Kod: Zaznacz cały
https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-debian-8Kod: Zaznacz cały
##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server. #
# #
# This configuration can be used by multiple #
# clients, however each client should have #
# its own cert and key files. #
# #
# On Windows, you might want to rename this #
# file so it has a .ovpn extension #
##############################################
# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client
# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun
# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one. On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap
# Are we connecting to a TCP or
# UDP server? Use the same setting as
# on the server.
;proto tcp
proto udp
# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote moje_IP 11194
;remote my-server-2 1194
# Choose a random host from the remote
# list for load-balancing. Otherwise
# try hosts in the order specified.
;remote-random
# Keep trying indefinitely to resolve the
# host name of the OpenVPN server. Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite
# Most clients don't need to bind to
# a specific local port number.
nobind
# Downgrade privileges after initialization (non-Windows only)
user nobody
group nogroup
# Try to preserve some state across restarts.
persist-key
persist-tun
# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here. See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
# Wireless networks often produce a lot
# of duplicate packets. Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings
# SSL/TLS parms.
# See the server config file for more
# description. It's best to use
# a separate .crt/.key file pair
# for each client. A single ca
# file can be used for all clients.
;ca ca.crt
;cert client.crt
;key client.key
# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server". This is an
# important precaution to protect against
# a potential attack discussed here:
# http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server". The build-key-server
# script in the easy-rsa folder will do this.
ns-cert-type server
# If a tls-auth key is used on the server
# then every client must also have the key.
;tls-auth ta.key 1
# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
;cipher x
# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo
# Set log file verbosity.
verb 3
# Silence repeating messages
;mute 20
<ca>
-----BEGIN CERTIFICATE-----
MIIEjzCCA3egAwIBAgIJAM79KzPSvbr4MA0GCSqGSIb3DQEBCwUAMIGLMQswCQYD
VQQGEwJQTDEMMAoGA1UECBMDUE9MMQ4wDAYDVQQHEwVSYWJrYTELMAkGA1UEChMC
REsxDjAMBgNVBAsTBU15VlBOMQ4wDAYDVQQDEwVESyBDQTEPMA0GA1UEKRMGc2Vy
dmVyMSAwHgYJKoZIhvcNAQkBFhFkYXJrb205QGdtYWlsLmNvbTAeFw0xNzA0MDYy
MTQyMTZaFw0yNzA0MDQyMTQyMTZaMIGLMQswCQYDVQQGEwJQTDEMMAoGA1UECBMD
