TUN\/TAP deve essere installato e attivo. Per controllare se sia attivo o meno eseguire il seguente comando.<\/p>\n
\n# cat \/dev\/net\/tun\ncat: \/dev\/net\/tun: Il descrittore del file \u00e8 danneggiato\n#\n<\/pre>\n<\/blockquote>\n<\/div>\nSe tutto va bene si dovrebbe ricevere lo stesso output. Nel mio caso invece mi da un errore.<\/p>\n
\n\n# cat \/dev\/net\/tun\ncat: \/dev\/net\/tun: File o directory non esistente\n#\n<\/pre>\n<\/blockquote>\n<\/div>\nRicompile il Kernel e aggiungiungere il modulo.
\nIn Device Drivers -> Network device support scegliere “Universal TUN\/TAP device driver support”.<\/p>\nInstallazione<\/h2>\n
Usare zypper per installare openvpn con il seguente comando:<\/p>\n
\n\n# zypper in openvpn\n<\/pre>\n<\/blockquote>\n<\/div>\nImpostazioni easy-rsa<\/h2>\n
Easy-rsa \u00e8 un gestore di chiavi basato su OPENSSL. Per scaricarlo eseguire il seguente comando.<\/p>\n
\n\n# wget -O easy-rsa-2.x.tar.gz https:\/\/github.com\/OpenVPN\/easy-rsa\/archive\/release\/2.x.tar.gz\n<\/pre>\n<\/blockquote>\n<\/div>\nPoi estrarre il contenuto dall’archivio compresso con il seguente comando:<\/p>\n
\n\n# tar -xf easy-rsa-2.x.tar.gz\n<\/pre>\n<\/blockquote>\n<\/div>\nSpostarsi nella cartella.<\/p>\n
\n\n# cd easy-rsa-release-2.x\n<\/pre>\n<\/blockquote>\n<\/div>\nCopiare la cartella easy-rsa<\/b> in \/etc\/openvpn<\/b>.<\/p>\n
\n\nworkstation1:\/home\/chit\/easy-rsa-release-2.x # cp -R easy-rsa \/etc\/openvpn\/\n<\/pre>\n<\/blockquote>\n<\/div>\nGenerare certificati e chiavi (Certificates & Keys)<\/h2>\n
Spostarsi nella cartella easy-rsa\/2.0 (o la propria versione).<\/p>\n
\n\n# cd \/etc\/openvpn\/easy-rsa\/2.0\n<\/pre>\n<\/blockquote>\n<\/div>\nUna volta nella cartella editare il file \u201cvars\u201d con vi o un altro editore di testo.<\/p>\n
\n\n\/etc\/openvpn\/easy-rsa\/2.0 # vi vars\n<\/pre>\n<\/blockquote>\n<\/div>\nModificare le informazioni relative alla propria localit\u00e0, citt\u00e0, il nome dell’organizzazione, l’indirizzo e-mail eccetera a proprio piacimento.<\/p>\n
Una volta fatto eseguire il file “vars”.<\/p>\n
\n\nworkstation1:\/etc\/openvpn\/easy-rsa\/2.0 # .\/vars\nbash: .\/vars: Permesso negato\nworkstation1:\/etc\/openvpn\/easy-rsa\/2.0 #\n<\/pre>\n<\/blockquote>\n<\/div>\nNel mio caso mi da un errore. Per rimediare bisogna cambire i diritti del file.<\/p>\n
\n\nworkstation1:\/etc\/openvpn\/easy-rsa\/2.0 # chmod u+x vars\n<\/pre>\n<\/blockquote>\n<\/div>\nOra funziona.<\/p>\n
\n\nworkstation1:\/etc\/openvpn\/easy-rsa\/2.0 # .\/vars\nNOTE: If you run .\/clean-all, I will be doing a rm -rf on \/etc\/openvpn\/easy-rsa\/2.0\/keys\nworkstation1:\/etc\/openvpn\/easy-rsa\/2.0 #\n<\/pre>\n<\/blockquote>\n<\/div>\nEseguire il comando clean-all.<\/p>\n
\n\nworkstation1:\/etc\/openvpn\/easy-rsa\/2.0 # .\/clean-all\nPlease source the vars script first (i.e. \"source .\/vars\")\nMake sure you have edited it to reflect your configuration.\nworkstation1:\/etc\/openvpn\/easy-rsa\/2.0 #\n<\/pre>\n<\/blockquote>\n<\/div>\nIl programma mi invita ad eseguire il comando source.<\/p>\n
