2013-03-04

Ubuntu架設VPN Server

VPN在現今環境是很實用的，可以讓你在家裡也能存取公司內部網路的資源，這樣就可遠端工作啦~(但順不順暢還是得靠網路速度和硬體夠不夠強@@)

這邊用Ubuntu Server 12.04來說明如何架設。



首先硬體方面，安裝兩張網路卡比較好，網路卡設定:
eth0(內部連線) eth1(對外連線)
IP 192.168.1.10 i.i.i.i(視情況而定)
Gateway 不指定(因為不對外) g.g.g.g(視情況)
Mask 255.255.255.0 255.255.255.0(視情況)
DNS (有內部dns server可在此指定) 8.8.8.8(視情況)

如果是全新安裝，那在安裝時候預設網路要選擇eth1，在DHCP會失敗沒關係(如果對外是DHCP連線就沒此問題)，在下一步會讓你手動輸入對外網路連線資訊，就照著實際情況輸入好，這樣網路就會通。在選擇要安裝的套件先只選擇OpenSSH Server就好，其他就照著說明裝完吧。

裝好之後的設定步驟：

  1. 變身Root 
    1. sudo -i
    2. (輸入你帳號的密碼)
  2. 安裝pptpd
    1. apt-get install pptpd
  3. 編輯/etc/pptpd.conf
    1. vi /etc/pptpd.conf
  4. 幾乎都不用動，只需編輯最下面的localip與remoteip。
    這裡說明一下，localip指的是vpn server的真實IP，也就是可連線到internet的IP；而remoteip就是你要指派給用戶端的IP範圍，跟DHCP的意思差不多。 
    1. ###############################################################################
    2. # $Id$
    3. #
    4. # Sample Poptop configuration file /etc/pptpd.conf
    5. #
    6. # Changes are effective when pptpd is restarted.
    7. ###############################################################################
    9. # TAG: ppp
    10. #       Path to the pppd program, default '/usr/sbin/pppd' on Linux
    11. #
    12. #ppp /usr/sbin/pppd
    14. # TAG: option
    15. #       Specifies the location of the PPP options file.
    16. #       By default PPP looks in '/etc/ppp/options'
    17. #
    18. #下面這行的檔案等等也要做修改。
    19. option /etc/ppp/pptpd-options
    21. # TAG: debug
    22. #       Turns on (more) debugging to syslog
    23. #
    24. #debug
    26. # TAG: stimeout
    27. #       Specifies timeout (in seconds) on starting ctrl connection
    28. #
    29. # stimeout 10
    31. # TAG: noipparam
    32. #       Suppress the passing of the client's IP address to PPP, which is
    33. #       done by default otherwise.
    34. #
    35. #noipparam
    37. # TAG: logwtmp
    38. #       Use wtmp(5) to record client connections and disconnections.
    39. #
    40. logwtmp
    41. # TAG: bcrelay
    42. #       Turns on broadcast relay to clients from interface
    43. #
    44. #bcrelay eth1
    46. # TAG: localip
    47. # TAG: remoteip
    48. #       Specifies the local and remote IP address ranges.
    49. #
    50. #       Any addresses work as long as the local machine takes care of the
    51. #       routing.  But if you want to use MS-Windows networking, you should
    52. #       use IP addresses out of the LAN address space and use the proxyarp
    53. #       option in the pppd options file, or run bcrelay.
    54. #
    55. #       You can specify single IP addresses seperated by commas or you can
    56. #       specify ranges, or both. For example:
    57. #
    58. #               192.168.0.234,192.168.0.245-249,192.168.0.254
    59. #
    60. #       IMPORTANT RESTRICTIONS:
    61. #
    62. #       1. No spaces are permitted between commas or within addresses.
    63. #
    64. #       2. If you give more IP addresses than MAX_CONNECTIONS, it will
    65. #          start at the beginning of the list and go until it gets
    66. #          MAX_CONNECTIONS IPs. Others will be ignored.
    67. #
    68. #       3. No shortcuts in ranges! ie. 234-8 does not mean 234 to 238,
    69. #          you must type 234-238 if you mean this.
    70. #
    71. #       4. If you give a single localIP, that's ok - all local IPs will
    72. #          be set to the given one. You MUST still give at least one remote
    73. #          IP for each simultaneous client.
    74. #
    75. # (Recommended)
    76. #localip 192.168.0.1
    77. #remoteip 192.168.0.234-238,192.168.0.245
    78. # or
    79. #localip 192.168.0.234-238,192.168.0.245
    80. #remoteip 192.168.1.234-238,192.168.1.245
    82. #伺服器真實IP，依實際情況修改
    83. localip i.i.i.i
    85. #要指派給用戶端的內部IP範圍，依實際情況修改
    86. remoteip 192.168.1.241-245
  5. 編輯/etc/ppp/pptpd-options檔案，把ms-dns打開，還有做一些連線認證的設定 
    1. ###############################################################################
    2. # $Id$
    3. #
    4. # Sample Poptop PPP options file /etc/ppp/pptpd-options
    5. # Options used by PPP when a connection arrives from a client.