UE9MMQ4wDAYDVQQHEwVSYWJrYTELMAkGA1UEChMCREsxDjAMBgNVBAsTBU15VlBO
MQ4wDAYDVQQDEwVESyBDQTEPMA0GA1UEKRMGc2VydmVyMSAwHgYJKoZIhvcNAQkB
FhFkYXJrb205QGdtYWlsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
ggEBAMqKShXeZcphZdNuOe8kGsHusQvbWpuxHvzwaav+8N+sYTgIUwCXpqbT+NXl
rbjDLskSr2dxv0Yy4FOx/9/X+yIce+iH0irM8lu9/rPmzaWYOxnyp2KeRl14QMzJ
kKNFSm/DkEgJd2etG4jX3gAmV9rfozCwqagGDKIfRP8Q3PImymGUwpzkpPkfjSxx
Nif/NZAcZF9NGpy5PLeomYFMoMaHCZon2DT1YPz8J8c5vBsER1YCKd34gcp3JXP1
63dIvgcFIOFLJhSP0BR63Io4panX8Ylkjcz58ssWPXvGYo13Lk/ad28tZonqct6w
FwIyp6DxG3ZUqyY8vH82dCJrI+8CAwEAAaOB8zCB8DAdBgNVHQ4EFgQUNfxhdt5N
J/p+enonRQB5pud7LLwwgcAGA1UdIwSBuDCBtYAUNfxhdt5NJ/p+enonRQB5pud7
LLyhgZGkgY4wgYsxCzAJBgNVBAYTAlBMMQwwCgYDVQQIEwNQT0wxDjAMBgNVBAcT
BVJhYmthMQswCQYDVQQKEwJESzEOMAwGA1UECxMFTXlWUE4xDjAMBgNVBAMTBURL
IENBMQ8wDQYDVQQpEwZzZXJ2ZXIxIDAeBgkqhkiG9w0BCQEWEWRhcmtvbTlAZ21h
aWwuY29tggkAzv0rM9K9uvgwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC
AQEAjxo6jDdB6JElOE0iUVhn7QjaRVK0TZrESp3JwzDzZkpMTBrJrcHESrPVT8DA
O2WXgzNN8T1scgbLXK8gutHrRttirKryJBf+N66rTfrVTR7QESD+3YEHE/4uIx0L
/wLADhBOxXpBr6hNOllKRVRgPN6gn8zUeTacZ78z/+nG54SUKF4eSsIYxhdQ4x7m
CnpHj3PZBwOzEni63F+I2zGTnTilumKj/tWvsBW3cN3r0Zzh2Yw5Iqxh0GrQv2Wb
24DmmzpRp6gtm2ORmuQCl1/26yQKp6a63nnS7Zsld2tgi/attPRC5GkXq9qVrISD
W/w5JAShZzxWRIpc72g0hJoWKQ==
-----END CERTIFICATE-----
</ca>
<cert>
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=PL, ST=POL, L=Rabka, O=DK, OU=MyVPN, CN=DK CA/name=server/[email protected]
Validity
Not Before: Apr 10 17:35:22 2017 GMT
Not After : Apr 8 17:35:22 2027 GMT
Subject: C=PL, ST=POL, L=Rabka, O=DK, OU=MyVPN, CN=test1/name=server/[email protected]
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:c1:83:ce:fc:e2:d3:8f:07:86:52:b3:13:15:80:
5a:b9:d6:dd:e2:27:5b:ca:46:3b:73:56:44:a4:2e:
1c:47:cf:0a:a8:ae:64:78:26:12:ff:d7:8c:a9:5c:
0d:c0:bc:0f:f2:02:61:3f:b2:2d:f9:21:c7:3c:d3:
7e:8b:60:b7:93:96:e4:89:e6:26:e7:14:6b:f5:45:
b1:ca:bf:79:81:ef:40:66:e3:b2:da:d7:ca:d9:55:
1f:54:ee:d2:3c:61:62:b9:77:2e:13:2d:8e:47:07:
79:53:7e:9e:bf:37:81:33:22:09:2d:4d:08:cd:a5:
03:e3:f8:8c:7f:71:3f:18:a4:c7:bc:bc:42:52:58:
32:7a:d8:0d:ff:5f:2a:e1:b0:f1:80:de:92:aa:81:
a2:d3:6b:0a:3a:fe:33:53:aa:be:45:ee:10:29:52:
64:e5:57:08:12:60:ca:d2:67:08:24:f9:75:06:48:
f4:bf:19:f0:4c:72:e9:b7:a4:8e:28:1f:72:06:34:
12:13:fc:fe:55:8f:b7:63:54:f2:cd:45:5a:66:98:
f3:c3:39:ff:d6:10:e7:d8:fa:87:ad:79:51:25:5e:
19:32:81:ee:76:f8:e0:ff:d9:3a:7b:f6:db:8e:d9:
0a:41:3b:ca:74:31:67:cf:43:94:df:c3:66:d7:e7:
e1:97
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
Easy-RSA Generated Certificate
X509v3 Subject Key Identifier:
40:2C:39:30:41:91:94:18:DD:65:08:ED:60:E0:7A:C9:A4:6F:62:61
X509v3 Authority Key Identifier:
keyid:9D:AE:4D:F1:47:23:CA:9B:9A:5A:6E:BD:4F:25:4B:B4:19:33:38:DA
DirName:/C=PL/ST=POL/L=Rabka/O=DK/OU=MyVPN/CN=DK CA/name=server/[email protected]
