於OpenWRT系統實現OpenVPN客户端

更新於 發佈於 閱讀時間約 41 分鐘
使用者想操作市面上的路由器,能操作的功能都受限於裝置提供商的限制;但若將路由器刷成類似於Linux的OpenWRT文件系統,不但可解決此問題,還有多達1000以上的功能安裝包可供使用者選擇,非常便於使用者開發。


將路由器韌體刷成OpenWRT系統,其實就是在路由器上安裝OpenWRT的概念,常見的方法有以下三種:

1. 於路由器本身的頁面上傳OpenWRT韌體進行更新
2. 透過tftp上傳OpenWRT韌體進行更新
3. TTL寫入OpenWRT
本篇文章僅介紹安裝OpenVPN的過程

延伸閱讀

基於OpenWRT之QOS排程


Client端(Router)設定

1. 安裝包

# opkg update
# opkg install wget
# opkg install openvpn-openssl
# wget https://www.ovpn.com/download/openwrt/install.sh --no-check-certificate -O /tmp/install.sh && cd /tmp/ && chmod 0777 install.sh && ./install.sh && rm install.sh

2. 編輯Config

# vi /etc/config/openvpn
========================================
option enabled 1
option client 1
option dev tun
option proto udp
list remote “my_server_IP 1194”
option resolv_retry infinite
option route_nopull 1 #禁止走默認VPN路由表
option nobind 1
option persist_key 1
option persist_tun 1
option user nobody
option ca /etc/openvpn/ca.crt
option cert /etc/openvpn/client01.crt
option key /etc/openvpn/client01.key
option verb 3

3. 使用文件軟連結(非必要)

# vi /etc/openvpn/openvpn.conf

4. 重啟/停止OpenVPN

# /etc/init.d/openvpn start && logread -f
# /etc/init.d/openvpn restart
# /etc/init.d/openvpn stop

5. 配置iptables

  • 允許br-lan端口流量被轉發
  • 允許tun0端口流量被轉發
  • 設置tun0出口流量NAT出去,允許路由器LAN流量走VPN通道
# iptables -I FORWARD -o br-lan -j ACCEPT
# iptables -I FORWARD -o tun0 -j ACCEPT
# iptables -t nat -I POSTROUTING -o tun0 -j MASQUERADE

6. iptables分流

6.1 新增路由表讓特定ip走VPN

# vi /etc/iproute2/rt_tables
===============================
98 route_vpn

6.2 將destination IP與gfwlist裡匹配的封包標記0xffff

# ipset -N gfwlist iphash
# iptables -t mangle -N fwmark
# iptables -t mangle -A OUTPUT -j fwmark
# iptables -t mangle -A PREROUTING -j fwmark
# iptables -t mangle -A fwmark -m set --match-set gfwlist dst -j MARK --set-mark 0xffff

6.3 將標記0xffff的封包指定到路由表route_vpn

# ip rule add fwmark 0xffff table route_vpn

6.4 查看路由表route_vpn的路由規則

# ip route show table route_vpn #可查看路由表路由

6.5 清空路由表route_vpn的規則

ip route flush table route_vpn

6.6 自訂路由表route_vpn的規則

ip route add 0.0.0.0/1 via $tun_ip1 dev tun0 table route_vpn
ip route add 10.8.0.1 via $tun_ip1 dev tun0 table route_vpn
ip route add 128.0.0.0/1 via $tun_ip1 dev tun0 table route_vpn


VPN Server端設定

1. 需要的安裝包

# sudo apt-get update
# sudo apt-get install openvpn easy-rsa

2. 編輯easy-rsa Config

# sudo mkdir /etc/openvpn/easy-rsa/
# sudo cp -r /usr/share/easy-rsa/* /etc/openvpn/easy-rsa/
# sudo vi /etc/openvpn/easy-rsa/vars
=========================================================
export KEY_COUNTRY="US"
export KEY_PROVINCE="NC"
export KEY_CITY="Winston-Salem"
export KEY_ORG="Example Company"
export KEY_EMAIL="steve@example.com"
export KEY_CN=MyVPN
export KEY_ALTNAMES=AltMyVPN
export KEY_NAME=MyVPN
export KEY_OU=MyVPN
export KEY_CONFIG=$EASY_RSA/openssl-1.0.0.cnf

