���������̃y�[�W�͍���X�V����\��͂���܂��񁦁���

VPN�T�[�o�[�\�z(OpenVPN)

�ŏI�X�V���F 2023.02.23

���T�v

OpenVPN(OpenVPN���{����T�C�g)���g�p����SSL-VPN�������C���^�[�l�b�gVPN���\�z���A�O������OpenVPN�o�R��LAN�Ɉ��S�ɐڑ��ł���悤�ɂ���B�Ȃ��AVPN�N���C�A���g��Windows�}�V�������iPhone�Ƃ���B

��OpenVPN�ł̓N���C�A���g���Ƀ\�t�g�E�F�A���C���X�g�[������K�v�����邽�߁A�\�t�g�E�F�A�̃C���X�g�[������������Ă���悤�Ȋ�Ɠ��ł�SoftEther VPN Server�𐄏�

�y�O��Ƃ���l�b�g���[�N�C���[�W�z


�y�O��Ƃ���l�b�g���[�N�����z
LAN�l�b�g���[�N�A�h���X:192.168.1.0/24
VPN�T�[�o�[IP�A�h���X:192.168.1.30
VPN�p���z�l�b�g���[�N�A�h���X:10.8.0.0/24��
VPN�T�[�o�[���zIP�A�h���X:10.8.0.1��

��VPN�ł͉��z�̃v���C�x�[�gIP�A�h���X���T�[�o�[�^�N���C�A���g�Ƃ��Ɋ����ĂāA���̉��z�A�h���X��VPN�ʐM���s�����A�����ł́A���X��LAN���v���C�x�[�gIP�A�h���X(192.168.1.X)���w�肵�đΏۃz�X�g�փA�N�Z�X�ł���悤�ɂ���B


��OpenVPN�C���X�g�[��(�T�[�o�[��)

[root@centos ~]# yum -y install openssl-devel lzo-devel pam-devel�@���@OpenVPN�C���X�g�[���ɕK�v�ȃp�b�P�[�W���C���X�g�[��

[root@centos ~]# wget http://swupdate.openvpn.org/community/releases/openvpn-2.3.4.tar.gz�@���@OpenVPN�_�E�����[�h

���ŐV�ł�URL���_�E�����[�h�y�[�W�Ŋm�F���邱��

[root@centos ~]# rpmbuild -tb --clean openvpn-2.3.4.tar.gz�@���@OpenVPN��RPM�p�b�P�[�W����

[root@centos ~]# yum -y localinstall ~/rpmbuild/RPMS/x86_64/openvpn-2.3.4-1.x86_64.rpm�@���@��������OpenVPN��RPM�p�b�P�[�W���C���X�g�[��

[root@centos ~]# rm -f ~/rpmbuild/RPMS/x86_64/openvpn-*�@���@��������OpenVPN��RPM�p�b�P�[�W���폜

[root@centos ~]# rm -f openvpn-2.3.4.tar.gz�@���@�_�E�����[�h�����t�@�C�����폜

[root@centos ~]# wget https://github.com/OpenVPN/easy-rsa/archive/master.zip�@���@easy-rsa�_�E�����[�h

[root@centos ~]# unzip master.zip�@���@easy-rsa��

[root@centos ~]# cp -r easy-rsa-master/easyrsa3/ /etc/openvpn/�@���@easyrsa3������̃f�B���N�g���փR�s�[

[root@centos ~]# rm -rf easy-rsa-master/�@���@�𓀐�f�B���N�g�����폜

[root@centos ~]# rm -f master.zip�@���@�_�E�����[�h�����t�@�C�����폜

��OpenVPN�ݒ�(�T�[�o�[��)

�i�P�jCA�ؖ����E�閧���쐬
[root@centos ~]# cd /etc/openvpn/easyrsa3/�@���@easyrsa3�f�B���N�g���ֈړ�

[root@centos easyrsa3]# ./easyrsa init-pki�@���@��������OpenVPN�C���X�g�[����ŏ���1��̂�

init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /etc/openvpn/easyrsa3/pki

[root@centos easyrsa3]# ./easyrsa build-ca�@���@CA�ؖ����E�閧���쐬
Generating a 2048 bit RSA private key
......................................................+++
........................................+++
writing new private key to '/root/easy-rsa-master/easyrsa3/pki/private/ca.key'
Enter PEM pass phrase:�@���@�C�ӂ̃p�X�t���[�Y������
Verifying - Enter PEM pass phrase:�@���@�C�ӂ̃p�X�t���[�Y�������i�m�F�j
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:centossrv.com�@���@�T�C�g���i��:centossrv.com�j������

CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/root/easy-rsa-master/easyrsa3/pki/ca.crt

[root@centos easyrsa3]# cp pki/ca.crt /etc/openvpn/�@���@CA�ؖ�����OpenVPN�ݒ�t�@�C���i�[�f�B���N�g���փR�s�[
��CA�閧���͌�q����T�[�o�[�ؖ����E�閧���쐬���A�N���C�A���g�ؖ����E�閧���쐬���̂ݎg�p����̂ŃR�s�[�s�v

�i�Q�j�T�[�o�[�ؖ����E�閧���쐬
[root@centos easyrsa3]# ./easyrsa build-server-full server nopass�@���@�T�[�o�[�ؖ����E�閧���쐬
Generating a 2048 bit RSA private key
.......+++
.....+++
writing new private key to '/etc/openvpn/easyrsa3/pki/private/server.key'
-----
Using configuration from /etc/openvpn/easyrsa3/openssl-1.0.cnf
Enter pass phrase for /etc/openvpn/easyrsa3/pki/private/ca.key:�@���@CA�閧���̃p�X�t���[�Y������
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :PRINTABLE:'server'
Certificate is to be certified until Jul 10 12:48:56 2024 GMT (3650 days)

