Как установить и настроить OpenVPN сервер на Ubuntu / Debian / CentOS за 5 минут

Как установить бесплатный VPN (виртуальная частная сеть) сервер на Ubuntu / Debian /CentOS Linux для удалленого доступа сотрудников или для защиты вашей активности в интернете от злоумышленников при открытом wi-fi или другом открытом интернет соединении?

ОpenVPN — это бесплатное и общедоступное программное обеспечение для систем типа Linux/Unix. Таким образом осуществляется двух или трех уровневая OSI защита сетевого подключения на основе протокола SSL/TLS. VPN позволяет осуществлять защищенные соединения в незащищенных общественных сетях, таких как wi-fi сеть в аэропорту или отеле. Виртуальной частной сети так же необходим доступ к вашему корпоративному, домашнему серверу или серверу компании. Вы можете обойти сайты с защитой по геолокации, повысить вашу приватность и безопасность онлайн.

Это руководство содержит в себе пошаговые инструкции для настройки OpenVPN сервера на Ubuntu / Debian /CentOS, включая настройки межсетевого экрана ufw/iptables .

Нужно сделать следующее:

1. Найти и записать свой публичный IP адрес.
2. Установить скрипт openvpn-install.sh.
3. Запустить openvpn-install.sh для установки OpenVPN сервера.
4. Подключиться к OpenVPN серверу используя клиент для IOS / Android / Linux / Windows.
5. Убедиться в работоспособности VPN сети.

Шаг 1 – Найти ваш публичный IP адрес

Используйте любую из приведенных ниже команд для определения вашего публичного IPv4 адреса. Если ваш интерфейс назван eth0 или eth1, введите:

 $ ip addr show eth0 

Или:

 $ ip addr show eth1 

Так же можно использовать команды host или dig как показано ниже:

 $ host myip.opendns.com resolver1.opendns.com 

Или:

 $ dig TXT +short o-o.myaddr.l.google.com @ns1.google.com 

Пример вывода:

Запишите публичный IP адрес 104.248.137.187, то есть публичный IP адрес вашего сервера OpenVPN.

Шаг 2 – Обновить вашу систему и установить ufw

Введите команду apt-get / команду apt для обновления системы:

$ sudo apt-get update && sudo apt-get dist-upgrade 

После установки ядра Linux необходима перезагрузка. Для этого нужно ввести следующую команду:

 $ sudo reboot 

Установить ufw (Простой фаервол)

Для установки ufw на ubuntu / Debian, нужно ввести команду:

 $ sudo apt-get install ufw

Образец вывода:

Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
ufw
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 164 kB of archives.
After this operation, 848 kB of additional disk space will be used.
Get:1 http://mirrors.linode.com/debian stretch/main amd64 ufw all 0.35-4 [164 kB]
Fetched 164 kB in 0s (13.1 MB/s)
Preconfiguring packages ...
Selecting previously unselected package ufw.
(Reading database ... 28439 files and directories currently installed.)
Preparing to unpack .../archives/ufw_0.35-4_all.deb ...
Unpacking ufw (0.35-4) ...
Setting up ufw (0.35-4) ...

Creating config file /etc/ufw/before.rules with new version

Creating config file /etc/ufw/before6.rules with new version

Creating config file /etc/ufw/after.rules with new version

Creating config file /etc/ufw/after6.rules with new version
Created symlink /etc/systemd/system/multi-user.target.wants/ufw.service ? /lib/systemd/system/ufw.service.
Processing triggers for systemd (232-25) ...
Processing triggers for man-db (2.7.6.1-2) ...
Processing triggers for rsyslog (8.24.0-1) ...

