtun0 openvpn-option --ping-timer-rem

set interfaces openvpn vtun0 openvpn-option --persist-tun

set interfaces openvpn vtun0 openvpn-option --persist-key

set interfaces openvpn vtun0 openvpn-option "--user nobody"

set interfaces openvpn vtun0 openvpn-option "--group nogroup"

commit

save

exit

执行命令启用NAT

configure
set service nat rule 5020 outbound-interface vtun0
set service nat rule 5020 type masquerade
commit
save
exit

configure

set service nat rule 5020 outbound-interface vtun0

set service nat rule 5020 type masquerade

commit

save

exit

如果需要重启tunnel

reset openvpn interface vtun0

1	reset openvpn interface vtun0

配置Linux 安装openvpn

apt-get install openvpn

1	apt-get install openvpn

把EdgeRouter的 /config/auth/secret 复制到 /etc/openvpn/er-site2site-static.key 编辑 /etc/openvpn/server.conf

dev tun
ifconfig 10.99.99.2 10.99.99.1 
secret /etc/openvpn/er-site2site-static.key
lport 1194
rport 1194
user nobody
group nogroup
comp-lzo
ping 10
ping-restart 20
ping-timer-rem
persist-tun
persist-key
verb 3
status /var/log/openvpn/openvpn-status.log
log-append  /var/log/openvpn/openvpn.log

dev tun

ifconfig 10.99.99.2 10.99.99.1

secret /etc/openvpn/er-site2site-static.key

lport 1194

rport 1194

user nobody

group nogroup

comp-lzo

ping 10

ping-restart 20

ping-timer-rem

persist-tun

persist-key

verb 3

status /var/log/openvpn/openvpn-status.log

log-append /var/log/openvpn/openvpn.log

启动openvpn

/etc/init.d/openvpn start

1	/etc/init.d/openvpn start

测试在EdgeRouter ping Linux

ping 10.99.99.2

1	ping 10.99.99.2

在Linux ping EdgeRouter

ping 10.99.99.1

1	ping 10.99.99.1

如果还有问题，可以看日志配置路由参考下一篇文章 UBNT EdgeOS 配置设备路由(interface-route)的方法 … Continue reading “Set up OpenVPN Site-to-Site on UBNT EdgeRouter Lite”

基于SNIProxy的路由端网络流量定制分发方案

标题感觉很高大上，其实写得乱七八糟。前序文章： SNIProxy Bind Outgoing Interface Build SNIProxy Debian Package for EdgeRouter Ubnt EdgeRouter Lite 和 EdgeRouter X 上安装使用SNIProxy 不急，上边三篇可能会在本文内提及。首先，sniproxy不解释了，但是如标题所属，sniproxy的版本不支持我要的功能，所以我就fork然后改了。具体思路参考上述第一个链接。接下来，直接进入正题。按之前的玩法，我使用路由表来控制流量。这是一个很典型，也很正确的做法；但是也是一个很不好用的玩法。参考文章：Set up OpenVPN Site-to-Site on UBNT EdgeRouter Lite, EdgeOS PPTP VPN客户端配置 PS：我维护了一份自己的路由表，地址在 https://ip.rst.im/blocks/sskaje 为了让定制化程度高一些，我配了一个Socks代理，实际上是在vpn对端配置的，本地路由做了个DNAT，转发过去了。这样我就可以用firefox＋foxyproxy实现本地定制化规则。参考文章：UBNT VPN + Socks5 代理和 Set up dante-server on Ubuntu 后来考虑到上述用起来麻烦，又趁着回老家的时候，在家里的ac68u merlin上实践了下WPAD，不过没有在自己家里的edgerouter上搞。参考文章：Setup WPAD on Asus … Continue reading “基于SNIProxy的路由端网络流量定制分发方案”