\n\u203btun(\u30eb\u30fc\u30c6\u30a3\u30f3\u30b0)\u65b9\u5f0f\u3067\u8a2d\u5b9a\u3059\u308b
\n\u203b\u81ea\u5b85\u7528\u306a\u306e\u3067\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ea\u30b9\u30af(CA\u306e\u79d8\u5bc6\u9375\u3078\u306e\u30a2\u30af\u30bb\u30b9)\u3092\u627f\u77e5\u3057\u305f\u4e0a\u3067OpenVPN\u30b5\u30fc\u30d0\u30fc\u3068CA\u3092\u540c\u3058\u30de\u30b7\u30f3\u306b\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\n<\/p>\n
\r\n\u30fb Ubuntu: 22.04.1\r\n\u30fb openvpn: 2.5.5\r\n\u30fb easy-rsa: 3.0.8\r\n\u30fb openssl: 3.0.2\r\n<\/pre>\n\u30b5\u30fc\u30d0\u30fc\u8a2d\u5b9a\u624b\u9806<\/h4>\n
\nopenvpn\u3068easy-rsa\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\u3002\n<\/p>\n
\r\n# apt install openvpn easy-rsa\r\n<\/pre>\n\n\u30eb\u30fc\u30c8\u8a3c\u660e\u66f8\u306e\u6709\u52b9\u671f\u9593(\u65e5\u6570)\u3092\u5909\u66f4\u3057\u305f\u3044\u5834\u5408\u3001\u4e8b\u524d\u306b\u4e0b\u8a18\u3092\u53c2\u8003\u306b\u74b0\u5883\u5909\u6570\u3092\u5909\u66f4\u3059\u308b\u3002\n<\/p>\n
\r\n# export EASYRSA_CA_EXPIRE=7300\r\n<\/pre>\n\n\u516c\u958b\u9375\u57fa\u76e4(PKI)\u3092\u521d\u671f\u5316\u3057\u3066\u8a8d\u8a3c\u5c40(CA)\u3092\u8a2d\u7f6e\u3059\u308b\u3002CA\u4f5c\u6210\u6642\u306b\u79d8\u5bc6\u9375\u306e\u30d1\u30b9\u30d5\u30ec\u30fc\u30ba\u3092\u805e\u3044\u3066\u304f\u308b\u3002\u3053\u306e\u30d1\u30b9\u30d5\u30ec\u30fc\u30ba\u306f\u65b0\u3057\u3044\u8a3c\u660e\u66f8\u767a\u884c\u6642\u306b\u5fc5\u8981\u306b\u306a\u308b\u3002\n<\/p>\n
\r\n# cd \/usr\/share\/easy-rsa\/\r\n# .\/easyrsa init-pki\r\n# .\/easyrsa build-ca\r\n<\/pre>\n\n\u8a8d\u8a3c\u5c40(CA)\u304c\u767a\u884c\u3059\u308b\u8a3c\u660e\u66f8\u306e\u6709\u52b9\u671f\u9593(\u65e5\u6570)\u3092\u5909\u66f4\u3057\u305f\u3044\u5834\u5408\u3001\u4e8b\u524d\u306b\u4e0b\u8a18\u3092\u53c2\u8003\u306b\u74b0\u5883\u5909\u6570\u3092\u5909\u66f4\u3059\u308b\u3002\n<\/p>\n
\r\n# export EASYRSA_CERT_EXPIRE=3650\r\n<\/pre>\n\nVPN\u30b5\u30fc\u30d0\u30fc\u7528\u306e\u8a3c\u660e\u66f8\u3092\u4f5c\u6210\u3059\u308b\u3002
\n\u203b\u30d1\u30b9\u30d5\u30ec\u30fc\u30ba\u306f\u4e0d\u8981\u306a\u306e\u3067nopass\u3092\u6307\u5b9a\n<\/p>\n\r\n# .\/easyrsa build-server-full vpn.example.com nopass\r\n<\/pre>\n\nDiffie-Hellman\u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u30d5\u30a1\u30a4\u30eb\u3092\u4f5c\u6210\u3059\u308b\u3002\n<\/p>\n
\r\n# .\/easyrsa gen-dh\r\n<\/pre>\n\nTLS-Auth\u306eHMAC\u306b\u4f7f\u7528\u3059\u308b\u5171\u901a\u9375\u3092\u4f5c\u6210\u3059\u308b\u3002\n<\/p>\n
\r\n# openvpn --genkey secret \/etc\/openvpn\/server\/ta.key\r\n<\/pre>\n\nOpenVPN\u30b5\u30fc\u30d0\u30fc\u306e\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u3092\u30b5\u30f3\u30d7\u30eb\u304b\u3089\u30b3\u30d4\u30fc\u3059\u308b\u3002\n<\/p>\n