\n\nworkstation1:\/etc\/openvpn\/easy-rsa\/2.0 # source .\/vars\nNOTE: If you run .\/clean-all, I will be doing a rm -rf on \/etc\/openvpn\/easy-rsa\/2.0\/keys\nworkstation1:\/etc\/openvpn\/easy-rsa\/2.0 #\n<\/pre>\n<\/blockquote>\n<\/div>\nOra funziona.<\/p>\n
\n\nworkstation1:\/etc\/openvpn\/easy-rsa\/2.0 # .\/clean-all\nworkstation1:\/etc\/openvpn\/easy-rsa\/2.0 # \n<\/pre>\n<\/blockquote>\n<\/div>\nEseguire build-ca<\/b>.<\/p>\n
\n\nworkstation1:\/etc\/openvpn\/easy-rsa\/2.0 # .\/build-ca\nGenerating a 2048 bit RSA private key\n...++\n...........++\nwriting new private key to 'ca.key'\n-----\nYou are about to be asked to enter information that will be incorporated\ninto your certificate request.\nWhat you are about to enter is what is called a Distinguished Name or a DN.\nThere are quite a few fields but you can leave some blank\nFor some fields there will be a default value,\nIf you enter '.', the field will be left blank.\n-----\nCountry Name (2 letter code) [CH]:\nState or Province Name (full name) [ZH]:\nLocality Name (eg, city) [Zurich]:\nOrganization Name (eg, company) [CHIT]:\nOrganizational Unit Name (eg, section) [IT]:\nCommon Name (eg, your name or your server's hostname) [christeninformatica.ch]:\nName [EasyRSA]:\nEmail Address [xxxxxx@]:\nworkstation1:\/etc\/openvpn\/easy-rsa\/2.0 #\n<\/pre>\n<\/blockquote>\n<\/div>\nLasciare tutto com’\u00e8, se avete cambiato i valori all’inizio (nel file vars) verranno visualizzati automaticamente.<\/p>\n
Generare il certificato e la chiave per il Server<\/h2>\n
\n\nworkstation1:\/etc\/openvpn\/easy-rsa\/2.0 # .\/build-key-server server\nGenerating a 4096 bit RSA private key\n..................................................................++\n......................................................................................++\nwriting new private key to 'server.key'\n-----\nYou are about to be asked to enter information that will be incorporated\ninto your certificate request.\nWhat you are about to enter is what is called a Distinguished Name or a DN.\nThere are quite a few fields but you can leave some blank\nFor some fields there will be a default value,\nIf you enter '.', the field will be left blank.\n-----\nCountry Name (2 letter code) [CH]:\nState or Province Name (full name) [ZH]:\nLocality Name (eg, city) [Zurich]:\nOrganization Name (eg, company) [CHIT]:\nOrganizational Unit Name (eg, section) [IT]:\nCommon Name (eg, your name or your server's hostname) [christeninformatica.ch]:\nName [EasyRSA]:\nEmail Address [xxxxxx@xxxxxx]:\n\nPlease enter the following 'extra' attributes\nto be sent with your certificate request\nA challenge password []:\nAn optional company name []:\nUsing configuration from \/etc\/openvpn\/easy-rsa\/2.0\/openssl-1.0.0.cnf\nCheck that the request matches the signature\nSignature ok\nThe Subject's Distinguished Name is as follows\ncountryName :PRINTABLE:'CH'\nstateOrProvinceName :PRINTABLE:'ZH'\nlocalityName :PRINTABLE:'Zurich'\norganizationName :PRINTABLE:'CHIT'\norganizationalUnitName:PRINTABLE:'IT'\ncommonName :PRINTABLE:'christeninformatica.ch'\nname :PRINTABLE:'EasyRSA'\nemailAddress :IA5STRING:'xxxxxx@xxxxxx'\nCertificate is to be certified until Mar 26 00:21:16 2025 GMT (3650 days)\n\n\n1 out of 1 certificate requests certified, commit? [y\/n]y\nWrite out database with 1 new entries\nData Base Updated\nworkstation1:\/etc\/openvpn\/easy-rsa\/2.0 #\n<\/pre>\n<\/blockquote>\n<\/div>\nLasciare anche qui tutto com’\u00e8 e confermare con “y” alle ultime due domande:<\/p>\n