Необходимо открыть затребованные порты, такие как SHH port 22, 80, 443 и так далее:

$ sudo ufw allow 22
$ sudo ufw allow 80
$ sudo ufw allow 443

Для включения фаервола запустим:

$ sudo ufw enable 

Состояние правил фаервола:

$ sudo ufw status

Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startup

Образец вывода:

Status: active

To Action From
--  ------ ----
22 ALLOW Anywhere
80 ALLOW Anywhere
443 ALLOW Anywhere
22 (v6) ALLOW Anywhere (v6)
80 (v6) ALLOW Anywhere (v6)
443 (v6) ALLOW Anywhere (v6)

Шаг 3 – Установка скрипта openvpn-install.sh

Введем команду wget:

$ wget https://git.io/vpn -O openvpn-install.sh

Образец вывода:

--2020-04-06 10:02:13-- https://git.io/vpn
Resolving git.io (git.io)... 34.197.27.35, 34.235.56.240, 52.72.182.203, ...
Connecting to git.io (git.io)|34.197.27.35|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://raw.github.com/Nyr/openvpn-install/master/openvpn-install.sh [following]
--2020-04-06 10:02:14-- https://raw.github.com/Nyr/openvpn-install/master/openvpn-install.sh
Resolving raw.github.com (raw.github.com)... 151.101.112.133
Connecting to raw.github.com (raw.github.com)|151.101.112.133|:443... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://raw.githubusercontent.com/Nyr/openvpn-install/master/openvpn-install.sh [following]
--2020-04-06 10:02:14-- https://raw.githubusercontent.com/Nyr/openvpn-install/master/openvpn-install.sh
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 151.101.112.133
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|151.101.112.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 20587 (20K) [text/plain]
Saving to: openvpn-install.sh

Запустим скрипт openvpn-install.sh для установки и настройки сервера OpenVPN автоматически:

$ sudo bash openvpn-install.sh

Когда будет установлен IP адрес 104.248.137.187 (замените 104.248.137.187 на ваш актуальный IP) и порт на 1194 (или 443, если вы не используете веб сервер). Используйте OpenDNS или Google DNS серверы с VPN. Далее, введите имя клиента (например, iPhone, Nexus6, LinuxRouter, BackupServer и другие). Наконец, нажмите клавишу ‘Enter’ для установки и настройки OpenVPN на вашей системе:

Welcome to this OpenVPN road warrior installer!

I need to ask you a few questions before starting setup.
You can use the default options and just press enter if you are ok with them.

What IPv4 address should the OpenVPN server use?
1) 104.248.137.187
2) 10.19.0.5
IPv4 address [1]: 1

Which protocol do you want for OpenVPN connections?
1) UDP (recommended)
2) TCP
Protocol [1]: 2

What port do you want OpenVPN listening to?
Port [1194]: 443

Which DNS do you want to use with the VPN?
1) Current system resolvers
2) 1.1.1.1
3) Google
4) OpenDNS
5) Verisign
DNS [1]: 4

Finally, tell me a name for the client certificate.
Client name [client]:

Okay, that was all I needed. We are ready to set up your OpenVPN server now.
Press any key to continue...

0% [Working]

Get:1 http://mirrors.digitalocean.com/ubuntu bionic InRelease [242 kB]

0% [1 InRelease 0 B/242 kB 0%] [Connecting to security.ubuntu.com (2001:67c:1562::18)]

0% [Connecting to security.ubuntu.com (2001:67c:1562::18)]
0% [1 InRelease gpgv 242 kB] [Waiting for headers] [Waiting for headers]

Hit:2 http://mirrors.digitalocean.com/ubuntu bionic-updates InRelease

0% [1 InRelease gpgv 242 kB] [Waiting for headers] [Waiting for headers]

Hit:3 http://mirrors.digitalocean.com/ubuntu bionic-backports InRelease

0% [1 InRelease gpgv 242 kB] [Waiting for headers]

Get:4 http://security.ubuntu.com/ubuntu bionic-security InRelease [88.7 kB]

0% [1 InRelease gpgv 242 kB] [4 InRelease 2546 B/88.7 kB 3%]

0% [4 InRelease 11.1 kB/88.7 kB 13%]
0% [2 InRelease gpgv 88.7 kB] [4 InRelease 11.1 kB/88.7 kB 13%]

0% [4 InRelease 34.0 kB/88.7 kB 38%]
0% [3 InRelease gpgv 74.6 kB] [4 InRelease 34.0 kB/88.7 kB 38%]

0% [4 InRelease 79.7 kB/88.7 kB 90%]

