Forum: Multiroom N z wykorzystaniem openVPN

# amod OpenVPN server configuration file
# created by ovpn 01/10/15 21:18:35

########################################
# DO NOT touch these

dev ovpns
dev-type tap
dev-node /dev/tun0
proto tcp-server
daemon
writepid /var/run/openvpn_server.pid
script-security 3
secret /etc/amod/conf/openvpn/openvpn_server_static.key
log /tmp/ovpnspipe
status /var/log/openvpn_server_status.log 60

local 192.168.0.1
lport 1194

########################################
# You may touch these, but only
# if you know what you are doing

#user nobody
#group nobody

nice 12
mute 3
suppress-timestamps

keepalive 10 60
ping-timer-rem
persist-tun
persist-key
persist-remote-ip
float

# Automatically generated configuration
daemon
dev tap11
proto tcp-client
remote dar3k.myftp.org 1194
ifconfig 192.168.0.200 255.255.255.0
resolv-retry 5
nobind
persist-key
persist-tun
comp-lzo adaptive
verb 3
secret static.key
status-version 2
status status

# Custom Configuration
log-append /var/log/openvpn.log

TCP/UDP: Preserving recently used remote address: [AF_INET]18.*.*.*:55188
Preserving previous TUN/TAP instance: ovpns
Listening for incoming TCP connection on [AF_INET]192.168.0.1:1194
TCP connection established with [AF_INET]18.*.*.*:26009
TCPv4_SERVER link local (bound): [AF_INET]192.168.0.1:1194
TCPv4_SERVER link remote: [AF_INET]18.*.*.*:26009
Peer Connection Initiated with [AF_INET]18.*.*.*:26009
Initialization Sequence Completed

Sat Jan 10 21:35:40 2015 Preserving previous TUN/TAP instance: tap11
Sat Jan 10 21:35:40 2015 Attempting to establish TCP connection with [AF_INET]77.255.13.*:1194 [nonblock]
Sat Jan 10 21:35:44 2015 TCP connection established with [AF_INET]77.255.13.*:1194
Sat Jan 10 21:35:44 2015 TCPv4_CLIENT link local: [undef]
Sat Jan 10 21:35:44 2015 TCPv4_CLIENT link remote: [AF_INET]77.255.13.*:1194

Kod Pobierz kod źródłowy

cat /etc/openvpn/client1/config.ovpn

# Automatically generated configuration 

daemon 

client 

dev tap11 

proto tcp-client 

remote coś.tam.pl 1466 

resolv-retry 30 

nobind 

persist-key 

persist-tun 

comp-lzo yes 

cipher AES-128-CBC 

verb 3 

status-version 2 

status status 



# Custom Configuration 

ca /jffs/ca.crt 

cert /jffs/client1.crt 

key /jffs/client1.key 



Oraz firewall:

cat /etc/iptables

*mangle 

:PREROUTING ACCEPT [0:0] 

:OUTPUT ACCEPT [0:0] 

-I PREROUTING -i vlan1 -j DSCP --set-dscp 0 

COMMIT 

*nat 

:PREROUTING ACCEPT [0:0] 

:POSTROUTING ACCEPT [0:0] 

:OUTPUT ACCEPT [0:0] 

:WANPREROUTING - [0:0] 

xxxxxx

-A PREROUTING -i vlan1 -d 192.168.1.1/255.255.255.0 -j DROP 

-A PREROUTING -i vlan1 -d 192.168.200.2/255.255.255.0 -j DROP 

xxxxxx

-A POSTROUTING -o br0 -s 192.168.1.1/255.255.255.0 -d 192.168.1.1/255.255.255.0 -j SNAT --to-source 192.168.1.1 

-A POSTROUTING -o br1 -s 192.168.200.2/255.255.255.0 -d 192.168.200.2/255.255.255.0 -j SNAT --to-source 192.168.200.2 

COMMIT 

*filter 

:INPUT DROP [0:0] 

:OUTPUT ACCEPT [0:0] 

xxxxx

-A INPUT -i lo -j ACCEPT 

-A INPUT -i br0 -j ACCEPT 

-A INPUT -i br1 -j ACCEPT 

xxxxxx

:FORWARD DROP [0:0] 

-A FORWARD -m account --aaddr 192.168.1.0/255.255.255.0 --aname lan 

-A FORWARD -m account --aaddr 192.168.200.0/255.255.255.0 --aname lan1 

-A FORWARD -i br0 -o br0 -j ACCEPT 

-A FORWARD -i br1 -o br1 -j ACCEPT 

xxxxxx

:monitor - [0:0] 

xxxxxx

:wanin - [0:0] 

:wanout - [0:0] 

xxxxxx 

-A FORWARD -i br0 -o br1 -j DROP 

-A FORWARD -i br1 -o br0 -j DROP 

-A FORWARD -i vlan1 -j wanin 

-A FORWARD -o vlan1 -j wanout 

-A FORWARD -i br0 -j ACCEPT 

-A FORWARD -i br1 -j ACCEPT 

COMMIT

sleep 30
ip route flush table 200
ip route flush cache
ip rule add from 192.168.1.6 lookup 200
ip rule add from 192.168.1.8 lookup 200
VPN_GW=`ifconfig tun11 | awk '/inet addr/ {split ($2,A,":"); print A[2]}'`
ip route add table 200 default via $VPN_GW dev tun11