\n
- Sign the certificate? [y\/n]:y<\/li>\n
- 1 out of 1 certificate requests certified, commit? [y\/n]y<\/li>\n<\/ul>\n
Generare il certificato e le chiavi per due clients<\/h2>\n
\n\nworkstation1:\/etc\/openvpn\/easy-rsa\/2.0 # .\/build-key client\nGenerating a 2048 bit RSA private key\n........++\n......................................................................................................................................................++\nwriting new private key to 'client.key'\n-----\nYou are about to be asked to enter information that will be incorporated\ninto your certificate request.\nWhat you are about to enter is what is called a Distinguished Name or a DN.\nThere are quite a few fields but you can leave some blank\nFor some fields there will be a default value,\nIf you enter '.', the field will be left blank.\n-----\nCountry Name (2 letter code) [CH]:\nState or Province Name (full name) [ZH]:\nLocality Name (eg, city) [Zurich]:\nOrganization Name (eg, company) [CHIT]:\nOrganizational Unit Name (eg, section) [IT]:\nCommon Name (eg, your name or your server's hostname) [christeninformatica.ch]:\nName [EasyRSA]:\nEmail Address [xxxxxx@xxxxxx]:\n\nPlease enter the following 'extra' attributes\nto be sent with your certificate request\nA challenge password []:\nAn optional company name []:\nUsing configuration from \/etc\/openvpn\/easy-rsa\/2.0\/openssl-1.0.0.cnf\nCheck that the request matches the signature\nSignature ok\nThe Subject's Distinguished Name is as follows\ncountryName :PRINTABLE:'CH'\nstateOrProvinceName :PRINTABLE:'ZH'\nlocalityName :PRINTABLE:'Zurich'\norganizationName :PRINTABLE:'CHIT'\norganizationalUnitName:PRINTABLE:'IT'\ncommonName :PRINTABLE:'christeninformatica.ch'\nname :PRINTABLE:'EasyRSA'\nemailAddress :IA5STRING:'xxxxxx@xxxxxx'\nCertificate is to be certified until Mar 26 00:25:48 2025 GMT (3650 days)\nSign the certificate? [y\/n]:y\n\n\n1 out of 1 certificate requests certified, commit? [y\/n]y\nWrite out database with 1 new entries\nData Base Updated\nworkstation1:\/etc\/openvpn\/easy-rsa\/2.0 # \n<\/pre>\n<\/blockquote>\n<\/div>\nPer generare un secondo client fare la stessa cosa con client2.<\/p>\n
Generare i parametri Diffie Hellman<\/h2>\n
\n\nworkstation1:\/etc\/openvpn\/easy-rsa\/2.0 # .\/build-dh\nGenerating DH parameters, 2048 bit long safe prime, generator 2\nThis is going to take a long time\n......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................\n<\/pre>\n<\/blockquote>\n<\/div>\nFile chiave (Key Files)<\/h2>\n
Ogni client ha bisogno di tre files chiave (Key Files) per potersi connettere e identificare, ca.crt, client.crt e client.key. Questi files si trovano in “\/etc\/openvpn\/easy-rsa\/2.0\/keys”. Copiare i file sul computer del client.<\/p>\n
\n\n