0% [Working]
0% [4 InRelease gpgv 88.7 kB]

100% [Working]

Fetched 331 kB in 1s (639 kB/s)

Reading package lists... 0%

Reading package lists... 0%

Reading package lists... 0%

Reading package lists... 4%

Reading package lists... 4%

Reading package lists... 7%

Reading package lists... 7%

Reading package lists... 7%

Reading package lists... 7%

Reading package lists... 7%

Reading package lists... 7%

Reading package lists... 36%

Reading package lists... 46%

Reading package lists... 46%

Reading package lists... 67%

Reading package lists... 67%

Reading package lists... 68%

Reading package lists... 68%

Reading package lists... 68%

Reading package lists... 68%

Reading package lists... 73%

Reading package lists... 73%

Reading package lists... 77%

Reading package lists... 77%

Reading package lists... 77%

Reading package lists... 77%

Reading package lists... 77%

Reading package lists... 77%

Reading package lists... 84%

Reading package lists... 84%

Reading package lists... 86%

Reading package lists... 86%

Reading package lists... 86%

Reading package lists... 86%

Reading package lists... 86%

Reading package lists... 86%

Reading package lists... 86%

Reading package lists... 86%

Reading package lists... 86%

Reading package lists... 86%

Reading package lists... 86%

Reading package lists... 86%

Reading package lists... 86%

Reading package lists... 86%

Reading package lists... 90%

Reading package lists... 90%

Reading package lists... 91%

Reading package lists... 93%

Reading package lists... 93%

Reading package lists... 93%

Reading package lists... 93%

Reading package lists... 94%

Reading package lists... 94%

Reading package lists... 97%

Reading package lists... 97%

Reading package lists... 99%

Reading package lists... 99%

Reading package lists... 99%

Reading package lists... 99%

Reading package lists... 99%

Reading package lists... 99%

Reading package lists... Done

 

Reading package lists... 0%

Reading package lists... 100%

Reading package lists... Done

 

Building dependency tree... 0%

Building dependency tree... 0%

Building dependency tree... 50%

Building dependency tree... 50%

Building dependency tree

 

Reading state information... 0%

Reading state information... 0%

Reading state information... Done

ca-certificates is already the newest version (20180409).
ca-certificates set to manually installed.
iptables is already the newest version (1.6.1-2ubuntu2).
iptables set to manually installed.
openssl is already the newest version (1.1.1-1ubuntu2.1~18.04.5).
openssl set to manually installed.
The following packages were automatically installed and are no longer required:
grub-pc-bin libdumbnet1
Use 'sudo apt autoremove' to remove them.
The following additional packages will be installed:
libpkcs11-helper1
Suggested packages:
easy-rsa resolvconf
The following NEW packages will be installed:
libpkcs11-helper1 openvpn
0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.
Need to get 514 kB of archives.
After this operation, 1274 kB of additional disk space will be used.

0% [Working]

Get:1 http://mirrors.digitalocean.com/ubuntu bionic/main amd64 libpkcs11-helper1 amd64 1.22-4 [43.5 kB]

0% [1 libpkcs11-helper1 0 B/43.5 kB 0%]

17% [Working]

Get:2 http://mirrors.digitalocean.com/ubuntu bionic-updates/main amd64 openvpn amd64 2.4.4-2ubuntu1.3 [470 kB]

17% [2 openvpn 0 B/470 kB 0%]

100% [Working]