3. 查看openssl版本

# dpkg -s openssl
# openssl version

4. 複製key config file

# cp /etc/ssl/openssl.cnf /etc/openvpn/easy-rsa/openssl-1.0.0.cnf

4.1 openssl-1.0.0.cnf

# For use with easy-rsa version 2.0 and OpenSSL 1.0.0*

# This definition stops the following lines choking if HOME isn't
# defined.
HOME = .
RANDFILE = $ENV::HOME/.rnd
openssl_conf = openssl_init

[ openssl_init ]
# Extra OBJECT IDENTIFIER info:
#oid_file = $ENV::HOME/.oid
oid_section = new_oids
engines = engine_section

# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions =
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)

[ new_oids ]

# We can add new OIDs in here for use by 'ca' and 'req'.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6

####################################################################
[ ca ]
default_ca = CA_default # The default ca section

####################################################################
[ CA_default ]

dir = $ENV::KEY_DIR # Where everything is kept
certs = $dir # Where the issued certs are kept
crl_dir = $dir # Where the issued crl are kept
database = $dir/index.txt # database index file.
new_certs_dir = $dir # default place for new certs.

certificate = $dir/ca.crt # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/ca.key # The private key
RANDFILE = $dir/.rand # private random number file

x509_extensions = usr_cert # The extentions to add to the cert

# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crl_extensions = crl_ext

default_days = 3650 # how long to certify for
default_crl_days= 30 # how long before next CRL
default_md = sha256 # use public key default MD
preserve = no # keep passed DN ordering

# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy = policy_anything

# For the CA policy
[ policy_match ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
name = optional
emailAddress = optional

# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
name = optional
emailAddress = optional

####################################################################
[ req ]
default_bits = $ENV::KEY_SIZE
default_keyfile = privkey.pem
default_md = sha256
distinguished_name = req_distinguished_name
attributes = req_attributes
x509_extensions = v3_ca # The extentions to add to the self signed cert

# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret

# This sets a mask for permitted string types. There are several options.
# default: PrintableString, T61String, BMPString.
# pkix : PrintableString, BMPString (PKIX recommendation after 2004).
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
string_mask = nombstr

# req_extensions = v3_req # The extensions to add to a certificate request

[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default = $ENV::KEY_COUNTRY
countryName_min = 2
countryName_max = 2

stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = $ENV::KEY_PROVINCE

localityName = Locality Name (eg, city)
localityName_default = $ENV::KEY_CITY

0.organizationName = Organization Name (eg, company)
0.organizationName_default = $ENV::KEY_ORG

# we can do this but it is not needed normally :-)
#1.organizationName = Second Organization Name (eg, company)
#1.organizationName_default = World Wide Web Pty Ltd

organizationalUnitName = Organizational Unit Name (eg, section)
#organizationalUnitName_default =

commonName = Common Name (eg, your name or your server\'s hostname)
commonName_max = 64

name = Name
name_max = 64

emailAddress = Email Address
emailAddress_default = $ENV::KEY_EMAIL
emailAddress_max = 40

# JY -- added for batch mode
organizationalUnitName_default = $ENV::KEY_OU
commonName_default = $ENV::KEY_CN
name_default = $ENV::KEY_NAME


# SET-ex3 = SET extension number 3

[ req_attributes ]
challengePassword = A challenge password
challengePassword_min = 4
challengePassword_max = 20

unstructuredName = An optional company name

[ usr_cert ]

# These extensions are added when 'ca' signs a request.

# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.