\r\n# cp \/usr\/share\/doc\/openvpn\/examples\/sample-config-files\/server.conf \/etc\/openvpn\/\r\n<\/pre>\n\n\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u3092\u4e0b\u8a18\u306e\u3088\u3046\u306b\u5909\u66f4\u3059\u308b\u3002
\n\u203b\u91cd\u8981\u305d\u3046\u306a\u7b87\u6240\u306e\u307f\u8a18\u8f09
\n\u203bserver\u306b\u306f\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306b\u5272\u308a\u5f53\u3066\u3089\u308c\u308bip\u30a2\u30c9\u30ec\u30b9\u3092\u5b9a\u7fa9
\n\u203bpush(route)\u306b\u306f\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306b\u30a2\u30af\u30bb\u30b9\u3092\u8a31\u53ef\u3059\u308b\u30b5\u30fc\u30d0\u30fc\u306e\u30d7\u30e9\u30a4\u30d9\u30fc\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u3092\u6307\u5b9a
\n\u203bpush(redirect-gateway)\u3067\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306eIP\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u304cVPN\u3092\u901a\u904e\u3059\u308b\u3088\u3046\u8a2d\u5b9a
\n\u203bpush(dhcp-option DNS)\u3067\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u304c\u4f7f\u7528\u3059\u308bDNS\u30b5\u30fc\u30d0\u30fc\u3092\u6307\u5b9a
\n\u203bclient-to-client\u3067\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u540c\u58eb\u306e\u901a\u4fe1\u3092\u8a31\u53ef
\n\u203bduplicate-cn\u3067\u540c\u3058\u8a3c\u660e\u66f8\u3092\u4f7f\u7528\u3057\u305f\u8907\u6570\u306e\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u63a5\u7d9a\u3092\u8a31\u53ef(\u975e\u63a8\u5968)\n<\/p>\n\r\nport 7716\r\nproto udp\r\ndev tun\r\nca \/usr\/share\/easy-rsa\/pki\/ca.crt\r\ncert \/usr\/share\/easy-rsa\/pki\/issued\/vpn.example.com.crt\r\nkey \/usr\/share\/easy-rsa\/pki\/private\/vpn.example.com.key\r\ndh \/usr\/share\/easy-rsa\/pki\/dh.pem\r\nserver 172.16.1.0 255.255.255.0\r\npush "route 192.168.1.0 255.255.255.0"\r\npush "redirect-gateway def1 bypass-dhcp"\r\npush "dhcp-option DNS 192.168.1.11"\r\npush "dhcp-option DNS 8.8.8.8"\r\nclient-to-client\r\nduplicate-cn\r\ntls-auth server\/ta.key 0\r\n<\/pre>\n\nIP\u30d5\u30a9\u30ef\u30fc\u30c9\u3092\u6709\u52b9\u306b\u3057\u3066\u3001\u7570\u306a\u308b\u30cd\u30c3\u30c8\u30ef\u30fc\u30af(NIC)\u9593\u3067\u30d1\u30b1\u30c3\u30c8\u304c\u8ee2\u9001\u3055\u308c\u308b\u3088\u3046\u306b\u8a2d\u5b9a\u5909\u66f4\u3059\u308b\u3002\n<\/p>\n
\r\n# sed -i "s\/#net.ipv4.ip_forward\/net.ipv4.ip_forward\/g" \/etc\/sysctl.conf\r\n# sysctl -p\r\n<\/pre>\n\niptables\u3067IP\u30de\u30b9\u30ab\u30ec\u30fc\u30c9\u3092\u6709\u52b9\u306b\u8a2d\u5b9a\u3059\u308b\u3002\n<\/p>\n
\r\n# apt install iptables-persistent\r\n# iptables -t nat -A POSTROUTING -s 172.16.1.0\/24 -o [\u30c7\u30d0\u30a4\u30b9\u540d] -j MASQUERADE\r\n# netfilter-persistent save\r\n<\/pre>\n\n\u30b5\u30fc\u30d3\u30b9\u3092\u6709\u52b9\u5316\u3057\u3066\u8d77\u52d5\u3059\u308b\u3002\n<\/p>\n