Fetched 514 kB in 0s (4780 kB/s)
Preconfiguring packages ...
Selecting previously unselected package libpkcs11-helper1:amd64.
(Reading database ...
(Reading database ... 5%
(Reading database ... 10%
(Reading database ... 15%
(Reading database ... 20%
(Reading database ... 25%
(Reading database ... 30%
(Reading database ... 35%
(Reading database ... 40%
(Reading database ... 45%
(Reading database ... 50%
(Reading database ... 55%
(Reading database ... 60%
(Reading database ... 65%
(Reading database ... 70%
(Reading database ... 75%
(Reading database ... 80%
(Reading database ... 85%
(Reading database ... 90%
(Reading database ... 95%
(Reading database ... 100%
(Reading database ... 90615 files and directories currently installed.)
Preparing to unpack .../libpkcs11-helper1_1.22-4_amd64.deb ...
Unpacking libpkcs11-helper1:amd64 (1.22-4) ...
Selecting previously unselected package openvpn.
Preparing to unpack .../openvpn_2.4.4-2ubuntu1.3_amd64.deb ...
Unpacking openvpn (2.4.4-2ubuntu1.3) ...
Setting up libpkcs11-helper1:amd64 (1.22-4) ...
Setting up openvpn (2.4.4-2ubuntu1.3) ...
* Restarting virtual private network daemon.
[ OK ]
Created symlink /etc/systemd/system/multi-user.target.wants/openvpn.service /lib/systemd/system/openvpn.service.
Processing triggers for systemd (237-3ubuntu10.39) ...
Processing triggers for man-db (2.8.3-2ubuntu0.1) ...
Processing triggers for ureadahead (0.100.0-21) ...
Processing triggers for libc-bin (2.27-3ubuntu1) ...

init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /etc/openvpn/server/easy-rsa/pki

 

Using SSL: openssl OpenSSL 1.1.1 11 Sep 2018
Generating RSA private key, 2048 bit long modulus (2 primes)
....................................................................+++++
...................................................................+++++
e is 65537 (0x010001)

Using SSL: openssl OpenSSL 1.1.1 11 Sep 2018
Generating a RSA private key
..........+++++
............................................................................+++++
writing new private key to '/etc/openvpn/server/easy-rsa/pki/easy-rsa-1835.Dv3KMm/tmp.l2XUzw'
-----
Using configuration from /etc/openvpn/server/easy-rsa/pki/easy-rsa-1835.Dv3KMm/tmp.vyDhJV
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'server'
Certificate is to be certified until Apr 4 10:05:08 2030 GMT (3650 days)

Write out database with 1 new entries
Data Base Updated

Using SSL: openssl OpenSSL 1.1.1 11 Sep 2018
Generating a RSA private key
..............................................................+++++
...........+++++
writing new private key to '/etc/openvpn/server/easy-rsa/pki/easy-rsa-1910.yLz4oy/tmp.FrKpNA'
-----
Using configuration from /etc/openvpn/server/easy-rsa/pki/easy-rsa-1910.yLz4oy/tmp.fCcXuX
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'client'
Certificate is to be certified until Apr 4 10:05:08 2030 GMT (3650 days)

Write out database with 1 new entries
Data Base Updated

Using SSL: openssl OpenSSL 1.1.1 11 Sep 2018
Using configuration from /etc/openvpn/server/easy-rsa/pki/easy-rsa-1966.ddMmvX/tmp.P8MtZ5

An updated CRL has been created.
CRL file: /etc/openvpn/server/easy-rsa/pki/crl.pem

 

Created symlink /etc/systemd/system/multi-user.target.wants/openvpn-iptables.service /etc/systemd/system/openvpn-iptables.service.
Created symlink /etc/systemd/system/multi-user.target.wants/[email protected] /lib/systemd/system/openvpn-server[email protected]

Finished!

Your client configuration is available at: /root/client.ovpn
If you want to add more clients, just run this script again!

На этом всё, ваш OpenVPN сервер настроен и готов к работе. Вы можете посмотреть файл добавленных правил фаервола /etc/systemd/system/multi-user.target.wants/openvpn-iptables.service используя команду cat:

$ less /etc/systemd/system/multi-user.target.wants/openvpn-iptables.service

Образец вывода:

[Unit]
Before=network.target
[Service]
Type=oneshot
ExecStart=/sbin/iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to 104.248.137.187
ExecStart=/sbin/iptables -I INPUT -p tcp --dport 443 -j ACCEPT
ExecStart=/sbin/iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT
ExecStart=/sbin/iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
ExecStop=/sbin/iptables -t nat -D POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to 104.248.137.187
ExecStop=/sbin/iptables -D INPUT -p tcp --dport 443 -j ACCEPT
ExecStop=/sbin/iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT
ExecStop=/sbin/iptables -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
ExecStart=/sbin/ip6tables -t nat -A POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to 2a03:b0 c0:3:e0::3ee:1
ExecStart=/sbin/ip6tables -I FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
ExecStart=/sbin/ip6tables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
ExecStop=/sbin/ip6tables -t nat -D POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to 2a03:b0c 0:3:e0::3ee:1
ExecStop=/sbin/ip6tables -D FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
ExecStop=/sbin/ip6tables -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target
/etc/systemd/system/multi-user.target.wants/openvpn-iptables.service (END)

