Search Results for edge openvpn

OpenVPN Site-to-Site VPN between Asus Merlin And Ubnt EdgeRouter

前言 Network Topology RT-AC68U 使用PPPoE拨号上网，但是分配的IP是100.64.204.111, 看着像公网IP实际却是Carrier-grade NAT. 现在需要将RT-AC68U与一台在公网的EdgeRouter使用OpenVPN Site-to-Site连接起来，并在RT-AC68U端实现policy-based routing。需要让RT-AC68U下的所有设备能访问EdgeRouter LAN的网络，并根据需求透过VPS访问指定互联网。本实验参考下列文章： Set up OpenVPN Site-to-Site on UBNT EdgeRouter Lite EdgeRouter OpenVPN Connectivity Monitor EdgeRouter 策略路由实现分析 EdgeRouter Policy Based Routing Using DNSMASQ IPSET Incoming search terms:asuswrt-merlin site to site vpnauthor6hzclose13rfutureh1cherq81leadp9hopenvpn site to site配置satxfostripjqgLink to this post!

EdgeRouter OpenVPN Connectivity Monitor

VPN protocols are censored and blocked in China. I’ve set up an PPTP client and a Site-to-site OpenVPN connection on my EdgeRouter Lite. PPTP is insecure and is easier to censor, so I’ve removed PPTP client from my router. OpenVPN is better than PPTP, not only secured, but also much more stable. But traffics are … Continue reading “EdgeRouter OpenVPN Connectivity Monitor”

Set up OpenVPN Site-to-Site on UBNT EdgeRouter Lite

参考：https://help.ubnt.com/hc/en-us/articles/204949694-EdgeMAX-OpenVPN-Site-to-Site 不同的是，我一端是Ubuntu Linux，另一端是EdgeRouter Lite。实现的目的也是让EdgeRouter连上远程vpn实现XXXX。 PPTP的方案参考：EdgeOS PPTP VPN客户端配置环境 Ubuntu Linux, 10.99.99.2 EdgeRouter Lite, 10.99.99.1 配置EdgeRouter Lite SSH到Ubnt EdgeRouter Lite 生成共享密钥文件

generate vpn openvpn-key /config/auth/secret

1	generate vpn openvpn-key /config/auth/secret

执行命令创建VPN

configure
set interfaces openvpn vtun0
set interfaces openvpn vtun0 mode site-to-site
set interfaces openvpn vtun0 remote-host 服务器公网地址
set interfaces openvpn vtun0 shared-secret-key-file /config/auth/secret
set interfaces openvpn vtun0 local-address 10.99.99.1 
set interfaces openvpn vtun0 remote-address 10.99.99.2
set interfaces openvpn vtun0 local-port 1194
set interfaces openvpn vtun0 remote-port 1194
set interfaces openvpn vtun0 openvpn-option --comp-lzo
set interfaces openvpn vtun0 openvpn-option --float
set interfaces openvpn vtun0 openvpn-option "--ping 10"
set interfaces openvpn vtun0 openvpn-option "--ping-restart 20"
set interfaces openvpn vtun0 openvpn-option --ping-timer-rem
set interfaces openvpn vtun0 openvpn-option --persist-tun
set interfaces openvpn vtun0 openvpn-option --persist-key
set interfaces openvpn vtun0 openvpn-option "--user nobody"
set interfaces openvpn vtun0 openvpn-option "--group nogroup"
commit
save
exit

configure

set interfaces openvpn vtun0

set interfaces openvpn vtun0 mode site-to-site

set interfaces openvpn vtun0 remote-host 服务器公网地址

set interfaces openvpn vtun0 shared-secret-key-file /config/auth/secret

set interfaces openvpn vtun0 local-address 10.99.99.1

set interfaces openvpn vtun0 remote-address 10.99.99.2

set interfaces openvpn vtun0 local-port 1194

set interfaces openvpn vtun0 remote-port 1194

set interfaces openvpn vtun0 openvpn-option --comp-lzo

set interfaces openvpn vtun0 openvpn-option --float

set interfaces openvpn vtun0 openvpn-option "--ping 10"

set interfaces openvpn vtun0 openvpn-option "--ping-restart 20"

set interfaces openvpn vtun0 openvpn-option --ping-timer-rem

set interfaces openvpn vtun0 openvpn-option --persist-tun

set interfaces openvpn vtun0 openvpn-option --persist-key

set interfaces openvpn vtun0 openvpn-option "--user nobody"

set interfaces openvpn vtun0 openvpn-option "--group nogroup"

commit

save

exit

执行命令启用NAT

configure
set service nat rule 5020 outbound-interface vtun0
set service nat rule 5020 type masquerade
commit
save
exit

configure

set service nat rule 5020 outbound-interface vtun0

set service nat rule 5020 type masquerade

commit

save

exit

如果需要重启tunnel

reset openvpn interface vtun0

1	reset openvpn interface vtun0

配置Linux 安装openvpn

apt-get install openvpn

1	apt-get install openvpn

把EdgeRouter的 /config/auth/secret 复制到 /etc/openvpn/er-site2site-static.key 编辑 /etc/openvpn/server.conf