\r\n# systemctl enable --now openvpn@server\r\n<\/pre>\n\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u8a3c\u660e\u66f8\u306e\u767a\u884c<\/h4>\n
\n\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306b\u914d\u308b*.ovpn\u3092\u4f5c\u6210\u3059\u308b\u306e\u304c\u9762\u5012\u306a\u306e\u3067\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u4f5c\u6210\u3057\u305f\u3002\u5730\u5473\u306b\u30cf\u30de\u3063\u305f\u30dd\u30a4\u30f3\u30c8\u306fTLS-Auth\u306e\u300ckey-direction 1\u300d\u30b5\u30fc\u30d0\u30fc\u306e\u8a2d\u5b9a\u304c0\u306a\u30891\u306b\u3059\u308b\u5fc5\u8981\u304c\u3042\u308b\u3002\n<\/p>\n
\r\n#!\/bin\/bash\r\neasyrsa_location=\/usr\/share\/easy-rsa\r\nsample_config_location=\/usr\/share\/doc\/openvpn\/examples\/sample-config-files\r\ntakey_location=\/etc\/openvpn\/server\/ta.key\r\nserver=vpn.example.com\r\nport=7716\r\necho "\u4f5c\u6210\u3059\u308b\u30e6\u30fc\u30b6\u30fcID\u3092\u5165\u529b\u3057\u3066\u304f\u3060\u3055\u3044\u3002"\r\nread -p "\u30e6\u30fc\u30b6\u30fcID:" id\r\nif [ -z "$id" ]; then\r\n exit 0\r\nfi\r\nfullname=$id.$server\r\necho\r\necho "\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u63a5\u7d9a\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u300c$id.ovpn\u300d\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002"\r\nread -p "Enter\u30ad\u30fc\u3067\u7d9a\u884c\u3057\u307e\u3059\u3002" result\r\nif [ ! -z "$result" ]; then\r\n exit 0\r\nfi\r\necho\r\ndefault_location=$(pwd)\r\ncd $easyrsa_location\r\n.\/easyrsa build-client-full $fullname nopass\r\nif [ ! $? -eq 0 ]; then\r\n exit 0;\r\nfi\r\ncd $default_location\r\ncp $sample_config_location\/client.conf $id.ovpn\r\nsed -i "s\/my-server-1 1194\/$server $port\/g" $id.ovpn\r\nsed -i "s\/ca ca.crt\/#ca ca.crt\/g" $id.ovpn\r\nsed -i "s\/cert client.crt\/#cert client.crt\/g" $id.ovpn\r\nsed -i "s\/key client.key\/#key client.key\/g" $id.ovpn\r\nsed -i "s\/tls-auth ta.key 1\/#tls-auth ta.key 1\\nkey-direction 1\/g" $id.ovpn\r\necho "" >>$id.ovpn\r\n# CA\r\necho "<ca>" >>$id.ovpn\r\ngrep -A 100 'BEGIN CERTIFICATE' $easyrsa_location\/pki\/ca.crt >>$id.ovpn\r\necho "<\/ca>" >>$id.ovpn\r\necho "" >>$id.ovpn\r\n# Key\r\necho "<key>" >>$id.ovpn\r\ngrep -A 100 'BEGIN PRIVATE KEY' $easyrsa_location\/pki\/private\/$fullname.key >>$id.ovpn\r\necho "<\/key>" >>$id.ovpn\r\necho "" >>$id.ovpn\r\n# Cert\r\necho "<cert>" >>$id.ovpn\r\ngrep -A 100 'BEGIN CERTIFICATE' $easyrsa_location\/pki\/issued\/$fullname.crt >>$id.ovpn\r\necho "<\/cert>" >>$id.ovpn\r\necho "" >>$id.ovpn\r\n# TLS-auth\r\necho "<tls-auth>" >>$id.ovpn\r\ncat $takey_location >>$id.ovpn\r\necho "<\/tls-auth>" >>$id.ovpn\r\necho "" >>$id.ovpn\r\necho "\u4f5c\u6210\u304c\u5b8c\u4e86\u3057\u307e\u3057\u305f\u3002"\r\n<\/pre>\n\n\u5b9f\u884c\u53ef\u80fd\u306b\u3057\u3066\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u5b9f\u884c\u3059\u308c\u3070\u5bfe\u8a71\u578b\u3067\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u7528\u306e*.ovpn\u3092\u4f5c\u6210\u3067\u304d\u308b\u3002\u4f5c\u6210\u3055\u308c\u305f*.ovpn\u306e\u30d1\u30fc\u30df\u30c3\u30b7\u30e7\u30f3\u306b\u306f\u6c17\u3092\u3064\u3051\u304c\u65b9\u304c\u826f\u3044\u3002\n<\/p>\n