Вы можете посмотреть настройки вашего OpenVPN сервера сгенерировав их скриптом приведенным ниже (не редактируйте этот файл вручную):

$ sudo more /etc/openvpn/server.conf
$ sudo vi -M /etc/openvpn/server.conf

Образец вывода:

local 104.248.137.187
port 443
proto tcp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.255.0
server-ipv6 fddd:1194:1194:1194::/64
push "redirect-gateway def1 ipv6 bypass-dhcp"
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem

Как запускать/останавливать/перезапускать OpenVPN сервер на Ubuntu / Debian / CentOS?

Для остановки службы OpenVPN:

$ sudo systemctl stop openvpn

Для запуска службы OpenVPN:

$ sudo systemctl start openvpn

Для перезапуска службы OpenVPN:

$ sudo systemctl restart openvpn

Шаг 4 – Настройка клиента

На сервере вы найдете файл настройки клиента по имени ~/client.ovpn. Всё, что вам нужно сделать – скопировать этот файл на ваш локальный рабочий стол и предоставить этому файлу соединение с вашим OpenVPN клиентом, для этого установим вебсервер Apache, чтобы можно было скачать конфигурацию:

$ apt-get install apache2

Образец вывода:

Reading package lists... 0%

Reading package lists... 100%

Reading package lists... Done

 

Building dependency tree... 0%

Building dependency tree... 0%

Building dependency tree... 50%

Building dependency tree... 50%

Building dependency tree

 

Reading state information... 0%

Reading state information... 0%

Reading state information... Done

The following packages were automatically installed and are no longer required:
grub-pc-bin libdumbnet1
Use 'apt autoremove' to remove them.
The following additional packages will be installed:
apache2-bin apache2-data apache2-utils libapr1 libaprutil1 libaprutil1-dbd-sqlite3 libaprutil1-ldap liblua5.2-0 ssl-cert
Suggested packages:
www-browser apache2-doc apache2-suexec-pristine | apache2-suexec-custom openssl-blacklist
The following NEW packages will be installed:
apache2 apache2-bin apache2-data apache2-utils libapr1 libaprutil1 libaprutil1-dbd-sqlite3 libaprutil1-ldap liblua5.2-0
ssl-cert
0 upgraded, 10 newly installed, 0 to remove and 0 not upgraded.
Need to get 1729 kB of archives.
After this operation, 6986 kB of additional disk space will be used.
Do you want to continue? [Y/n] y

0% [Working]

Get:1 http://mirrors.digitalocean.com/ubuntu bionic/main amd64 libapr1 amd64 1.6.3-2 [90.9 kB]

0% [1 libapr1 0 B/90.9 kB 0%]

6% [Working]

Get:2 http://mirrors.digitalocean.com/ubuntu bionic/main amd64 libaprutil1 amd64 1.6.1-2 [84.4 kB]

6% [2 libaprutil1 0 B/84.4 kB 0%]

12% [Working]

Get:3 http://mirrors.digitalocean.com/ubuntu bionic/main amd64 libaprutil1-dbd-sqlite3 amd64 1.6.1-2 [10.6 kB]

12% [3 libaprutil1-dbd-sqlite3 0 B/10.6 kB 0%]

15% [Working]

Get:4 http://mirrors.digitalocean.com/ubuntu bionic/main amd64 libaprutil1-ldap amd64 1.6.1-2 [8764 B]

15% [4 libaprutil1-ldap 0 B/8764 B 0%]

17% [Working]

Get:5 http://mirrors.digitalocean.com/ubuntu bionic/main amd64 liblua5.2-0 amd64 5.2.4-1.1build1 [108 kB]