serial:C8:5A:0A:1E:73:98:FE:B3
X509v3 Extended Key Usage:
TLS Web Client Authentication
X509v3 Key Usage:
Digital Signature
X509v3 Subject Alternative Name:
DNS:test1
Signature Algorithm: sha256WithRSAEncryption
4f:97:90:02:2c:a6:fb:06:4e:ba:19:b8:eb:2d:9a:23:75:67:
0b:0c:de:69:18:87:dd:58:1d:1c:b9:dc:4e:3a:35:08:a3:5b:
19:d2:d1:f5:f6:2d:de:c9:55:91:43:9b:55:5e:0f:19:1e:cd:
5f:73:55:b0:55:f4:b3:e5:37:05:50:33:9a:ac:84:9f:14:ef:
c3:51:64:9e:01:8f:0f:e5:7d:ff:a6:72:77:62:22:1e:0d:f7:
8e:87:91:b7:6f:42:a7:76:40:2a:62:c0:22:38:2f:04:b5:35:
db:28:fc:20:e7:0e:90:6f:b7:fd:41:18:2f:d6:7b:9b:a0:ad:
9d:31:b5:35:72:4b:1a:4d:ae:d9:f2:ee:cf:38:5d:07:12:95:
1c:f8:e2:b8:ef:5e:f6:64:93:cb:55:cd:48:1c:4a:79:82:0c:
7b:10:26:db:2e:56:88:91:de:f5:f6:d0:65:0f:60:9a:74:ca:
60:8c:c1:f9:6a:26:23:c0:b5:58:9c:10:50:fc:aa:63:ad:2f:
b8:72:d8:63:39:8f:0a:57:cc:35:c0:20:fd:fd:89:f6:95:b7:
ef:4b:2b:31:62:7e:fe:5d:6a:a8:93:e9:aa:98:4c:ac:cd:b1:
d5:bd:b7:04:76:7e:6b:d9:55:57:6b:e3:65:5b:ad:fd:5f:8a:
9c:50:a6:71
-----BEGIN CERTIFICATE-----
MIIE6TCCA9GgAwIBAgIBATANBgkqhkiG9w0BAQsFADCBizELMAkGA1UEBhMCUEwx
DDAKBgNVBAgTA1BPTDEOMAwGA1UEBxMFUmFia2ExCzAJBgNVBAoTAkRLMQ4wDAYD
VQQLEwVNeVZQTjEOMAwGA1UEAxMFREsgQ0ExDzANBgNVBCkTBnNlcnZlcjEgMB4G
CSqGSIb3DQEJARYRZGFya29tOUBnbWFpbC5jb20wHhcNMTcwNDEwMTczNTIyWhcN
MjcwNDA4MTczNTIyWjCBizELMAkGA1UEBhMCUEwxDDAKBgNVBAgTA1BPTDEOMAwG
A1UEBxMFUmFia2ExCzAJBgNVBAoTAkRLMQ4wDAYDVQQLEwVNeVZQTjEOMAwGA1UE
AxMFdGVzdDExDzANBgNVBCkTBnNlcnZlcjEgMB4GCSqGSIb3DQEJARYRZGFya29t
OUBnbWFpbC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDBg878
4tOPB4ZSsxMVgFq51t3iJ1vKRjtzVkSkLhxHzwqormR4JhL/14ypXA3AvA/yAmE/
si35Icc8036LYLeTluSJ5ibnFGv1RbHKv3mB70Bm47La18rZVR9U7tI8YWK5dy4T
LY5HB3lTfp6/N4EzIgktTQjNpQPj+Ix/cT8YpMe8vEJSWDJ62A3/XyrhsPGA3pKq
gaLTawo6/jNTqr5F7hApUmTlVwgSYMrSZwgk+XUGSPS/GfBMcum3pI4oH3IGNBIT
/P5Vj7djVPLNRVpmmPPDOf/WEOfY+oeteVElXhkyge52+OD/2Tp79tuO2QpBO8p0
MWfPQ5Tfw2bX5+GXAgMBAAGjggFUMIIBUDAJBgNVHRMEAjAAMC0GCWCGSAGG+EIB
DQQgFh5FYXN5LVJTQSBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFEAs
OTBBkZQY3WUI7WDgesmkb2JhMIHABgNVHSMEgbgwgbWAFJ2uTfFHI8qbmlpuvU8l
S7QZMzjaoYGRpIGOMIGLMQswCQYDVQQGEwJQTDEMMAoGA1UECBMDUE9MMQ4wDAYD
VQQHEwVSYWJrYTELMAkGA1UEChMCREsxDjAMBgNVBAsTBU15VlBOMQ4wDAYDVQQD
EwVESyBDQTEPMA0GA1UEKRMGc2VydmVyMSAwHgYJKoZIhvcNAQkBFhFkYXJrb205
QGdtYWlsLmNvbYIJAMhaCh5zmP6zMBMGA1UdJQQMMAoGCCsGAQUFBwMCMAsGA1Ud
DwQEAwIHgDAQBgNVHREECTAHggV0ZXN0MTANBgkqhkiG9w0BAQsFAAOCAQEAT5eQ
Aiym+wZOuhm46y2aI3VnCwzeaRiH3VgdHLncTjo1CKNbGdLR9fYt3slVkUObVV4P
GR7NX3NVsFX0s+U3BVAzmqyEnxTvw1FkngGPD+V9/6Zyd2IiHg33joeRt29Cp3ZA
KmLAIjgvBLU12yj8IOcOkG+3/UEYL9Z7m6CtnTG1NXJLGk2u2fLuzzhdBxKVHPji
uO9e9mSTy1XNSBxKeYIMexAm2y5WiJHe9fbQZQ9gmnTKYIzB+WomI8C1WJwQUPyq
Y60vuHLYYzmPClfMNcAg/f2J9pW370srMWJ+/l1qqJPpqphMrM2x1b23BHZ+a9lV
V2vjZVut/V+KnFCmcQ==
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkq. . .