Write out database with 1 new entries
Data Base Updated

[root@centos easyrsa3]# cp pki/issued/server.crt /etc/openvpn/�@���@�T�[�o�[�ؖ�����OpenVPN�ݒ�t�@�C���i�[�f�B���N�g���փR�s�[

[root@centos easyrsa3]# cp pki/private/server.key /etc/openvpn/�@���@�T�[�o�[�閧����OpenVPN�ݒ�t�@�C���i�[�f�B���N�g���փR�s�[

�i�R�jDH(Diffie Hellman)�p�����[�^�쐬
[root@centos easyrsa3]# ./easyrsa gen-dh�@���@DH�p�����[�^�쐬
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time
�`
DH parameters of size 2048 created at /root/easy-rsa-master/easyrsa3/pki/dh.pem
�����Ԃ�������ꍇ������

[root@centos easyrsa3]# cp pki/dh.pem /etc/openvpn/�@���@DH�p�����[�^��OpenVPN�ݒ�t�@�C���i�[�f�B���N�g���փR�s�[

�i�S�j�ؖ����p�~���X�g�쐬
�����VPN�N���C�A���g�����VPN�ڑ����֎~�ł���悤�ɂ��邽�߁A�ؖ����p�~���X�g���쐬����B
���ؖ����p�~���X�g�́A���ۂɃN���C�A���g�ؖ������쐬���Ă���p�~���s��Ȃ��ƍ쐬�ł��Ȃ��̂ŁA�_�~�[�̃N���C�A���g�ؖ�������������쐬&�p�~���邱�Ƃɂ��ؖ����p�~���X�g���쐬����
[root@centos easyrsa3]# ./easyrsa build-client-full dmy nopass�@���@�_�~�[�̃N���C�A���g�ؖ����쐬
Generating a 2048 bit RSA private key
.............................................+++
...........+++
writing new private key to '/etc/openvpn/easyrsa3/pki/private/dmy.key'
-----
Using configuration from /etc/openvpn/easyrsa3/openssl-1.0.cnf
Enter pass phrase for /etc/openvpn/easyrsa3/pki/private/ca.key:�@���@CA�閧���̃p�X�t���[�Y������
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :PRINTABLE:'dmy'
Certificate is to be certified until Jul 10 12:52:28 2024 GMT (3650 days)

Write out database with 1 new entries
Data Base Updated

[root@centos easyrsa3]# ./easyrsa revoke dmy�@���@�_�~�[�̃N���C�A���g�ؖ����p�~


Please confirm you wish to revoke the certificate with the following subject:

subject=
    commonName                = dmy


Type the word 'yes' to continue, or any other input to abort.
  Continue with revocation: yes�@���@yes����
Using configuration from /etc/openvpn/easyrsa3/openssl-1.0.cnf
Enter pass phrase for /etc/openvpn/easyrsa3/pki/private/ca.key:
Revoking Certificate 03.
Data Base Updated

IMPORTANT!!!

Revocation was successful. You must run gen-crl and upload a CRL to your
infrastructure in order to prevent the revoked cert from being accepted.

[root@centos easyrsa3]# rm -f /etc/openvpn/easyrsa3/pki/issued/dmy.crt�@���@dmy�ؖ����ލ폜

[root@centos easyrsa3]# rm -f /etc/openvpn/easyrsa3/pki/private/dmy.key�@���@dmy�ؖ����ލ폜

[root@centos easyrsa3]# rm -f /etc/openvpn/easyrsa3/pki/reqs/dmy.req�@���@dmy�ؖ����ލ폜

[root@centos easyrsa3]# cp vars.example vars�@���@Easy-RSA�p�����[�^�ݒ�t�@�C�����T���v�����R�s�[

[root@centos easyrsa3]# vi vars�@���@Easy-RSA�p�����[�^�ݒ�t�@�C���ҏW
set_var EASYRSA_CRL_DAYS        3650�@���@�s����#���폜�i�R�����g�����j���ďؖ����p�~���X�g�̗L��������3650���ɕύX
���ؖ����p�~���X�g�̗L�������͏����ݒ�ł�180���ƂȂ��Ă���A�������؂�邽�тɏؖ����p�~���X�g�̍č쐬�����Ȃ���΂Ȃ�Ȃ��A�^�p���ώG�Ȃ��߁A�T�[�o�[�ؖ����A�N���C�A���g�ؖ����̏����ݒ�l�Ɠ���3650���ɂ���

[root@centos easyrsa3]# ./easyrsa gen-crl�@���@�ؖ����p�~���X�g���쐬
Using configuration from /etc/openvpn/easyrsa3/openssl-1.0.cnf
Enter pass phrase for /etc/openvpn/easyrsa3/pki/private/ca.key:

An updated CRL has been created.
CRL file: /etc/openvpn/easyrsa3/pki/crl.pem

[root@centos easyrsa3]# /bin/cp /etc/openvpn/easyrsa3/pki/crl.pem /etc/openvpn/�@���@�ؖ����p�~���X�g��OpenVPN�ݒ�t�@�C���i�[�f�B���N�g���փR�s�[

[root@centos easyrsa3]# chmod o+r /etc/openvpn/crl.pem�@���@�ؖ����p�~���X�g�֎Q�ƌ����t��

[root@centos easyrsa3]# cd�@���@easyrsa3�f�B���N�g���𔲂���

�i�T�jOpenVPN�ݒ�
[root@centos ~]# openvpn --genkey --secret /etc/openvpn/ta.key�@���@TLS�F�،���OpenVPN�ݒ�t�@�C���i�[�f�B���N�g���֍쐬

[root@centos ~]# cp /usr/share/doc/openvpn-*/sample/sample-config-files/server.conf /etc/openvpn/�@���@OpenVPN�ݒ�t�@�C�����T���v�����R�s�[

[root@centos ~]# vi /etc/openvpn/server.conf�@���@OpenVPN�ݒ�t�@�C���ҏW
dev tun�@���@VPN�C���^�t�F�[�X�Ƃ���TUN���w��(�f�t�H���g)

dh dh.pem�@���@DH�p�����[�^�t�@�C�������w��

server 10.8.0.0 255.255.255.0�@���@VPN�N���C�A���g�����ăA�h���X�͈͂Ƃ���10.8.0.0/24���w��(�f�t�H���g)

;push "route 192.168.10.0 255.255.255.0"
;push "route 192.168.20.0 255.255.255.0"
push "route 192.168.1.0 255.255.255.0"�@���@�lj�(LAN(��:192.168.1.0/24)�ւ̃��[�g��VPN�T�[�o�[�o�R�ɂ���)

tls-auth ta.key 0 # This file is secret�@���@�s����;���폜���ăR�����g����(TLS�F�ؗL����)

user nobody�@���@�s����;���폜���ăR�����g����(OpenVPN���s������������)
group nobody�@���@�s����;���폜���ăR�����g����(OpenVPN���s������������)

log-append  /var/log/openvpn.log�@���@�s����;���폜���ăR�����g����(���O��/var/log/openvpn.log�ɋL�^����)

management localhost 7505�@���@�ŏI�s�֒lj�(�Ǘ��C���^�t�F�[�X�̗L��������q)

crl-verify crl.pem�@���@�ŏI�s�֒lj�(�ؖ����p�~���X�g�̗L����)

�ŏI�s�ֈȉ���lj�(OpenVPN�o�R��Samba�ւ̃A�N�Z�X���G���[�ɂȂ�ꍇ)
�i���jiPhone����OpenVPN�֐ڑ�����ꍇ�A�A�v����fragment�I�v�V�������Ή��̂��߁A�A�v���Őڑ��͂ł��邪�l�b�g���[�N�փA�N�Z�X�ł��Ȃ��Ȃ�̂ʼn��L�ݒ�͍s��Ȃ�����
fragment 1280
mssfix 1280
link-mtu 1400

�i�U�jVPN�C���^�t�F�[�X�p�t�@�C�A�E�H�[�������ݒ�
[root@centos ~]# vi /etc/openvpn/openvpn-startup�@���@OpenVPN�N�������s�X�N���v�g�V�K�쐬
#!/bin/bash

# VPN�C���^�t�F�[�Xiptables���[���폜�X�N���v�g���s���K�{
/etc/openvpn/openvpn-shutdown

# VPN�T�[�o�[����̑��M���������K�{
iptables -I OUTPUT -o tun+ -j ACCEPT
iptables -I FORWARD -o tun+ -j ACCEPT

# VPN�N���C�A���g����VPN�T�[�o�[�ւ̃A�N�Z�X�����‚���ꍇ
iptables -I INPUT -i tun+ -j ACCEPT

# VPN�N���C�A���g����LAN�ւ̃A�N�Z�X�����‚���ꍇ
# (��Ƃ���VPN�N���C�A���g����192.168.1.0/24�ւ̃A�N�Z�X�����‚���ꍇ)
# ��192.168.1.0/24���̊e�[���̃t�@�C�A�E�H�[������VPN�N���C�A���g(10.8.0.0/24)����̃A�N�Z�X�����‚��邱��
iptables -I FORWARD -i tun+ -d 192.168.1.0/24 -j ACCEPT

# VPN�N���C�A���g����LAN������}�V���݂̂ւ̃A�N�Z�X�����‚���ꍇ
# (��Ƃ���VPN�N���C�A���g����192.168.1.30�ւ̃A�N�Z�X�����‚���ꍇ)
# ��192.168.1.30���̃t�@�C�A�E�H�[������VPN�N���C�A���g(10.8.0.0/24)����̃A�N�Z�X�����‚��邱��
iptables -I FORWARD -i tun+ -d 192.168.1.30 -j ACCEPT

[root@centos ~]# chmod +x /etc/openvpn/openvpn-startup�@���@OpenVPN�N�������s�X�N���v�g�֎��s�����t��

�i�V�jVPN�C���^�t�F�[�X�p�t�@�C�A�E�H�[�������ݒ����
[root@centos ~]# vi /etc/openvpn/openvpn-shutdown�@���@OpenVPN��~�����s�X�N���v�g�V�K�쐬
#!/bin/bash

# VPN�C���^�t�F�[�X(tun+)�piptables���[���폜�֐�
delete() {
    rule_number=`iptables -L $target --line-numbers -n -v|grep tun.|awk '{print $1}'|sort -r`
    for num in $rule_number
    do
        iptables -D $target $num
    done
}