17% [5 liblua5.2-0 0 B/108 kB 0%]

24% [Working]

Get:6 http://mirrors.digitalocean.com/ubuntu bionic-updates/main amd64 apache2-bin amd64 2.4.29-1ubuntu4.13 [1070 kB]

24% [6 apache2-bin 0 B/1070 kB 0%]

76% [Working]

Get:7 http://mirrors.digitalocean.com/ubuntu bionic-updates/main amd64 apache2-utils amd64 2.4.29-1ubuntu4.13 [83.8 kB]

76% [7 apache2-utils 0 B/83.8 kB 0%]

81% [Working]

Get:8 http://mirrors.digitalocean.com/ubuntu bionic-updates/main amd64 apache2-data all 2.4.29-1ubuntu4.13 [160 kB]

81% [8 apache2-data 0 B/160 kB 0%]

91% [Working]

Get:9 http://mirrors.digitalocean.com/ubuntu bionic-updates/main amd64 apache2 amd64 2.4.29-1ubuntu4.13 [95.1 kB]

91% [9 apache2 0 B/95.1 kB 0%]

97% [Working]

Get:10 http://mirrors.digitalocean.com/ubuntu bionic/main amd64 ssl-cert all 1.0.39 [17.0 kB]

97% [10 ssl-cert 0 B/17.0 kB 0%]

100% [Working]

Fetched 1729 kB in 0s (4199 kB/s)
Preconfiguring packages ...
Selecting previously unselected package libapr1:amd64.
(Reading database ...
(Reading database ... 5%
(Reading database ... 10%
(Reading database ... 15%
(Reading database ... 20%
(Reading database ... 25%
(Reading database ... 30%
(Reading database ... 35%
(Reading database ... 40%
(Reading database ... 45%
(Reading database ... 50%
(Reading database ... 55%
(Reading database ... 60%
(Reading database ... 65%
(Reading database ... 70%
(Reading database ... 75%
(Reading database ... 80%
(Reading database ... 85%
(Reading database ... 90%
(Reading database ... 95%
(Reading database ... 100%
(Reading database ... 90711 files and directories currently installed.)
Preparing to unpack .../0-libapr1_1.6.3-2_amd64.deb ...
Unpacking libapr1:amd64 (1.6.3-2) ...
Selecting previously unselected package libaprutil1:amd64.
Preparing to unpack .../1-libaprutil1_1.6.1-2_amd64.deb ...
Unpacking libaprutil1:amd64 (1.6.1-2) ...
Selecting previously unselected package libaprutil1-dbd-sqlite3:amd64.
Preparing to unpack .../2-libaprutil1-dbd-sqlite3_1.6.1-2_amd64.deb ...
Unpacking libaprutil1-dbd-sqlite3:amd64 (1.6.1-2) ...
Selecting previously unselected package libaprutil1-ldap:amd64.
Preparing to unpack .../3-libaprutil1-ldap_1.6.1-2_amd64.deb ...
Unpacking libaprutil1-ldap:amd64 (1.6.1-2) ...
Selecting previously unselected package liblua5.2-0:amd64.
Preparing to unpack .../4-liblua5.2-0_5.2.4-1.1build1_amd64.deb ...
Unpacking liblua5.2-0:amd64 (5.2.4-1.1build1) ...
Selecting previously unselected package apache2-bin.
Preparing to unpack .../5-apache2-bin_2.4.29-1ubuntu4.13_amd64.deb ...
Unpacking apache2-bin (2.4.29-1ubuntu4.13) ...
Selecting previously unselected package apache2-utils.
Preparing to unpack .../6-apache2-utils_2.4.29-1ubuntu4.13_amd64.deb ...
Unpacking apache2-utils (2.4.29-1ubuntu4.13) ...
Selecting previously unselected package apache2-data.
Preparing to unpack .../7-apache2-data_2.4.29-1ubuntu4.13_all.deb ...
Unpacking apache2-data (2.4.29-1ubuntu4.13) ...
Selecting previously unselected package apache2.
Preparing to unpack .../8-apache2_2.4.29-1ubuntu4.13_amd64.deb ...
Unpacking apache2 (2.4.29-1ubuntu4.13) ...
Selecting previously unselected package ssl-cert.
Preparing to unpack .../9-ssl-cert_1.0.39_all.deb ...
Unpacking ssl-cert (1.0.39) ...
Setting up libapr1:amd64 (1.6.3-2) ...
Setting up apache2-data (2.4.29-1ubuntu4.13) ...
Setting up ssl-cert (1.0.39) ...
Setting up libaprutil1:amd64 (1.6.1-2) ...
Setting up liblua5.2-0:amd64 (5.2.4-1.1build1) ...
Setting up libaprutil1-ldap:amd64 (1.6.1-2) ...
Setting up libaprutil1-dbd-sqlite3:amd64 (1.6.1-2) ...
Setting up apache2-utils (2.4.29-1ubuntu4.13) ...
Setting up apache2-bin (2.4.29-1ubuntu4.13) ...
Setting up apache2 (2.4.29-1ubuntu4.13) ...
Enabling module mpm_event.
Enabling module authz_core.
Enabling module authz_host.
Enabling module authn_core.
Enabling module auth_basic.
Enabling module access_compat.
Enabling module authn_file.
Enabling module authz_user.
Enabling module alias.
Enabling module dir.
Enabling module autoindex.
Enabling module env.
Enabling module mime.
Enabling module negotiation.
Enabling module setenvif.
Enabling module filter.
Enabling module deflate.
Enabling module status.
Enabling module reqtimeout.
Enabling conf charset.
Enabling conf localized-error-pages.
Enabling conf other-vhosts-access-log.
Enabling conf security.
Enabling conf serve-cgi-bin.
Enabling site 000-default.
Created symlink /etc/systemd/system/multi-user.target.wants/apache2.service /lib/systemd/system/apache2.service.
Created symlink /etc/systemd/system/multi-user.target.wants/apache-htcacheclean.service /lib/systemd/system/apache-htcacheclean.service.
Processing triggers for libc-bin (2.27-3ubuntu1) ...
Processing triggers for systemd (237-3ubuntu10.39) ...
Processing triggers for man-db (2.8.3-2ubuntu0.1) ...
Processing triggers for ufw (0.36-0ubuntu0.18.04.1) ...
Processing triggers for ureadahead (0.100.0-21) ...