# This is OK for an SSL server.
# nsCertType = server

# For an object signing certificate this would be used.
# nsCertType = objsign

# For normal client use this is typical
# nsCertType = client, email

# and for everything including object signing:
# nsCertType = client, email, objsign

# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# This will be displayed in Netscape's comment listbox.
nsComment = "Easy-RSA Generated Certificate"

# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always
extendedKeyUsage=clientAuth
keyUsage = digitalSignature


# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
subjectAltName=$ENV::KEY_ALTNAMES

# Copy subject details
# issuerAltName=issuer:copy

#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
#nsBaseUrl
#nsRevocationUrl
#nsRenewalUrl
#nsCaPolicyUrl
#nsSslServerName

[ server ]

# JY ADDED -- Make a cert with nsCertType set to "server"
basicConstraints=CA:FALSE
nsCertType = server
nsComment = "Easy-RSA Generated Server Certificate"
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always
extendedKeyUsage=serverAuth
keyUsage = digitalSignature, keyEncipherment
subjectAltName=$ENV::KEY_ALTNAMES

[ v3_req ]

# Extensions to add to a certificate request

basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment

[ v3_ca ]


# Extensions for a typical CA


# PKIX recommendation.

subjectKeyIdentifier=hash

authorityKeyIdentifier=keyid:always,issuer:always

# This is what PKIX recommends but some broken software chokes on critical
# extensions.
#basicConstraints = critical,CA:true
# So we do this instead.
basicConstraints = CA:true

# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign

# Some might want this also
# nsCertType = sslCA, emailCA

# Include email address in subject alt name: another PKIX recommendation
# subjectAltName=email:copy
# Copy issuer details
# issuerAltName=issuer:copy

# DER hex encoding of an extension: beware experts only!
# obj=DER:02:03
# Where 'obj' is a standard or added object
# You can even override a supported extension:
# basicConstraints= critical, DER:30:03:01:01:FF

[ crl_ext ]

# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.

# issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always,issuer:always

[ engine_section ]
#
# If you are using PKCS#11
# Install engine_pkcs11 of opensc (www.opensc.org)
# And uncomment the following
# verify that dynamic_path points to the correct location
#
#pkcs11 = pkcs11_section

[ pkcs11_section ]
engine_id = pkcs11
dynamic_path = /usr/lib/engines/engine_pkcs11.so
MODULE_PATH = $ENV::PKCS11_MODULE_PATH
PIN = $ENV::PKCS11_PIN
init = 0

5. 生成伺服器端相關證書密鑰

# source vars
# ./clean-all ##使用./clean-all 會清空之前的證書
# ./build-ca
# ./build-key-server server01
##Common Name 必填,且不能与 build-dh 相同,否則會報錯:failed to update database</n> TXT_DB error number 2


# ./build-dh
##openvpn --genkey --secret keys/ta.key 目前不生成,若有需要可生成

# cd keys/
# cp server01.crt server01.key ca.crt ta.key dh2048.pem /etc/openvpn/
# cd /etc/openvpn/easy-rsa/

6. 生成客戶端證書

# source vars
# ./build-key client01

7. 吊銷證書

**********************************************************************
# ./revoke-full client (填要註銷的common name)
crl-verify /etc/openvpn/easy-rsa/keys/crl.pem #加在server.conf
#crl-verify /etc/openvpn/easy-rsa/keys/crl.pem #註釋此行可還原吊銷的用戶
**********************************************************************
# sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/
# sudo gzip -d /etc/openvpn/server.conf.gz

8. 編輯server config

# sudo vi /etc/openvpn/server.conf  #目前有開的
============================================================
port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server01.crt
key /etc/openvpn/server01.key
dh /etc/openvpn/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
push "redirect-gateway def1 bypass-dhcp"
keepalive 10 120
cipher AES-256-CBC
max-clients 1000
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 3
explicit-exit-notify 1
#腳本啟動
script-security 2
;down-pre
;up "/etc/openvpn/upp.sh" #server啟動後執行的腳本
;down "/etc/openvpn/down.sh" #server關閉要執行的腳本
;client-connect "/etc/openvpn/upp.sh" #client連線後,server要執行的腳本(尚未測試成功)
;client-disconnect "/etc/openvpn/down.sh"