\n Nome del file<\/th>\n Necessari a<\/th>\n Scopo<\/th>\n Segreta<\/th>\n<\/tr>\n \n ca.crt<\/td>\n Al Server e a tutti i clients<\/td>\n Root CA certificate<\/td>\n NO<\/td>\n<\/tr>\n \n ca.key<\/td>\n A chi segna il certificato<\/td>\n Root CA Key<\/td>\n SI<\/td>\n<\/tr>\n \n dh{n}.pem<\/td>\n Al server<\/td>\n Parametri Diffie Hellman<\/td>\n NO<\/td>\n<\/tr>\n \n server.crt<\/td>\n Al server<\/td>\n Server Certificate<\/td>\n NO<\/td>\n<\/tr>\n \n server.key<\/td>\n Al server<\/td>\n Server Key<\/td>\n SI<\/td>\n<\/tr>\n \n client.crt<\/td>\n Al client<\/td>\n Client Certificate<\/td>\n NO<\/td>\n<\/tr>\n \n client.key<\/td>\n Al client<\/td>\n Client Key<\/td>\n SI<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n Configurazione del client<\/h2>\n
Creare un file nominato client.conf per ogni client e aggiungere quanto segue.<\/p>\n
\n\nclient\nremote xxx.xx.xxx.xx 1194\nca \"\/path\/to\/ca.crt\"\ncert \"\/path\/to\/client.crt\"\nkey \"\/path\/to\/client.key\"\ncomp-lzo yes\ndev tun\nproto udp\nnobind\nauth-nocache\nscript-security 2\npersist-key\npersist-tun\nuser nobody\ngroup nobody\nremote-cert-tls server\n<\/pre>\n<\/blockquote>\n<\/div>\nSostituire naturalmente i dati come l’indirizzo IP del server (xxx.xx.xxx.xx), il nome del certificato, della chiave, la cartella in cui si trova eccetera presenti nell’esempio con i propri.<\/p>\n
Configurazione del Server<\/h2>\n
\n\nworkstation1:\/etc\/openvpn\/easy-rsa\/2.0 # cd keys\nworkstation1:\/etc\/openvpn\/easy-rsa\/2.0\/keys # cp ca.key ca.crt dh2048.pem server.key server.crt \/etc\/openvpn\/\n<\/pre>\n<\/blockquote>\n<\/div>\nCopiare il file di configurazione del server nella cartella \/etc\/openvpn.<\/p>\n
\n\nworkstation1:\/etc\/openvpn\/easy-rsa\/2.0\/keys # cp \/usr\/share\/doc\/packages\/openvpn\/sample-config-files\/server.conf \/etc\/openvpn\/\n<\/pre>\n<\/blockquote>\n<\/div>\nEditare il file di configurazione del sever.<\/p>\n
\n\n# vi \/etc\/openvpn\/server.conf\n<\/pre>\n<\/blockquote>\n<\/div>\nCambiare il valore della chiave dh in dh2048 al posto di dh1024.<\/p>\n
\n\n# Diffie hellman parameters.\n# Generate your own with:\n# openssl dhparam -out dh1024.pem 1024\n# Substitute 2048 for 1024 if you are using\n# 2048 bit keys. \ndh dh4096.pem\n<\/pre>\n<\/blockquote>\n<\/div>\nAttivare la direttiva push “redirect-gateway def1 bypass-dhcp”<\/p>\n
\n\n# If enabled, this directive will configure\n# all clients to redirect their default\n# network gateway through the VPN, causing\n# all IP traffic such as web browsing and\n# and DNS lookups to go through the VPN\n# (The OpenVPN server machine may need to NAT\n# or bridge the TUN\/TAP interface to the internet\n# in order for this to work properly).\npush \"redirect-gateway def1 bypass-dhcp\"\n<\/pre>\n<\/blockquote>\n<\/div>\nSalvare il file.<\/p>\n
Per ulteriori informazioni consultare anche la guida in inglese di OPENSUSE: OpenVPN Installation and Setup<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Requisiti TUN\/TAP deve essere installato e attivo. Per controllare se sia attivo o meno eseguire il seguente comando. # cat \/dev\/net\/tun cat: \/dev\/net\/tun: Il descrittore del file \u00e8 danneggiato # Se tutto va bene si dovrebbe ricevere lo stesso output. Nel mio caso invece mi da un errore. # cat \/dev\/net\/tun cat: \/dev\/net\/tun: File o…<\/p>\n