Отредакитуем файл конфигурации хостинга:

vim /ectc/apache2/sites-available/000-default.conf

К следующему виду:

<VirtualHost *:80>
# The ServerName directive sets the request scheme, hostname and port that
# the server uses to identify itself. This is used when creating
# redirection URLs. In the context of virtual hosts, the ServerName
# specifies what hostname must appear in the request's Host: header to
# match this virtual host. For the default virtual host (this file) this
# value is not decisive as it is used as a last resort host regardless.
# However, you must set it for any further virtual host explicitly.
#ServerName www.example.com

ServerAdmin [email protected]
DocumentRoot /var/www/html

# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
# error, crit, alert, emerg.
# It is also possible to configure the loglevel for particular
# modules, e.g.
#LogLevel info ssl:warn

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined

# For most configuration files from conf-available/, which are
# enabled or disabled at a global level, it is possible to
# include a line for only one particular virtual host. For example the
# following line enables the CGI configuration for this host only
# after it has been globally disabled with "a2disconf".
#Include conf-available/serve-cgi-bin.conf

AccessFileName .htaccess

<Directory "/var/www/html">
Options FollowSymLinks
AllowOverride All
Require all granted
</Directory>

</VirtualHost>

Создадим файл /var/www/html/.htaccess

vim /var/www/html/.htaccess

Со следующим видом:

Redirect 302 /config http://104.248.137.187/client.ovpn

AddType application/octect-stream .ovpn

Скопируем файл конфигуркции в рабочую папку веб сервера:

cp client.ovpn /var/www/html/client.ovpn

Далее вам нужно установить OpenVPN клиент для вашей операционной системы

• OpenVPN для Apple IOS version 6.x или выше
• OpenVPN для Android
• OpenVPN для Apple MacOS (OS X)
• OpenVPN для Windows 7/8/10

Настройки клиента OpenVPN MacOS/OS X

Для начала установите OpenVPN macos клиент. Далее дважды нажмите на файл macos-vpn-client.ovpn и он откроется в вашем клиенте tunnelblick. Нажмите “Only me” для установки.

