Search Results for openvpn site to site edgerouter ubuntu

Set up OpenVPN Site-to-Site on UBNT EdgeRouter Lite

参考：https://help.ubnt.com/hc/en-us/articles/204949694-EdgeMAX-OpenVPN-Site-to-Site 不同的是，我一端是Ubuntu Linux，另一端是EdgeRouter Lite。实现的目的也是让EdgeRouter连上远程vpn实现XXXX。 PPTP的方案参考：EdgeOS PPTP VPN客户端配置环境 Ubuntu Linux, 10.99.99.2 EdgeRouter Lite, 10.99.99.1 配置EdgeRouter Lite SSH到Ubnt EdgeRouter Lite 生成共享密钥文件

generate vpn openvpn-key /config/auth/secret

1	generate vpn openvpn-key /config/auth/secret

执行命令创建VPN

configure
set interfaces openvpn vtun0
set interfaces openvpn vtun0 mode site-to-site
set interfaces openvpn vtun0 remote-host 服务器公网地址
set interfaces openvpn vtun0 shared-secret-key-file /config/auth/secret
set interfaces openvpn vtun0 local-address 10.99.99.1 
set interfaces openvpn vtun0 remote-address 10.99.99.2
set interfaces openvpn vtun0 local-port 1194
set interfaces openvpn vtun0 remote-port 1194
set interfaces openvpn vtun0 openvpn-option --comp-lzo
set interfaces openvpn vtun0 openvpn-option --float
set interfaces openvpn vtun0 openvpn-option "--ping 10"
set interfaces openvpn vtun0 openvpn-option "--ping-restart 20"
set interfaces openvpn vtun0 openvpn-option --ping-timer-rem
set interfaces openvpn vtun0 openvpn-option --persist-tun
set interfaces openvpn vtun0 openvpn-option --persist-key
set interfaces openvpn vtun0 openvpn-option "--user nobody"
set interfaces openvpn vtun0 openvpn-option "--group nogroup"
commit
save
exit

configure

set interfaces openvpn vtun0

set interfaces openvpn vtun0 mode site-to-site

set interfaces openvpn vtun0 remote-host 服务器公网地址

set interfaces openvpn vtun0 shared-secret-key-file /config/auth/secret

set interfaces openvpn vtun0 local-address 10.99.99.1

set interfaces openvpn vtun0 remote-address 10.99.99.2

set interfaces openvpn vtun0 local-port 1194

set interfaces openvpn vtun0 remote-port 1194

set interfaces openvpn vtun0 openvpn-option --comp-lzo

set interfaces openvpn vtun0 openvpn-option --float

set interfaces openvpn vtun0 openvpn-option "--ping 10"

set interfaces openvpn vtun0 openvpn-option "--ping-restart 20"

set interfaces openvpn vtun0 openvpn-option --ping-timer-rem

set interfaces openvpn vtun0 openvpn-option --persist-tun

set interfaces openvpn vtun0 openvpn-option --persist-key

set interfaces openvpn vtun0 openvpn-option "--user nobody"

set interfaces openvpn vtun0 openvpn-option "--group nogroup"

commit

save

exit

执行命令启用NAT

configure
set service nat rule 5020 outbound-interface vtun0
set service nat rule 5020 type masquerade
commit
save
exit

configure

set service nat rule 5020 outbound-interface vtun0

set service nat rule 5020 type masquerade

commit

save

exit

如果需要重启tunnel

reset openvpn interface vtun0

1	reset openvpn interface vtun0

配置Linux 安装openvpn

apt-get install openvpn

1	apt-get install openvpn

把EdgeRouter的 /config/auth/secret 复制到 /etc/openvpn/er-site2site-static.key 编辑 /etc/openvpn/server.conf

dev tun
ifconfig 10.99.99.2 10.99.99.1 
secret /etc/openvpn/er-site2site-static.key
lport 1194
rport 1194
user nobody
group nogroup
comp-lzo
ping 10
ping-restart 20
ping-timer-rem
persist-tun
persist-key
verb 3
status /var/log/openvpn/openvpn-status.log
log-append  /var/log/openvpn/openvpn.log

dev tun

ifconfig 10.99.99.2 10.99.99.1

secret /etc/openvpn/er-site2site-static.key

lport 1194

rport 1194

user nobody

group nogroup

comp-lzo

ping 10

ping-restart 20

ping-timer-rem

persist-tun

persist-key

verb 3

status /var/log/openvpn/openvpn-status.log

log-append /var/log/openvpn/openvpn.log

启动openvpn

/etc/init.d/openvpn start

1	/etc/init.d/openvpn start

测试在EdgeRouter ping Linux

ping 10.99.99.2

1	ping 10.99.99.2

在Linux ping EdgeRouter

ping 10.99.99.1

1	ping 10.99.99.1

如果还有问题，可以看日志配置路由参考下一篇文章 UBNT EdgeOS 配置设备路由(interface-route)的方法 … Continue reading “Set up OpenVPN Site-to-Site on UBNT EdgeRouter Lite”

基于SNIProxy的路由端网络流量定制分发方案

标题感觉很高大上，其实写得乱七八糟。前序文章： SNIProxy Bind Outgoing Interface Build SNIProxy Debian Package for EdgeRouter Ubnt EdgeRouter Lite 和 EdgeRouter X 上安装使用SNIProxy 不急，上边三篇可能会在本文内提及。首先，sniproxy不解释了，但是如标题所属，sniproxy的版本不支持我要的功能，所以我就fork然后改了。具体思路参考上述第一个链接。接下来，直接进入正题。按之前的玩法，我使用路由表来控制流量。这是一个很典型，也很正确的做法；但是也是一个很不好用的玩法。参考文章：Set up OpenVPN Site-to-Site on UBNT EdgeRouter Lite, EdgeOS PPTP VPN客户端配置 PS：我维护了一份自己的路由表，地址在 https://ip.rst.im/blocks/sskaje 为了让定制化程度高一些，我配了一个Socks代理，实际上是在vpn对端配置的，本地路由做了个DNAT，转发过去了。这样我就可以用firefox＋foxyproxy实现本地定制化规则。参考文章：UBNT VPN + Socks5 代理和 Set up dante-server on Ubuntu 后来考虑到上述用起来麻烦，又趁着回老家的时候，在家里的ac68u merlin上实践了下WPAD，不过没有在自己家里的edgerouter上搞。参考文章：Setup WPAD on Asus … Continue reading “基于SNIProxy的路由端网络流量定制分发方案”