-----END PRIVATE KEY-----
</key>
Kod: Zaznacz cały
##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server. #
# #
# This configuration can be used by multiple #
# clients, however each client should have #
# its own cert and key files. #
# #
# On Windows, you might want to rename this #
# file so it has a .ovpn extension #
##############################################
# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client
# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun
# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one. On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap
# Are we connecting to a TCP or
# UDP server? Use the same setting as
# on the server.
;proto tcp
proto udp
# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote moje_IP 11194
;remote my-server-2 1194
# Choose a random host from the remote
# list for load-balancing. Otherwise
# try hosts in the order specified.
;remote-random
# Keep trying indefinitely to resolve the
# host name of the OpenVPN server. Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite
# Most clients don't need to bind to
# a specific local port number.
nobind
# Downgrade privileges after initialization (non-Windows only)
user nobody
group nogroup
# Try to preserve some state across restarts.
persist-key
persist-tun
# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here. See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
# Wireless networks often produce a lot
# of duplicate packets. Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings
# SSL/TLS parms.
# See the server config file for more
# description. It's best to use
# a separate .crt/.key file pair
# for each client. A single ca
# file can be used for all clients.
;ca ca.crt
;cert client.crt
;key client.key
# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server". This is an
# important precaution to protect against
# a potential attack discussed here:
# http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server". The build-key-server
# script in the easy-rsa folder will do this.
ns-cert-type server
# If a tls-auth key is used on the server
# then every client must also have the key.
;tls-auth ta.key 1
# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
;cipher x
# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo
# Set log file verbosity.
verb 3
# Silence repeating messages
;mute 20
<ca>
-----BEGIN CERTIFICATE-----
MIIEjzCCA3egAwIBAgIJAM79KzPSvbr4MA0GCSqGSIb3DQEBCwUAMIGLMQswCQYD
VQQGEwJQTDEMMAoGA1UECBMDUE9MMQ4wDAYDVQQHEwVSYWJrYTELMAkGA1UEChMC
REsxDjAMBgNVBAsTBU15VlBOMQ4wDAYDVQQDEwVESyBDQTEPMA0GA1UEKRMGc2Vy
dmVyMSAwHgYJKoZIhvcNAQkBFhFkYXJrb205QGdtYWlsLmNvbTAeFw0xNzA0MDYy