Единожды нажав на кнопку ‘Connect’ вы будете онлайн. Используйте приведенные ниже команды на клиентах MacOS для подтверждения замены вашего публичного IP на IP VPN сервера (введите в вашем локальном Linux/Unix/MacOS)

$ dig TXT +short o-o.myaddr.l.google.com @ns1.google.com

Образец вывода:

"104.237.156.154"

Вы можете проверить связь OpenVPN сервера частного IP:

$ ping 10.8.0.1

Образец вывода:

PING 10.8.0.1 (10.8.0.1): 56 data bytes
64 bytes from 10.8.0.1: icmp_seq=0 ttl=64 time=287.760 ms
64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=283.046 ms
64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=278.271 ms
64 bytes from 10.8.0.1: icmp_seq=3 ttl=64 time=283.679 ms
^C
--- 10.8.0.1 ping statistics ---
4 packets transmitted, 4 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 278.271/283.189/287.760/3.367 ms

Настройка клиента Linux OpenVPN

Установка клиента OpenVPN на RHEL/CentOS Linux командой yum:

$ sudo yum install openvpn

Или установки клиента OpenVPN на Debian/Ubuntu Linux Linux используйте команду apt:

$ sudo apt install openvpn

Далее, скопируйте macos-vpn-client.ovpn как показано ниже:

$ sudo cp macos-vpn-client.ovpn /etc/openvpn/client.conf

Проверьте соединение от CLI:

$ sudo openvpn --client --config /etc/openvpn/client.conf

Ваша система Linux будет автоматически подключена, когда компьютер перезапустится используя скрипт /etc/init.d/openvpn:

$ sudo /etc/init.d/openvpn start

Для систем построенных на systemd нужно поступать следующим образом:

$ sudo systemctl start [email protected]

Проверьте соединение:

$ ping 10.8.0.1 # Ping to OpenVPN server gateway

$ ip route # Make sure routing setup
$ dig TXT +short o-o.myaddr.l.google.com @ns1.google.com # Make sure your public IP set to OpenVPN server

Настройка клиента FreeBSD OpenVPN

Первое, установите клиент OpenVPN, введите:

$ sudo pkg install openvpn

Далее, скопируйте macos-vpn-client.ovpn следующим образом:

$ mkdir -p /usr/local/etc/openvpn/
$ sudo cp macos-vpn-client.ovpn /usr/local/etc/openvpn/client.conf

Редактирование /etc/rc.conf и добавление по примеру приведенному ниже:

openvpn_enable="YES"
openvpn_configfile="/usr/local/etc/openvpn/client.conf"

Запуск службы OpenVPN:

$ sudo /usr/local/etc/rc.d/openvpn start

Подтверждение:

$ ping 10.8.0.1 #Ping to OpenVPN server gateway

$
$ netstat -nr #Make sure routing setup
$
$ drill myip.opendns.com @resolver1.opendns.com #Make sure your public IP set to OpenVPN server

Ссылки:

• OpenVPN
• OpenVPN road warrior для Linux

На этом всё, у вас установлен OpenVPN сервер, что поможет достигнуть нового уровня приватности на только вашем облачном сервере Ubuntu / Debian /CentOS.

Спасибо за уделенное время на прочтение статьи!

Если возникли вопросы, задавайте их в комментариях.

Подписывайтесь на обновления нашего блога и оставайтесь в курсе новостей мира инфокоммуникаций!

Чтобы знать больше и выделяться знаниями среди толпы IT-шников, записывайтесь на курсы Cisco, курсы по кибербезопасности,  полный курс по кибербезопасности, курсы DevNet (программируемые сети) от Академии Cisco, курсы Linux от Linux Professional Institute на платформе SEDICOMM University (Университет СЭДИКОММ).