networking:openvpn_howto
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
networking:openvpn_howto [2017/04/05 15:49] ww |
networking:openvpn_howto [2022/03/16 09:39] (current) |
||
|---|---|---|---|
| Line 3: | Line 3: | ||
| ===== 1. Generování klíčů (Linux) ===== | ===== 1. Generování klíčů (Linux) ===== | ||
| - | ==== 1.1. Příprava | + | ==== 1.1. PKI - příprava ===== |
| - | - Zkopírovat nástroje z adresáře '' | + | - Stáhnout Easy-RSA ([[https://github.com/ |
| - | - Upravit | + | - Zkopírovat |
| - | - Volitelně eliptické křivky: '' | + | - Volitelně eliptické křivky: |
| + | - '' | ||
| + | - '' | ||
| # ./easyrsa init-pki | # ./easyrsa init-pki | ||
| Line 14: | Line 16: | ||
| # ./easyrsa gen-dh | # ./easyrsa gen-dh | ||
| - | ==== 1.2. Umístění souborů ==== | + | ==== 1.2. PKI - umístění souborů ==== |
| - server: | - server: | ||
| - '' | - '' | ||
| Line 24: | Line 26: | ||
| - '' | - '' | ||
| - '' | - '' | ||
| + | |||
| + | ==== 1.3. TLS auth ==== | ||
| + | openvpn --genkey secret ta.key | ||
| ===== 2. Nastavení serveru (Linux) ===== | ===== 2. Nastavení serveru (Linux) ===== | ||
| Line 44: | Line 49: | ||
| cipher AES-256-GCM | cipher AES-256-GCM | ||
| | | ||
| - | client-to-client | + | |
| + | #push "route 192.168.X.0 255.255.255.0 172.17.Y.Z" | ||
| | | ||
| # ifconfig-pool-persist ipp.txt | # ifconfig-pool-persist ipp.txt | ||
| | | ||
| keepalive 10 120 | keepalive 10 120 | ||
| - | compress lz4 | ||
| | | ||
| log / | log / | ||
| Line 55: | Line 60: | ||
| mute 10 | mute 10 | ||
| | | ||
| - | ca [inline] | + | ca |
| - | cert [inline] | + | cert |
| - | key | + | key [inline] |
| - | dh [inline] | + | dh [inline] |
| + | tls-auth | ||
| key-direction 0 | key-direction 0 | ||
| | | ||
| Line 107: | Line 113: | ||
| persist-key | persist-key | ||
| persist-tun | persist-tun | ||
| + | auth-nocache | ||
| | | ||
| remote-cert-tls server | remote-cert-tls server | ||
| - | cipher AES-256-GSM | + | cipher AES-256-GCM |
| - | + | ||
| - | compress lz4 | + | |
| | | ||
| log " | log " | ||
| Line 117: | Line 122: | ||
| mute 10 | mute 10 | ||
| | | ||
| - | ca [inline] | + | ca |
| - | cert [inline] | + | cert |
| - | key | + | key |
| + | tls-auth | ||
| key-direction 1 | key-direction 1 | ||
| | | ||
| Line 145: | Line 151: | ||
| -----END OpenVPN Static key V1----- | -----END OpenVPN Static key V1----- | ||
| </ | </ | ||
| + | |||
| + | ===== 4. Výpis zneplatněných certifikátů ===== | ||
| + | grep " | ||
| + | |||
| + | ===== 5. Zneplatnění certifikátu ===== | ||
| + | ./easyrsa revoke < | ||
| + | EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl | ||
| + | |||
| + | + přidat do konfiguráku serveru: | ||
| + | crl-verify / | ||
| + | |||
| + | Po zneplatnění je potřeba restartovat OpenVPN server: | ||
| + | systemctl restart openvpn@< | ||
networking/openvpn_howto.1491400181.txt.gz · Last modified: 2022/03/16 09:38 (external edit)
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