# VPN�C���^�t�F�[�X(tun+)�piptables��M���[���폜
target='INPUT'
delete

# VPN�C���^�t�F�[�X(tun+)�piptables�]�����[���폜
target='FORWARD'
delete

# VPN�C���^�t�F�[�X(tun+)�piptables���M���[���폜
target='OUTPUT'
delete

[root@centos ~]# chmod +x /etc/openvpn/openvpn-shutdown�@���@OpenVPN��~�����s�X�N���v�g�֎��s�����t��

�i�W�jOpenVPN���O���[�e�[�V�����ݒ�
[root@centos ~]# vi /etc/logrotate.d/openvpn�@���@OpenVPN���O���[�e�[�V�����ݒ�t�@�C���V�K�쐬
/var/log/openvpn.log {
    missingok
    notifempty
    sharedscripts
    postrotate
        systemctl restart openvpn 2>&1 > /dev/null || true
    endscript
}

��OpenVPN�N��(�T�[�o�[��)

�i�P�jOpenVPN�N��
[root@centos ~]# vi /etc/rc.d/init.d/openvpn�@���@OpenVPN�N���X�N���v�g�ҏW
        echo 1 > /proc/sys/net/ipv4/ip_forward�@���@�s����#���폜���ăR�����g����(�p�P�b�g�]���L����)

[root@centos ~]# systemctl daemon-reload�@���@OpenVPN�N���X�N���v�g�ύX���f��CentOS7�̏ꍇ

[root@centos ~]# /etc/rc.d/init.d/openvpn start�@���@OpenVPN�N��

[root@centos ~]# chkconfig openvpn on�@���@OpenVPN�����N���ݒ�

�i�Q�jUDP1194�ԃ|�[�g�J��
�y���[�^�[�z
���[�^�[���̐ݒ�ŁAUDP1194�ԃ|�[�g�ւ̃A�N�Z�X���T�[�o�[�ɓ]������悤�ɂ���B
�����[�^�[�̐ݒ�͊e���[�^�[�̃}�j���A���܂������[�J�[�ʃ��[�^�[�|�[�g�J���菇���Q��

�y�t�@�C�A�E�H�[���z
�T�[�o�[���̃t�@�C�A�E�H�[���ݒ�ŁAUDP1194�ԃ|�[�g�ւ̃A�N�Z�X�����‚���悤�ɂ���B
�T�[�o�[���̃t�@�C�A�E�H�[���ݒ�ŁAVPN�C���^�t�F�[�X�p�t�@�C�A�E�H�[����ݒ肷��B
���t�@�C�A�E�H�[���ݒ�͂�������Q��

�|�[�g�J���m�F�c�[���ŁuIP�v�ɃT�[�o�[��(��:centossrv.com)�A�u�|�[�g�ԍ��v��1194�Ɠ��́A�uUDP�v��I�����āu�m�F�v�{�^�����������A�|�[�g�͊J������Ă��܂��ƕ\������邱�Ƃ��m�F�B

�i�R�j���[�^�[��VPN�T�[�o�[��lj���VPN�T�[�o�[�����[�^�[�̏ꍇ�͎��{�s�v
���[�^�[���ŁA���悪VPN(��:10.8.0.0/24)�̃A�N�Z�X��VPN�T�[�o�[(��:192.168.1.30)���o�R����悤�Ƀ��[�g��lj�����B
�����[�^�[�̐ݒ���e���[�^�[�̃}�j���A�����Q��
�����[�^�[��Linux�̏ꍇ�̐ݒ�͈ȉ����Q��
[root@Router ~]# echo "any net 10.8.0.0 netmask 255.255.255.0 gw 192.168.1.30" >> /etc/sysconfig/static-routes�@���@10.8.0.0/24�������[�g��192.168.1.30�o�R�Ƃ���ݒ��lj�

[root@Router ~]# /etc/rc.d/init.d/network reload�@���@�l�b�g���[�N�ċN��(��L���[�g�ݒ蔽�f)

[root@Router ~]# route�@���@���[�g�lj��m�F
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
�E�E�E�E
10.8.0.0        192.168.1.30    255.255.255.0   UG    0      0        0 eth0�@���@�lj����ꂽ���[�g
192.168.1.0     *               255.255.255.0   U     0      0        0 eth0
169.254.0.0     *               255.255.0.0     U     0      0        0 eth0
�E�E�E�E


��OpenVPN�C���X�g�[��(�N���C�A���g��)

�i�P�jOpenVPN�C���X�g�[���iWindows�j
OpenVPN�_�E�����[�h�y�[�W����uInstaller�v���_�E�����[�h���ăC���X�g�[������B

�i�Q�jOpenVPN�C���X�g�[���iiPhone�̏ꍇ�j
OpenVPN Connect���C���X�g�[������B


��OpenVPN�ݒ�(�N���C�A���g��)

�i�P�j�N���C�A���g�ؖ����E�閧���쐬(�p�X�t���[�Y�F�؂���)���T�[�o�[�����
iPhone�̏ꍇ��OpenVPN Connect���p�X�t���[�Y�F�ؖ��Ή��̂��ߎ����́u�i�Q�j�N���C�A���g�ؖ����E�閧���쐬(�p�X�t���[�Y�F�؂Ȃ�)�v���s���B
[root@centos ~]# cd /etc/openvpn/easyrsa3/�@���@easyrsa3�f�B���N�g���ֈړ�

[root@centos easyrsa3]# ./easyrsa build-client-full client1�@���@�N���C�A���g��client1���̃N���C�A���g�ؖ����E�閧��(�p�X�t���[�Y�F�؂���)�쐬
���N���C�A���g���͈�ӂł��邱�Ɓ����ɍ쐬�ς̃N���C�A���g���Əd�����Ȃ�����
Generating a 2048 bit RSA private key
.............+++
......................+++
writing new private key to '/etc/openvpn/easyrsa3/pki/private/client1.key'
Enter PEM pass phrase:�@���@�C�ӂ̃p�X�t���[�Y����
Verifying - Enter PEM pass phrase:�@���@�C�ӂ̃p�X�t���[�Y����(�m�F)
-----
Using configuration from /etc/openvpn/easyrsa3/openssl-1.0.cnf
Enter pass phrase for /etc/openvpn/easyrsa3/pki/private/ca.key:�@���@CA�閧���̃p�X�t���[�Y������
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :PRINTABLE:'client1'
Certificate is to be certified until Aug 16 08:18:16 2024 GMT (3650 days)

Write out database with 1 new entries
Data Base Updated

�i�Q�j�N���C�A���g�ؖ����E�閧���쐬(�p�X�t���[�Y�F�؂Ȃ�)���T�[�o�[�����
iPhone�̏ꍇ��OpenVPN Connect���p�X�t���[�Y�F�ؖ��Ή��̂��߃p�X�t���[�Y�F�؂Ȃ��̃N���C�A���g�ؖ����E�閧�����쐬����B
[root@centos ~]# cd /etc/openvpn/easyrsa3/�@���@easyrsa3�f�B���N�g���ֈړ�

[root@centos easyrsa3]# ./easyrsa build-client-full client1 nopass�@���@�N���C�A���g��client1���̃N���C�A���g�ؖ����E�閧��(�p�X�t���[�Y�F�؂Ȃ�)�쐬
���N���C�A���g���͈�ӂł��邱�Ɓ����ɍ쐬�ς̃N���C�A���g���Əd�����Ȃ�����
Generating a 2048 bit RSA private key
.............................................+++
...........+++
writing new private key to '/etc/openvpn/easyrsa3/pki/private/client1.key'
-----
Using configuration from /etc/openvpn/easyrsa3/openssl-1.0.cnf
Enter pass phrase for /etc/openvpn/easyrsa3/pki/private/ca.key:�@���@CA�閧���̃p�X�t���[�Y������
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :PRINTABLE:'client1'
Certificate is to be certified until Jul 10 12:52:28 2024 GMT (3650 days)

Write out database with 1 new entries
Data Base Updated

�i�R�jOpenVPN�ݒ�
�T�[�o�[��ɂ���N���C�A���g�ݒ�t�@�C���T���v��(/usr/share/doc/openvpn-*/sample/sample-config-files/client.conf)���R�s�[���Ĉȉ��̂Ƃ���ɕҏW���A�N���C�A���g���ɔz�z����B

# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
;remote my-server-2 1194
remote centossrv.com 1194�@���@VPN�T�[�o�[�����w��

# SSL/TLS parms.
# See the server config file for more
# description.  It's best to use
# a separate .crt/.key file pair
# for each client.  A single ca
# file can be used for all clients.
ca ca.crt
cert client1.crt�@���@�N���C�A���g�ؖ����t�@�C�������w��
key client1.key�@���@�N���C�A���g�閧���t�@�C�������w��

# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server".  This is an
# important precaution to protect against
# a potential attack discussed here:
#  http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server".  The build-key-server
# script in the easy-rsa folder will do this.
;ns-cert-type server
remote-cert-tls server�@���@�lj�("Man-in-the-Middle"�U���΍�)

# If a tls-auth key is used on the server
# then every client must also have the key.
tls-auth ta.key 1�@���@�s����;���폜���ăR�����g����(TLS�F�ؗL����)

�ŏI�s�ֈȉ���lj�(OpenVPN�o�R��Samba�ւ̃A�N�Z�X���G���[�ɂȂ�ꍇ)
�i���j�T�[�o�[���Őݒ肵���ꍇ�̂ݐݒ肷�邱��
fragment 1280
mssfix 1280
link-mtu 1400

�i�S�jOpenVPN�N���C�A���g�Z�b�g�A�b�v�iWindows�̏ꍇ�j
�T�[�o�[�����牺�L�t�@�C�����N���C�A���g����USB���������̉”��}�̌o�R�܂��́ASCP���̈Í������ꂽ�l�b�g���[�N�o�R���̈��S�Ȍo�H�Ŏ��������A�ݒ�t�@�C���i�[�t�H���_(C:\Program Files\OpenVPN\config)�֊i�[����B
  • CA�ؖ���(/etc/openvpn/ca.crt)
  • �N���C�A���g�ؖ���(/etc/openvpn/easyrsa3/pki/issued/client1.crt)
  • �N���C�A���g�閧��(/etc/openvpn/easyrsa3/pki/private/client1.key)
  • TLS�F�،�(/etc/openvpn/ta.key)
�N���C�A���g�ݒ�t�@�C��(client.conf)��client.ovpn�Ƃ������O�Őݒ�t�@�C���i�[�t�H���_(C:\Program Files\OpenVPN\config)�֊i�[����B

�i�T�jOpenVPN�N���C�A���g�Z�b�g�A�b�v�iiPhone�̏ꍇ�j
�T�[�o�[�����牺�L�t�@�C����Windows���USB���������̉”��}�̌o�R�܂��́ASCP���̈Í������ꂽ�l�b�g���[�N�o�R���̈��S�Ȍo�H�Ŏ��������AiTunes�o�R��iPhone�֊i�[����B
  • CA�ؖ���(/etc/openvpn/ca.crt)
  • �N���C�A���g�ؖ���(/etc/openvpn/easyrsa3/pki/issued/client1.crt)
  • �N���C�A���g�閧��(/etc/openvpn/easyrsa3/pki/private/client1.key)
  • TLS�F�،�(/etc/openvpn/ta.key)
�N���C�A���g�ݒ�t�@�C��(client.conf)��client.ovpn�Ƃ������O��iTunes�o�R��iPhone�֊i�[����B