    6. # This file is pointed to by /etc/pptpd.conf option keyword.
    7. # Changes are effective on the next connection.  See "man pppd".
    8. #
    9. # You are expected to change this file to suit your system.  As
    10. # packaged, it requires PPP 2.4.2 and the kernel MPPE module.
    11. ###############################################################################
    13. # Authentication
    15. # Name of the local system for authentication purposes
    16. # (must match the second field in /etc/ppp/chap-secrets entries)
    17. name pptpd
    19. # Optional: domain name to use for authentication
    20. # domain mydomain.net
    22. # Strip the domain prefix from the username before authentication.
    23. # (applies if you use pppd with chapms-strip-domain patch)
    24. #chapms-strip-domain
    26. # Encryption
    27. # Debian: on systems with a kernel built with the package
    28. # kernel-patch-mppe >= 2.4.2 and using ppp >= 2.4.2, ...
    29. # {{{
    31. #################################################################
    32. #注意這底下的設定，沒打開或是開錯了都有可能造成client端無法通過認證連線VPN
    33. refuse-pap
    34. refuse-chap
    35. refuse-mschap
    36. # Require the peer to authenticate itself using MS-CHAPv2 [Microsoft
    37. # Challenge Handshake Authentication Protocol, Version 2] authentication.
    38. require-mschap-v2
    39. # Require MPPE 128-bit encryption
    40. # (note that MPPE requires the use of MSCHAP-V2 during authentication)
    41. require-mppe-128
    42. # }}}
    43. ############################################
    45. # Network and Routing
    47. # If pppd is acting as a server for Microsoft Windows clients, this
    48. # option allows pppd to supply one or two DNS (Domain Name Server)
    49. # addresses to the clients.  The first instance of this option
    50. # specifies the primary DNS address; the second instance (if given)
    51. # specifies the secondary DNS address.
    52. # Attention! This information may not be taken into account by a Windows
    53. # client. See KB311218 in Microsoft's knowledge base for more information.
    54. #ms-dns 10.0.0.1
    55. #ms-dns 10.0.0.2
    56. #dns server依實際情況設定
    57. ms-dns 8.8.8.8
    58. ms-dns 8.8.4.4
    59. # If pppd is acting as a server for Microsoft Windows or "Samba"
    60. # clients, this option allows pppd to supply one or two WINS (Windows
    61. # Internet Name Services) server addresses to the clients.  The first
    62. # instance of this option specifies the primary WINS address; the
    63. # second instance (if given) specifies the secondary WINS address.
    64. #ms-wins 10.0.0.3
    65. #ms-wins 10.0.0.4
    67. # Add an entry to this system's ARP [Address Resolution Protocol]
    68. # table with the IP address of the peer and the Ethernet address of this
    69. # system.  This will have the effect of making the peer appear to other
    70. # systems to be on the local ethernet.
    71. # (you do not need this if your PPTP server is responsible for routing
    72. # packets to the clients -- James Cameron)
    73. proxyarp
    75. # Debian: do not replace the default route
    76. nodefaultroute
    78. # Logging
    80. # Enable connection debugging facilities.
    81. # (see your syslog configuration for where pppd sends to)
    82. #debug
    84. # Print out all the option values which have been set.
    85. # (often requested by mailing list to verify options)
    86. #dump
    88. # Miscellaneous
    90. # Create a UUCP-style lock file for the pseudo-tty to ensure exclusive
    91. # access.
    92. lock
    94. # Disable BSD-Compress compression
    95. nobsdcomp
  6. 編輯/etc/ppp/chap-secrets，這個檔案設定可用VPN連線的使用者，跟系統裡的帳號無關，採用明碼設定，所以一定要記得權限只有root可讀寫(600)，內容就照底下範例: 
    1. # Secrets for authentication using CHAP
    2. # client        server  secret                  IP addresses
    3. # 帳號名         勿動     密碼                     允許連線的IP
    4. vpn-user        pptpd   userpassword            *
  7. 設定好後重新啟動pptpd
    1. /etc/init.d/pptpd restart
試著連線看看，OK~可以連線成功，但....嘿嘿...