MTQyMTZaFw0yNzA0MDQyMTQyMTZaMIGLMQswCQYDVQQGEwJQTDEMMAoGA1UECBMD
UE9MMQ4wDAYDVQQHEwVSYWJrYTELMAkGA1UEChMCREsxDjAMBgNVBAsTBU15VlBO
MQ4wDAYDVQQDEwVESyBDQTEPMA0GA1UEKRMGc2VydmVyMSAwHgYJKoZIhvcNAQkB
FhFkYXJrb205QGdtYWlsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
ggEBAMqKShXeZcphZdNuOe8kGsHusQvbWpuxHvzwaav+8N+sYTgIUwCXpqbT+NXl
rbjDLskSr2dxv0Yy4FOx/9/X+yIce+iH0irM8lu9/rPmzaWYOxnyp2KeRl14QMzJ
kKNFSm/DkEgJd2etG4jX3gAmV9rfozCwqagGDKIfRP8Q3PImymGUwpzkpPkfjSxx
Nif/NZAcZF9NGpy5PLeomYFMoMaHCZon2DT1YPz8J8c5vBsER1YCKd34gcp3JXP1
63dIvgcFIOFLJhSP0BR63Io4panX8Ylkjcz58ssWPXvGYo13Lk/ad28tZonqct6w
FwIyp6DxG3ZUqyY8vH82dCJrI+8CAwEAAaOB8zCB8DAdBgNVHQ4EFgQUNfxhdt5N
J/p+enonRQB5pud7LLwwgcAGA1UdIwSBuDCBtYAUNfxhdt5NJ/p+enonRQB5pud7
LLyhgZGkgY4wgYsxCzAJBgNVBAYTAlBMMQwwCgYDVQQIEwNQT0wxDjAMBgNVBAcT
BVJhYmthMQswCQYDVQQKEwJESzEOMAwGA1UECxMFTXlWUE4xDjAMBgNVBAMTBURL
IENBMQ8wDQYDVQQpEwZzZXJ2ZXIxIDAeBgkqhkiG9w0BCQEWEWRhcmtvbTlAZ21h
aWwuY29tggkAzv0rM9K9uvgwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC
AQEAjxo6jDdB6JElOE0iUVhn7QjaRVK0TZrESp3JwzDzZkpMTBrJrcHESrPVT8DA
O2WXgzNN8T1scgbLXK8gutHrRttirKryJBf+N66rTfrVTR7QESD+3YEHE/4uIx0L
/wLADhBOxXpBr6hNOllKRVRgPN6gn8zUeTacZ78z/+nG54SUKF4eSsIYxhdQ4x7m
CnpHj3PZBwOzEni63F+I2zGTnTilumKj/tWvsBW3cN3r0Zzh2Yw5Iqxh0GrQv2Wb
24DmmzpRp6gtm2ORmuQCl1/26yQKp6a63nnS7Zsld2tgi/attPRC5GkXq9qVrISD
W/w5JAShZzxWRIpc72g0hJoWKQ==
-----END CERTIFICATE-----
</ca>
<cert>
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 2 (0x2)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=PL, ST=POL, L=Rabka, O=DK, OU=MyVPN, CN=DK CA/name=server/[email protected]
Validity
Not Before: Apr 6 21:47:05 2017 GMT
Not After : Apr 4 21:47:05 2027 GMT
Subject: C=PL, ST=POL, L=Rabka, O=DK, OU=MyVPN, CN=client1/name=server/[email protected]
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:cb:44:58:12:95:78:e6:4e:18:00:57:b3:b4:11:
dd:f2:71:a4:c4:1d:cc:5c:6d:62:6d:be:d1:4e:86:
c3:8f:a6:94:c6:a9:19:81:1d:3d:8a:cc:e9:be:47:
ef:80:aa:41:32:3d:6b:e5:8d:17:d7:ed:fe:3d:98:
89:0a:4c:c6:50:74:b6:b8:02:b0:4a:0a:6a:c9:73:
3b:78:bc:0c:51:5b:e5:b4:e2:56:51:40:8e:04:6e:
95:8b:60:28:ea:69:13:5a:3a:41:28:96:39:0d:a1:
cf:fa:db:de:b6:7f:60:1c:39:80:7d:05:35:b9:0d:
15:4a:48:c5:c6:e4:78:7d:48:75:bb:1e:cb:19:d6:
e6:f6:0b:ba:62:1d:dc:d7:3b:46:60:d5:da:21:2a:
17:20:47:0e:f7:61:51:b2:01:99:a4:33:17:4f:6c:
65:66:f9:52:68:b0:8e:33:b7:64:05:9b:f2:01:1b:
7b:a1:ea:dc:93:06:7e:e7:af:de:a4:90:9d:ad:4c:
e8:23:eb:db:d0:14:68:e5:c2:18:69:05:71:8a:ac:
37:94:be:cd:a7:ff:a5:03:04:3e:77:51:c5:3b:c7:
cf:34:ab:c1:5e:79:51:a8:65:8c:fb:80:f8:f1:61:
8c:5a:00:90:45:be:a3:c0:e8:6d:22:bb:0a:b1:26:
34:cf
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
Easy-RSA Generated Certificate