��OpenVPN�m�F���N���C�A���g�����

�i�P�jVPN�ڑ�
�yWindows�̏ꍇ�z
�X�^�[�g���j���[�|�u���ׂẴv���O�����v�|�uOpenVPN�v�|�uOpenVPN GUI�v���E�N���b�N���āu�v���p�e�B�v�|�u�݊����v�^�u�|�u�Ǘ��҂Ƃ��Ă��̃v���O���������s����v���`�F�b�N���āuOK�v���C���X�g�[����ŏ���1��̂�
�X�^�[�g���j���[�|�u���ׂẴv���O�����v�|�uOpenVPN�v�|�uOpenVPN GUI�v���N���b�N

�^�X�N�o�[���OpenVPN GUI�A�C�R�����_�u���N���b�N

�p�X�t���[�Y�������N���C�A���g�ؖ����쐬���ɉ��������p�X�t���[�Y

OpenVPN GUI�A�C�R�������F(�ڑ������)���ΐF(�ڑ��Ϗ��)�\���ɂȂ邱�Ƃ��m�F

�yiPhone�̏ꍇ�z
OpenVPN�A�v�����N��



�{�{�^�����������ăv���t�@�C����ǂݍ���




�����X���C�h����VPN�T�[�o�[�֐ڑ�����




Connected�ƂȂ��ď㕔��VPN�ƕ\������邱�Ƃ��m�F

�i�Q�jVPN�a�ʊm�F
�yWindows�̏ꍇ�z
�yVPN�T�[�o�[�փA�N�Z�X�����‚��Ă���ꍇ�z
C:\>ping 192.168.1.30�@���@VPN�N���C�A���g����VPN�T�[�o�[(��:192.168.1.30)��ping���ʂ邱��

Pinging 192.168.1.30 with 32 bytes of data:

Reply from 192.168.1.30: bytes=32 time=283ms TTL=64
Reply from 192.168.1.30: bytes=32 time=272ms TTL=64
Reply from 192.168.1.30: bytes=32 time=266ms TTL=64
Reply from 192.168.1.30: bytes=32 time=271ms TTL=64

Ping statistics for 192.168.1.30:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 266ms, Maximum = 283ms, Average = 273ms

�yLAN�փA�N�Z�X�����‚��Ă���ꍇ�z
C:\>ping 192.168.1.3�@���@VPN�N���C�A���g����LAN�����T�[�o�[(��:192.168.1.3)��ping���ʂ邱��

Pinging 192.168.1.3 with 32 bytes of data:

Reply from 192.168.1.3: bytes=32 time=1485ms TTL=62
Reply from 192.168.1.3: bytes=32 time=262ms TTL=62
Reply from 192.168.1.3: bytes=32 time=255ms TTL=62
Reply from 192.168.1.3: bytes=32 time=260ms TTL=62

Ping statistics for 192.168.1.3:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 255ms, Maximum = 1485ms, Average = 565ms

�yiPhone�̏ꍇ�z
Network Ping Lite - MochaSoft���C���X�g�[�����ċN������




Ping




�yVPN�T�[�o�[�փA�N�Z�X�����‚��Ă���ꍇ�z
VPN�T�[�o�[�̃v���C�x�[�gIP�A�h���X(��:192.168.1.3)����͂��āuStart�v




�yLAN�փA�N�Z�X�����‚��Ă���ꍇ�z
LAN�����T�[�o�[�̃v���C�x�[�gIP�A�h���X(��:192.168.1.5)����͂��āuStart�v

�i�R�jVPN�ؒf
�yWindows�̏ꍇ�z
�^�X�N�o�[���OpenVPN GUI�A�C�R�����_�u���N���b�N����Disconnect�{�^������

�yiPhone�̏ꍇ�z


�h���X���C�h����VPN�T�[�o�[����ؒf




Disconnected�ƂȂ��ď㕔��VPN�\���������邱�Ƃ��m�F

��VPN�N���C�A���g����̃A�N�Z�X����

VPN�N���C�A���g��VPN�ʐM���s���ꍇ��VPN�p�̉��z�A�h���X(10.8.0.0/24)�ŒʐM���s���̂ŁAVPN�N���C�A���g����A�N�Z�X�������[�����̃t�@�C�A�E�H�[����e�A�v���P�[�V�����̃A�N�Z�X�������ŁAVPN�N���C�A���g�A�h���X(10.8.0.0/24)����̃A�N�Z�X�����‚���悤�ɐݒ肵�Ă����B

�i�P�jVPN�N���C�A���g����Samba�փA�N�Z�X�������ꍇ
[root@centos ~]# vi /etc/samba/smb.conf�@���@Samba�ݒ�t�@�C���ҏW
   hosts allow = 192.168.1. 127. 10.8.0.�@���@�A�N�Z�X���ƒA�h���X��VPN��lj�

[root@centos ~]# systemctl restart smb�@���@Samba�ċN����CentOS7�̏ꍇ

�i�Q�jTCP Wrapper�ɂ��A�N�Z�X�����ΏۊO�Ƃ���ꍇ
[root@centos ~]# echo "ALL: 10.8.0." >> /etc/hosts.allow�@���@10.8.0.X����̃A�N�Z�X������

��VPN�N���C�A���g�ɌŒ�IP�A�h���X�������Ă�ꍇ

�O��������LAN��VPN�ڑ�����ꍇ���ł́AVPN�N���C�A���g���ƂɃA�N�Z�X��𐧌��������ꍇ������B���̏ꍇ�́AVPN�N���C�A���g�ɌŒ�IP�A�h���X�������āAIP�A�h���X���ƂɃt�@�C�A�E�H�[���ŃA�N�Z�X��𐧌�����悤�ɂ���B

��Ƃ��āA�N���C�A���g��client1�ɌŒ�IP�A�h���X10.8.0.5�������āA10.8.0.5�����192.168.1.3�ւ̂݃A�N�Z�X�����‚���悤�ɂ���B

�i�P�jOpenVPN�ݒ�
[root@centos ~]# vi /etc/openvpn/server.conf�@���@OpenVPN�ݒ�t�@�C���ҏW
client-config-dir ccd�@���@�s����;���폜���ăR�����g����(�N���C�A���g���ݒ�i�[�f�B���N�g���̗L����)

[root@centos ~]# mkdir /etc/openvpn/ccd�@���@�N���C�A���g���ݒ�i�[�f�B���N�g���쐬

[root@centos ~]# /etc/rc.d/init.d/openvpn restart�@���@OpenVPN�ċN��

�i�Q�jclient1�Œ�IP�A�h���X������
[root@centos ~]# vi /etc/openvpn/ccd/client1�@���@client1�ݒ�t�@�C���V�K�쐬
ifconfig-push 10.8.0.5 10.8.0.6�@���@�Œ�IP�A�h���X10.8.0.5�������Ă遦
��10.8.0.5��10.8.0.6��5��6�̕����͈ȉ��̊e�g�ݍ��킹����w�肷�邱��(�Ⴆ�΁A10.8.0.9��10.8.0.10�Ǝw�肷���10.8.0.9�������Ă���)
�������A10.8.0.1��10.8.0.2�̑g������VPN�T�[�o�[�̃A�h���X�Ȃ̂Ŏw�肵�Ȃ�����

[ 1, 2] [ 5, 6] [ 9, 10] [ 13, 14] [ 17, 18]
[ 21, 22] [ 25, 26] [ 29, 30] [ 33, 34] [ 37, 38]
[ 41, 42] [ 45, 46] [ 49, 50] [ 53, 54] [ 57, 58]
[ 61, 62] [ 65, 66] [ 69, 70] [ 73, 74] [ 77, 78]
[ 81, 82] [ 85, 86] [ 89, 90] [ 93, 94] [ 97, 98]
[101,102] [105,106] [109,110] [113,114] [117,118]
[121,122] [125,126] [129,130] [133,134] [137,138]
[141,142] [145,146] [149,150] [153,154] [157,158]
[161,162] [165,166] [169,170] [173,174] [177,178]
[181,182] [185,186] [189,190] [193,194] [197,198]
[201,202] [205,206] [209,210] [213,214] [217,218]
[221,222] [225,226] [229,230] [233,234] [237,238]
[241,242] [245,246] [249,250] [253,254]


�i�R�jclient1�p�t�@�C�A�E�H�[���ݒ�
[root@centos ~]# iptables -I FORWARD -i tun+ -s 10.8.0.5 -d 192.168.1.3 -j ACCEPT�@���@10.8.0.5����192.168.1.3�ւ̃A�N�Z�X������

[root@centos ~]# echo "iptables -I FORWARD -i tun+ -s 10.8.0.5 -d 192.168.1.3 -j ACCEPT" >> /etc/openvpn/openvpn-startup�@���@��L�t�@�C�A�E�H�[���ݒ��OpenVPN�N�������s�X�N���v�g�֒lj�

����ŁAclient1�̏ؖ������g�p����VPN�ڑ������N���C�A���g�ɂ͌Œ�IP�A�h���X10.8.0.5�������Ă��ALAN����192.168.1.3�ւ̂݃A�N�Z�X���ł���悤�ɂȂ�B
�Ȃ��A�N���C�A���g�ݒ�t�@�C�������݂��Ȃ��ꍇ��VPN�T�[�o�[����IP�A�h���X�������Ă�̂ŁA�Œ�^��Œ荬�݂��”\�B

��VPN�N���C�A���g�̍폜

�Ȃ�炩�̗��R(VPN�ʐM�v�����Ȃ��Ȃ����A�܂��́A�ؖ����̃p�X�t���[�Y��Y�ꂽ����)�œ����VPN�N���C�A���g�����VPN�ڑ����֎~�������ꍇ�́A�Y��VPN�N���C�A���g���g�p���Ă���N���C�A���g�ؖ�����p�~����΂悢�B
���p�~�����N���C�A���g���ŏؖ������č쐬���邱�Ƃ��ł���̂ŁA�p�X�t���[�Y��Y��Ă��܂����ꍇ�́A��������ؖ�����p�~��ɓ����N���C�A���g���ŃN���C�A���g�ؖ������č쐬����΂悢

�i�P�j�N���C�A���g�ؖ����p�~
�N���C�A���g�ؖ�����p�~���āA�Y���N���C�A���g�ؖ������g�p����VPN�ڑ����ł��Ȃ��悤�ɂ���B
[root@centos ~]# cd /etc/openvpn/easyrsa3/�@���@easyrsa3�f�B���N�g���ֈړ�

[root@centos easyrsa3]# ./easyrsa revoke client1�@���@client1�̃N���C�A���g�ؖ����p�~


Please confirm you wish to revoke the certificate with the following subject:

subject=
    commonName                = client1


Type the word 'yes' to continue, or any other input to abort.
  Continue with revocation: yes
Using configuration from /etc/openvpn/easyrsa3/openssl-1.0.cnf
Enter pass phrase for /etc/openvpn/easyrsa3/pki/private/ca.key:�@���@CA�閧���̃p�X�t���[�Y������
Revoking Certificate 03.
Data Base Updated

IMPORTANT!!!