dev tun
ifconfig 10.99.99.2 10.99.99.1 
secret /etc/openvpn/er-site2site-static.key
lport 1194
rport 1194
user nobody
group nogroup
comp-lzo
ping 10
ping-restart 20
ping-timer-rem
persist-tun
persist-key
verb 3
status /var/log/openvpn/openvpn-status.log
log-append  /var/log/openvpn/openvpn.log

dev tun

ifconfig 10.99.99.2 10.99.99.1

secret /etc/openvpn/er-site2site-static.key

lport 1194

rport 1194

user nobody

group nogroup

comp-lzo

ping 10

ping-restart 20

ping-timer-rem

persist-tun

persist-key

verb 3

status /var/log/openvpn/openvpn-status.log

log-append /var/log/openvpn/openvpn.log

启动openvpn

/etc/init.d/openvpn start

1	/etc/init.d/openvpn start

测试在EdgeRouter ping Linux

ping 10.99.99.2

1	ping 10.99.99.2

在Linux ping EdgeRouter

ping 10.99.99.1

1	ping 10.99.99.1

如果还有问题，可以看日志配置路由参考下一篇文章 UBNT EdgeOS 配置设备路由(interface-route)的方法 … Continue reading “Set up OpenVPN Site-to-Site on UBNT EdgeRouter Lite”

EdgeRouter 策略路由实现分析

最近家里的路由规则越来越复杂，而且越来越好用。正好昨天跟朋友讨论他的家用路由改造方案，所以研究了一下EdgeRouter的策略路由（Policy-based Routing，PBR）的实现。我家里的路由是EdgeRouter Lite，固件1.9.1.1，这个实现跟固件关系不大。首先，我们可以参考一下官方的文档：EdgeRouter – Policy-based routing (source address based) Incoming search terms:edgemax 策略路由edgerouter 策略路由 ipsetedgerouter 策略路由透明网关ipset er-xLink to this post!

UBNT EdgeOS 配置设备路由(interface-route)的方法

之前 EdgeOS PPTP VPN客户端配置里，配置VPN后，需要按需配置路由。由于自用的路由下一跳IP不确定，所以用了 interface-route。配置命令如下：

set protocols static interface-route 10.1.1.0/24 next-hop-interface pptpc0

1	set protocols static interface-route 10.1.1.0/24 next-hop-interface pptpc0

按这种方式配置路由的麻烦在于，每次输入都需要把目标网段后边配上一个interface，万一哪天需要改这个interface，要不一个一个改，要不重新导入配置文件。另外一个方法是用路由表＋防火墙路由表如下：

root@ubnt# show protocols static table 
 table 1 {
     description "route table via eth1: default internet access"
     interface-route 0.0.0.0/0 {
         next-hop-interface eth1 {
         }
     }
 }
 table 2 {
     description "route table via vtun0: openvpn  access"
     interface-route 0.0.0.0/0 {
         next-hop-interface vtun0 {
         }
     }
 }
[edit]

root@ubnt# show protocols static table

table 1 {

description "route table via eth1: default internet access"

interface-route 0.0.0.0/0 {

next-hop-interface eth1 {

}

table 2 {

description "route table via vtun0: openvpn access"

interface-route 0.0.0.0/0 {

next-hop-interface vtun0 {

}

[edit]

防火墙里配置一个地址组，并配好modify规则

firewall {
     group {
         network-group FORBIDDEN_ZONE {
             network 8.8.0.0/16
             network 8.25.0.0/16
         }
     }

     modify AUTO_VPN {
         description "Auto route to vpn based on destination"
         enable-default-log
         rule 1 {
             action modify
             description "route to table 2"
             destination {
                 group {
                     network-group FORBIDDEN_ZONE
                 }
             }
             log enable
             modify {
                 table 2
             }
         }
         rule 2 {
             action modify
             description "default route to table 1 "
             disable
             log enable
             modify {
                 table 1
             }
         }
     }
 }

firewall {

group {

network-group FORBIDDEN_ZONE {

network 8.8.0.0/16

network 8.25.0.0/16

}

modify AUTO_VPN {

description "Auto route to vpn based on destination"

enable-default-log

rule 1 {

action modify

description "route to table 2"

destination {

group {

network-group FORBIDDEN_ZONE

}

log enable

modify {

table 2

}

rule 2 {

action modify

description "default route to table 1 "

disable

log enable

modify {

table 1

}

再把内外网口的防火墙规则改一下

set interfaces ethernet eth0 firewall in modify AUTO_VPN

1	set interfaces ethernet eth0 firewall in modify AUTO_VPN

就行了。这里我的eth1连的外网，eth0是LAN。不过这里有个case我没试过，直接配置interface-route的方法，如果目标网段的interface掉了，会回落到默认的出口上，不知道modify的效果如何。 EdgeOS 1.8b3下firewall的log记录在 /var/log/messages 里，可以看到请求命中了哪个规则。 Incoming search terms:EDGEOSedgeos设置edgeroute4 配置路由edgeos 设置dnsdrawna4ledgeos 设置EdgeOS iptableswhitex9gedge os 旁路由eaten4u4driveraccadditionqiydonkeyz67decideem6circusv4mchoiceo8abasicg1qarrangementi75apple7clanotherhm6Link to this post!