9. 開啟轉發功能

# sudo vi /etc/sysctl.conf
##net.ipv4.ip_forward=1 (uncomment this line)
# sudo sysctl -p /etc/sysctl.conf #成功會顯示 net.ipv4.ip_forward=1

10. 設置iptables,配置NAT將VPN網段IP轉發到eth0網卡

# iptables -t nat -A POSTROUTING -s 10.88.0.0/24 -o ens4 -j MASQUERADE  #自動獲取eth0網卡的IP地址

11. 設置OpenVPN端口通過

# iptables -A INPUT -p TCP --dport 1194 -j ACCEPT
# iptables -A INPUT -p UDP --dport 1194 -j ACCEPT
# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

12. 設置filter

# iptables -A INPUT -i ens4 -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
# iptables -A INPUT -i tun0 -j ACCEPT
# iptables -A FORWARD -i tun0 -j ACCEPT
# iptables -A FORWARD -i tun0 -o ens4 -m state --state RELATED,ESTABLISHED -j ACCEPT
# iptables -A FORWARD -i ens4 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
# iptables -A OUTPUT -o tun0 -j ACCEPT

13. 啟動 OpenVPN server

# sudo systemctl start openvpn@server
# sudo systemctl stop openvpn@server
# sudo systemctl status openvpn@server

14. 驗證是否啟動成功

# sudo journalctl -xe
# openvpn --config /etc/openvpn/server.conf

15. Build client key script

(Just need to modify $Snum and $key_num, then can create keys automatically.)
1. Install packet
# sudo apt-get install tcl tk expect
2. Put produce_key and pkanswer files in the directory /etc/openvpn/easy-rsa
3. # chmod 777 produce_key pkanswer
4. Set the key common name (EX, client6.1, 6 : server number, 1 : client number) by modifying $Snum and $key_num inside the produce_key
5. Run the script
# ./produce_key #It needs about 8 to 10 seconds to build one key

15.1 produce_key

#!/bin/sh

#Set the server number
Snum="6"
#---------------------

#Check the current max existing number of client key automatically
num="1"
while find /etc/openvpn/easy-rsa/keys -iname "client*" | grep $Snum.$num > /dev/null; do
num=`expr $num + 1`
done

#If you want to check the current max existing number of client key manually,
#Uncommon this line and key-in your number
#num="4"
#----------------------------------------------------------------------------


#Set the number of keys you want to build
key_num="1"
#----------------------------------------

Cnum="$num"
key_count=1
while [ $key_count -le $key_num ]; do
./pkanswer $Snum $Cnum
echo "client_num:$Cnum"
Cnum=`expr $Cnum + 1`
key_count=`expr $key_count + 1`
done

15.2 pkanswer

#!/usr/bin/expect

#Passing parameters
set Snum [lindex $argv 0]
set Cnum [lindex $argv 1]

#Command that requires interaction
spawn ./build-key client$Snum.$Cnum

#Keywords of section that need interaction
expect "Country Name*"
#String that need to enter after the keywords appear
send "\n"

expect "stateOrProvinceName*"
send "\n"
expect "Locality Name*"
send "\n"
expect "Organization Name*"
send "\n"
expect "Organizational Unit*"
send "\n"
expect "Common Name*"
send "\n"
expect "Name*"
send "\n"
expect "Email Address*"
send "\n"
expect "A challenge password*"
send "fourgamers\n"
expect "An optional company name*"
send "N-Warp\n"
expect "Sign the certificate"
send "y\n"
expect "requests certified"
send "y\n"
interact
#expect eof


感謝您耐心閱讀
本專題將會持續收錄Violet的職場筆記,
若有理解不對的地方,歡迎留言指教!
若喜歡我的文章,歡迎贊助支持,您的支持將會成為我繼續創作的動力!