Revocation was successful. You must run gen-crl and upload a CRL to your
infrastructure in order to prevent the revoked cert from being accepted.

[root@centos easyrsa3]# rm -f /etc/openvpn/easyrsa3/pki/issued/client1.crt�@���@client1�ؖ����ލ폜

[root@centos easyrsa3]# rm -f /etc/openvpn/easyrsa3/pki/private/client1.key�@���@client1�ؖ����ލ폜

[root@centos easyrsa3]# rm -f /etc/openvpn/easyrsa3/pki/reqs/client1.req�@���@client1�ؖ����ލ폜

[root@centos easyrsa3]# ./easyrsa gen-crl�@���@�ؖ����p�~���X�g���쐬
Using configuration from /etc/openvpn/easyrsa3/openssl-1.0.cnf
Enter pass phrase for /etc/openvpn/easyrsa3/pki/private/ca.key:

An updated CRL has been created.
CRL file: /etc/openvpn/easyrsa3/pki/crl.pem

[root@centos easyrsa3]# /bin/cp /etc/openvpn/easyrsa3/pki/crl.pem /etc/openvpn/�@���@�ؖ����p�~���X�g��OpenVPN�ݒ�t�@�C���i�[�f�B���N�g���փR�s�[

[root@centos easyrsa3]# chmod o+r /etc/openvpn/crl.pem�@���@�ؖ����p�~���X�g�֎Q�ƌ����t��

[root@centos easyrsa3]# cd�@���@easyrsa3�f�B���N�g���𔲂���

�i�Q�j�ڑ����N���C�A���g�̋����ؒf
�N���C�A���g�ؖ�����p�~���Ă��Y���N���C�A���g���ڑ����ł������ꍇ�͂��̂܂܌p�����ĒʐM�ł��Ă��܂��̂ŁA����������I�ɐؒf�������ꍇ�͈ȉ��̎菇�Őؒf����B
[root@centos ~]# telnet localhost 7505�@���@OpenVPN�Ǘ��C���^�t�F�[�X�N��
Trying 127.0.0.1...
Connected to localhost.localdomain (127.0.0.1).
Escape character is '^]'.
>INFO:OpenVPN Management Interface Version 1 -- type 'help' for more info
status�@���@VPN�ڑ��󋵊m�F
OpenVPN CLIENT LIST
Updated,Tue Nov 28 19:28:49 2006
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
client1,124.211.3.180:1617,6882,7144,Tue Nov 28 19:26:53 2006�@���@client1���ڑ���
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
10.8.0.253,client1,124.211.3.180:1617,Tue Nov 28 19:28:41 2006
GLOBAL STATS
Max bcast/mcast queue length,0
END
kill client1�@���@client1�����ؒf
SUCCESS: common name 'client1' found, 1 client(s) killed
status�@���@VPN�ڑ��󋵊m�F
OpenVPN CLIENT LIST
Updated,Tue Nov 28 19:29:05 2006
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
GLOBAL STATS
Max bcast/mcast queue length,0
END
exit�@���@OpenVPN�Ǘ��C���^�t�F�[�X�I��
Connection closed by foreign host.

��OpenVPN�A�b�v�f�[�g

[root@centos ~]# wget http://swupdate.openvpn.org/community/releases/openvpn-2.4.3.tar.gz�@���@OpenVPN�_�E�����[�h

���ŐV�ł�URL���_�E�����[�h�y�[�W�Ŋm�F���邱��

[root@centos ~]# rpmbuild -tb --clean openvpn-2.4.3.tar.gz�@���@OpenVPN��RPM�p�b�P�[�W����

[root@centos ~]# yum -y localinstall ~/rpmbuild/RPMS/x86_64/openvpn-2.4.3-1.x86_64.rpm�@���@��������OpenVPN��RPM�p�b�P�[�W���C���X�g�[��

[root@centos ~]# rm -f ~/rpmbuild/RPMS/x86_64/openvpn-*�@���@��������OpenVPN��RPM�p�b�P�[�W���폜

[root@centos ~]# rm -f openvpn-2.4.3.tar.gz�@���@�_�E�����[�h�����t�@�C�����폜

[root@centos ~]# vi /etc/rc.d/init.d/openvpn�@���@OpenVPN�N���X�N���v�g�ҏW
        echo 1 > /proc/sys/net/ipv4/ip_forward�@���@�s����#���폜���ăR�����g����(�p�P�b�g�]���L����)

[root@centos ~]# systemctl daemon-reload�@���@OpenVPN�N���X�N���v�g�ύX���f��CentOS7�̏ꍇ

[root@centos ~]# /etc/rc.d/init.d/openvpn restart�@���@OpenVPN�ċN��


���֘A�R���e���c




�����̃y�[�W�̃g�b�v�֖߂�

�v���C�o�V�[�|���V�[
centossrv.com