怎麼連上去之後甚麼網站都去不了?

因為上面的設定只是讓外部網路使用者能以PPTP協定連線進來該台主機並取得內部IP，但預設NAT功能並沒打開，所以想要連其他IP或網站是不可能瘩!!!

所以我們繼續說明NAT設定...

  1. 首先開啟封包轉遞(IP forward功能) 
    1. vi /etc/sysctl.conf
    1. # 將底下這個設定值修改正確即可！ (本來值為 0 ，將它改為 1 即可)
    2. net.ipv4.ip_forward = 1

    改完存檔後輸入 sysctl -p 讓設定馬上生效。
  2. 輸入底下指令打開IP轉送 
    1. iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth1 -j MASQUERADE

    上面指令是將192.168.1.x網段透過eth1(也就是外網)轉發出去
  3. 上面設定完之後，透過VPN連線進來的User們應該就可以上網和連線到別台主機了!!但是這樣Port其實是全開，有點危險，所以有機會要再設定一下iptables防火牆

----

經過參考鳥哥的網頁之後，可照著底下的步驟，可使這台也充當IP分享器和簡易防火牆的功能，照底下步驟設定的話，上面的步驟就可以省囉~
    1. mkdir -p /usr/local/iptables
    2. vi /usr/local/iptables/iptables.rule
  2. 增加底下所有，並視情況修改 
    1. #!/bin/bash
    3. #設定參數
    4. EXTIF="eth1"
    5. INIF="eth0"
    6. INNET="192.168.1.0/24"
    7. export EXTIF INIF INNET
    9. #重設防火牆規則
    10. iptables -F
    11. iptables -X
    12. iptables -Z
    13. iptables -P INPUT   DROP
    14. iptables -P OUTPUT  ACCEPT
    15. iptables -P FORWARD ACCEPT
    16. iptables -A INPUT -i lo -j ACCEPT
    17. iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    19. #允許某些ICMP封包進入
    20. ##AICMP="0 3 3/4 4 8 11 12 14 16 18"
    21. #AICMP="0 8 17 18"
    22. #for tyicmp in $AICMP
    23. #do
    24. #  #iptables -A INPUT -i $EXTIF -p icmp --icmp-type $tyicmp -j ACCEPT
    25.   #iptables -A INPUT -i $INIF -p icmp --icmp-type $tyicmp -j ACCEPT
    26. #done
    28. #內部網路全部允許
    29. iptables -A INPUT -i $INIF -s $INNET -j ACCEPT
    31. #僅允許ssh與pptpd進入
    32. iptables -A INPUT -p TCP --dport 22 --sport 1024:65534 -j ACCEPT   #SSH
    33. iptables -A INPUT -p TCP --dport 1723 --sport 1024:65534 -j ACCEPT #PPTP
    34. #iptables -A INPUT -p TCP --dport 53 --sport 1024:65534 -j ACCEPT   #DNS
    35. #iptables -A INPUT -p UDP --dport 53 --sport 1024:65534 -j ACCEPT   #DNS
    37. #更新pptp之後，突然變得無法連線了嗎?因為新版pptpd要開GRE才能通的關係，所以必須打開47才能連線!!系統更新後就是為了這個卡超久
    38. iptables -A INPUT -p 47 -j ACCEPT
    41. #清除NAT Table
    42. iptables -F -t nat
    43. iptables -X -t nat
    44. iptables -Z -t nat
    45. iptables -t nat -P PREROUTING  ACCEPT
    46. iptables -t nat -P POSTROUTING ACCEPT
    47. iptables -t nat -P OUTPUT      ACCEPT
    49. #開啟IP轉發
    50. iptables -t nat -A POSTROUTING -s $INNET -o $EXTIF -j MASQUERADE
    52. #存檔
    53. iptables-save
  3. 修改權限僅root可讀取寫入執行 
    1. chmod 700 /usr/local/iptables/iptables.*
  4. 這樣的步驟每次開機都要手動執行一次/usr/local/iptables/iptables.rule，太麻煩了，我們讓他每次開機就自動執行: 
    1. vi /etc/rc.local

    在exit 0前面加上下面那行 
    1. /usr/local/iptables/iptables.rule

    存檔即可。

張貼者： 於
標籤： ,

沒有留言:

張貼留言

訂閱： 張貼留言 (Atom)