\r\n# chmod +x build-client-ovpn.sh\r\n# .\/build-client-ovpn.sh\r\n<\/pre>\n\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u8a3c\u660e\u66f8\u306e\u66f4\u65b0<\/h4>\n
\n\u66f4\u65b0\u304c\u53ef\u80fd\u306b\u306a\u308b\u671f\u9593\u3092\u5909\u66f4\u3057\u305f\u3044\u5834\u5408\u3001\u4e8b\u524d\u306b\u4e0b\u8a18\u3092\u53c2\u8003\u306b\u74b0\u5883\u5909\u6570\u3092\u5909\u66f4\u3059\u308b\u3002\n<\/p>\n
\r\n# export EASYRSA_CERT_RENEW=365\r\n<\/pre>\n\n\u3053\u308c\u3082\u9762\u5012\u306a\u306e\u3067\u66f4\u65b0\u7528\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u4f5c\u6210\u3057\u305f\u3002\n<\/p>\n
\r\n#!\/bin\/bash\r\neasyrsa_location=\/usr\/share\/easy-rsa\r\nsample_config_location=\/usr\/share\/doc\/openvpn\/examples\/sample-config-files\r\ntakey_location=\/etc\/openvpn\/server\/ta.key\r\nserver=vpn.example.com\r\nport=7716\r\necho "\u66f4\u65b0\u3059\u308b\u30e6\u30fc\u30b6\u30fcID\u3092\u5165\u529b\u3057\u3066\u304f\u3060\u3055\u3044\u3002"\r\nread -p "\u30e6\u30fc\u30b6\u30fcID:" id\r\nif [ -z "$id" ]; then\r\n exit 0\r\nfi\r\nfullname=$id.$server\r\necho\r\nif [ ! -f "$easyrsa_location\/pki\/issued\/$fullname.crt" ]; then\r\n echo "\u65e2\u5b58\u306e\u8a3c\u660e\u66f8\u304c\u898b\u3064\u304b\u308a\u307e\u305b\u3093\u3067\u3057\u305f\u3002"\r\n exit 1\r\nfi\r\necho "\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u63a5\u7d9a\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u300c$id.ovpn\u300d\u3092\u518d\u4f5c\u6210\u3057\u307e\u3059\u3002"\r\nread -p "Enter\u30ad\u30fc\u3067\u7d9a\u884c\u3057\u307e\u3059\u3002" result\r\nif [ ! -z "$result" ]; then\r\n exit 0\r\nfi\r\necho\r\ndefault_location=$(pwd)\r\ncd $easyrsa_location\r\n.\/easyrsa renew $fullname nopass\r\nif [ ! $? -eq 0 ]; then\r\n exit 0;\r\nfi\r\ncd $default_location\r\ncp $sample_config_location\/client.conf $id.ovpn\r\nsed -i "s\/my-server-1 1194\/$server $port\/g" $id.ovpn\r\nsed -i "s\/ca ca.crt\/#ca ca.crt\/g" $id.ovpn\r\nsed -i "s\/cert client.crt\/#cert client.crt\/g" $id.ovpn\r\nsed -i "s\/key client.key\/#key client.key\/g" $id.ovpn\r\nsed -i "s\/tls-auth ta.key 1\/#tls-auth ta.key 1\\nkey-direction 1\/g" $id.ovpn\r\necho "" >>$id.ovpn\r\n# CA\r\necho "<ca>" >>$id.ovpn\r\ngrep -A 100 'BEGIN CERTIFICATE' $easyrsa_location\/pki\/ca.crt >>$id.ovpn\r\necho "<\/ca>" >>$id.ovpn\r\necho "" >>$id.ovpn\r\n# Key\r\necho "<key>" >>$id.ovpn\r\ngrep -A 100 'BEGIN PRIVATE KEY' $easyrsa_location\/pki\/private\/$fullname.key >>$id.ovpn\r\necho "<\/key>" >>$id.ovpn\r\necho "" >>$id.ovpn\r\n# Cert\r\necho "<cert>" >>$id.ovpn\r\ngrep -A 100 'BEGIN CERTIFICATE' $easyrsa_location\/pki\/issued\/$fullname.crt >>$id.ovpn\r\necho "<\/cert>" >>$id.ovpn\r\necho "" >>$id.ovpn\r\n# TLS-auth\r\necho "<tls-auth>" >>$id.ovpn\r\ncat $takey_location >>$id.ovpn\r\necho "<\/tls-auth>" >>$id.ovpn\r\necho "" >>$id.ovpn\r\necho "\u4f5c\u6210\u304c\u5b8c\u4e86\u3057\u307e\u3057\u305f\u3002"\r\n<\/pre>\n\n\u5b9f\u884c\u53ef\u80fd\u306b\u3059\u308c\u3070\u5bfe\u8a71\u578b\u3067\u66f4\u65b0\u304c\u3067\u304d\u308b\u3002\u4f5c\u6210\u3055\u308c\u305f*.ovpn\u306e\u30d1\u30fc\u30df\u30c3\u30b7\u30e7\u30f3\u306b\u306f\u6c17\u3092\u3064\u3051\u304c\u65b9\u304c\u826f\u3044\u3002\n<\/p>\n
\r\n# chmod +x renew-client-ovpn.sh\r\n# .\/renew-client-ovpn.sh\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"\u524d\u63d0\u6761\u4ef6 \u203btun(\u30eb\u30fc\u30c6\u30a3\u30f3\u30b0)\u65b9\u5f0f\u3067\u8a2d\u5b9a\u3059\u308b \u203b\u81ea\u5b85\u7528\u306a\u306e\u3067\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ea\u30b9\u30af(CA\u306e\u79d8\u5bc6\u9375\u3078\u306e\u30a2\u30af\u30bb\u30b9)\u3092\u627f\u77e5\u3057\u305f\u4e0a\u3067OpenVPN\u30b5\u30fc\u30d0\u30fc\u3068CA\u3092\u540c\u3058\u30de\u30b7\u30f3\u306b\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b \u30fb Ubuntu: 22.04.1 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[],"class_list":["post-2384","post","type-post","status-publish","format-standard","hentry","category-ubuntu"],"views":4268,"_links":{"self":[{"href":"https:\/\/weblog.hirohiro716.com\/index.php?rest_route=\/wp\/v2\/posts\/2384","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/weblog.hirohiro716.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/weblog.hirohiro716.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/weblog.hirohiro716.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/weblog.hirohiro716.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2384"}],"version-history":[{"count":9,"href":"https:\/\/weblog.hirohiro716.com\/index.php?rest_route=\/wp\/v2\/posts\/2384\/revisions"}],"predecessor-version":[{"id":2567,"href":"https:\/\/weblog.hirohiro716.com\/index.php?rest_route=\/wp\/v2\/posts\/2384\/revisions\/2567"}],"wp:attachment":[{"href":"https:\/\/weblog.hirohiro716.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2384"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/weblog.hirohiro716.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2384"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/weblog.hirohiro716.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2384"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}