X509v3 Subject Key Identifier:
84:DE:AA:24:4A:9A:AA:6E:A1:A4:FB:AE:84:E5:BB:34:8C:A4:3E:3D
X509v3 Authority Key Identifier:
keyid:35:FC:61:76:DE:4D:27:FA:7E:7A:7A:27:45:00:79:A6:E7:7B:2C:BC
DirName:/C=PL/ST=POL/L=Rabka/O=DK/OU=MyVPN/CN=DK CA/name=server/[email protected]
serial:CE:FD:2B:33:D2:BD:BA:F8
X509v3 Extended Key Usage:
TLS Web Client Authentication
X509v3 Key Usage:
Digital Signature
X509v3 Subject Alternative Name:
DNS:client1
Signature Algorithm: sha256WithRSAEncryption
1f:f6:88:a5:ed:c2:7c:1e:60:f8:c0:48:ac:2f:53:3e:c7:ee:
51:33:98:1b:de:9b:00:c9:68:97:a4:c2:42:d0:79:2c:36:c6:
a8:a8:ac:b2:4e:28:41:0e:e4:8c:ce:75:e8:8b:0a:ee:9c:27:
9a:21:d8:40:53:91:44:6c:10:db:86:ea:90:bf:15:79:df:d0:
dd:f6:e1:84:7f:a8:bd:a7:a8:68:0e:2f:e4:d7:e1:33:d7:3b:
0e:6a:73:e9:a5:7e:14:7f:a3:29:bb:91:61:30:42:36:be:27:
66:57:19:41:36:0b:cb:cc:35:c5:58:0d:d6:54:43:1f:fe:a1:
15:00:df:98:fb:56:47:6f:e6:76:80:45:3b:69:8a:cc:1b:09:
46:58:8b:ef:dc:fd:30:ff:71:11:94:b1:73:19:52:3a:b7:30:
26:64:51:2d:30:8b:28:ec:bd:43:d5:d3:54:e7:16:bb:09:54:
55:2e:79:eb:fc:b7:7a:ac:cc:63:e9:4a:df:90:72:f6:30:be:
71:de:32:12:51:3f:99:22:43:43:99:83:14:ec:41:e5:ab:c3:
50:2d:fa:09:d5:dd:c5:f0:80:31:a1:9d:fb:b0:7a:86:e6:c1:
2c:ee:0d:4b:33:99:5e:1a:8f:6e:07:ec:2a:ca:71:c7:98:bf:
43:b7:c8:c0
-----BEGIN CERTIFICATE-----
MIIE7TCCA9WgAwIBAgIBAjANBgkqhkiG9w0BAQsFADCBizELMAkGA1UEBhMCUEwx
DDAKBgNVBAgTA1BPTDEOMAwGA1UEBxMFUmFia2ExCzAJBgNVBAoTAkRLMQ4wDAYD
VQQLEwVNeVZQTjEOMAwGA1UEAxMFREsgQ0ExDzANBgNVBCkTBnNlcnZlcjEgMB4G
CSqGSIb3DQEJARYRZGFya29tOUBnbWFpbC5jb20wHhcNMTcwNDA2MjE0NzA1WhcN
MjcwNDA0MjE0NzA1WjCBjTELMAkGA1UEBhMCUEwxDDAKBgNVBAgTA1BPTDEOMAwG
A1UEBxMFUmFia2ExCzAJBgNVBAoTAkRLMQ4wDAYDVQQLEwVNeVZQTjEQMA4GA1UE
AxMHY2xpZW50MTEPMA0GA1UEKRMGc2VydmVyMSAwHgYJKoZIhvcNAQkBFhFkYXJr
b205QGdtYWlsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMtE
WBKVeOZOGABXs7QR3fJxpMQdzFxtYm2+0U6Gw4+mlMapGYEdPYrM6b5H74CqQTI9
a+WNF9ft/j2YiQpMxlB0trgCsEoKaslzO3i8DFFb5bTiVlFAjgRulYtgKOppE1o6
QSiWOQ2hz/rb3rZ/YBw5gH0FNbkNFUpIxcbkeH1IdbseyxnW5vYLumId3Nc7RmDV
2iEqFyBHDvdhUbIBmaQzF09sZWb5UmiwjjO3ZAWb8gEbe6Hq3JMGfuev3qSQna1M
6CPr29AUaOXCGGkFcYqsN5S+zaf/pQMEPndRxTvHzzSrwV55UahljPuA+PFhjFoA
kEW+o8DobSK7CrEmNM8CAwEAAaOCAVYwggFSMAkGA1UdEwQCMAAwLQYJYIZIAYb4
QgENBCAWHkVhc3ktUlNBIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQU
hN6qJEqaqm6hpPuuhOW7NIykPj0wgcAGA1UdIwSBuDCBtYAUNfxhdt5NJ/p+enon
RQB5pud7LLyhgZGkgY4wgYsxCzAJBgNVBAYTAlBMMQwwCgYDVQQIEwNQT0wxDjAM
BgNVBAcTBVJhYmthMQswCQYDVQQKEwJESzEOMAwGA1UECxMFTXlWUE4xDjAMBgNV
BAMTBURLIENBMQ8wDQYDVQQpEwZzZXJ2ZXIxIDAeBgkqhkiG9w0BCQEWEWRhcmtv
bTlAZ21haWwuY29tggkAzv0rM9K9uvgwEwYDVR0lBAwwCgYIKwYBBQUHAwIwCwYD
VR0PBAQDAgeAMBIGA1UdEQQLMAmCB2NsaWVudDEwDQYJKoZIhvcNAQELBQADggEB
AB/2iKXtwnweYPjASKwvUz7H7lEzmBvemwDJaJekwkLQeSw2xqiorLJOKEEO5IzO
deiLCu6cJ5oh2EBTkURsENuG6pC/FXnf0N324YR/qL2nqGgOL+TX4TPXOw5qc+ml
fhR/oym7kWEwQja+J2ZXGUE2C8vMNcVYDdZUQx/+oRUA35j7Vkdv5naARTtpiswb
CUZYi+/c/TD/cRGUsXMZUjq3MCZkUS0wiyjsvUPV01TnFrsJVFUueev8t3qszGPp
St+QcvYwvnHeMhJRP5kiQ0OZgxTsQeWrw1At+gnV3cXwgDGhnfuweobmwSzuDUsz
mV4aj24H7CrKcceYv0O3yMA=
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkq . . .
-----END PRIVATE KEY-----
</key>
Kod: Zaznacz cały
-CERTYFIKAT CA
-- serwer_cert
-- klient1_cert
.
.
-- klientn_cert
Tutaj widać sporą różnice w konfiguracji konkretnie chodzi o:local 11.22.33.44
port 1194
proto udp
dev tun
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
;client-to-client
;duplicate-cn
keepalive 10 120
cipher AES-256-CBC
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384
auth SHA512
keysize 256
tls-version-min 1.2
comp-lzo
;max-clients 100
user nobody
group nogroup
persist-key
persist-tun
;status openvpn-status.log
;log openvpn.log
;log-append openvpn.log
verb 3
;mute 20
;client-cert-not-required
;plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so login
;ca /etc/openvpn/certs/ca.crt
;cert /etc/openvpn/certs/server-vpn.crt
;key /etc/openvpn/certs/server-vpn.key
dh /etc/openvpn/certs/dh4096.pem
;tls-auth /etc/openvpn/certs/ta.key 0
key-direction 0
<ca>
...
</ca>
<cert>
...
</cert>
<key>
...
</key>
<tls-auth>
...
</tls-auth>
Kod: Zaznacz cały
cipher AES-256-CBC
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384
auth SHA512
keysize 256
tls-version-min 1.2
comp-lzo
tu masz też tutorialeWitam wszystkich forumowiczów,
po różnych przygodach udało mi się w końcu na serwerze VPS zainstalować i uruchomić OpenVPN według tutorial:
https://www.digitalocean.com/community/ ... n-debian-8
Kod: Zaznacz cały
client
dev tun
proto udp
remote xx.xx.xx xxx
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert xxxx.crt
key xxxx.key
comp-lzo
verb 3
key-direction 1
<tls-auth>
-----BEGIN OpenVPN Static key V1-----
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
-----END OpenVPN Static key V1-----
</tls-auth>
Kod: Zaznacz cały
port xxx
proto udp
dev tun
ca ca.crt
cert xxxx.crt
key xxxx.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
key-direction 0
<tls-auth>
-----BEGIN OpenVPN Static key V1-----
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
-----END OpenVPN Static key V1-----
</tls-auth>
Kod: Zaznacz cały
Please edit the vars script to reflect your configuration,
then source it with "source ./vars".
Next, to start with a fresh PKI configuration and to delete any
previous certificates and keys, run "./clean-all".
Finally, you can run this tool (pkitool) to build certificates/keys.