留言
avatar-img
留言分享你的想法!
avatar-img
Violet旅遊札記
37會員
72內容數
記錄每一次珍貴的旅行,讓回憶變成永恆 這裡沒有華麗的詞藻,卻有最真實的筆記 札記撰寫耗時,願我有動力一直寫下去! ※本沙龍每次只會挑其中一個專題來發佈文章,每隔三週的週五為發佈日,若未發佈文章,下一個發佈日就是三週後,希望大家可以多多支持,也歡迎留言指教,您的留言或愛心都是Violet持續創作的寶貴動力唷~
你可能也想看
Thumbnail
每年4月、5月都是最多稅要繳的月份,當然大部份的人都是有機會繳到「綜合所得稅」,只是相當相當多人還不知道,原來繳給政府的稅!可以透過一些有活動的銀行信用卡或電子支付來繳,從繳費中賺一點點小確幸!就是賺個1%~2%大家也是很開心的,因為你們把沒回饋變成有回饋,就是用卡的最高境界 所得稅線上申報
Thumbnail
每年4月、5月都是最多稅要繳的月份,當然大部份的人都是有機會繳到「綜合所得稅」,只是相當相當多人還不知道,原來繳給政府的稅!可以透過一些有活動的銀行信用卡或電子支付來繳,從繳費中賺一點點小確幸!就是賺個1%~2%大家也是很開心的,因為你們把沒回饋變成有回饋,就是用卡的最高境界 所得稅線上申報
Thumbnail
本教程將引導您在 Ubuntu 系統上啟用 SSH、配置防火牆規則以允許入站連接,並更改預設 SSH 連接埠以增強安全性。包括更新系統、安裝OpenSSH伺服器、更改連接埠、設定防火牆、檢查規則和重新啟動服務等步驟。
Thumbnail
本教程將引導您在 Ubuntu 系統上啟用 SSH、配置防火牆規則以允許入站連接,並更改預設 SSH 連接埠以增強安全性。包括更新系統、安裝OpenSSH伺服器、更改連接埠、設定防火牆、檢查規則和重新啟動服務等步驟。
Thumbnail
當大量的網路封包在有限的頻寬中傳輸,總有一些服務的封包會因為搶不過其他封包而造成卡頓,例如玩遊戲時,若同時也在下載其他大型檔案,就會造成遊戲卡頓甚至斷線。這時候客製化QOS來決定哪些封包能優先被傳送,就能有效地提升指定服務的順暢度,進而提升使用者在網路上的體驗。 本篇文章接介紹如何在OpenW
Thumbnail
當大量的網路封包在有限的頻寬中傳輸,總有一些服務的封包會因為搶不過其他封包而造成卡頓,例如玩遊戲時,若同時也在下載其他大型檔案,就會造成遊戲卡頓甚至斷線。這時候客製化QOS來決定哪些封包能優先被傳送,就能有效地提升指定服務的順暢度,進而提升使用者在網路上的體驗。 本篇文章接介紹如何在OpenW
Thumbnail
使用者想操作市面上的路由器,能操作的功能都受限於裝置提供商的限制;但若將路由器刷成類似於Linux的OpenWRT文件系統,不但可解決此問題,還有多達1000以上的功能安裝包可供使用者選擇,非常便於使用者開發。 將路由器韌體刷成OpenWRT系統,其實就是在路由器上安裝OpenWRT的概念,常見的方
Thumbnail
使用者想操作市面上的路由器,能操作的功能都受限於裝置提供商的限制;但若將路由器刷成類似於Linux的OpenWRT文件系統,不但可解決此問題,還有多達1000以上的功能安裝包可供使用者選擇,非常便於使用者開發。 將路由器韌體刷成OpenWRT系統,其實就是在路由器上安裝OpenWRT的概念,常見的方
Thumbnail
ModSecurity 是普遍應用之 公開網頁程式防火牆 ( 可 搭配 OWASP (Open Web Application Security Project) 維護的免費核心規則集 Core Rule Set CRS 初始設計 為 Apache HTTP Server 之模組 後續發展成 htt
Thumbnail
ModSecurity 是普遍應用之 公開網頁程式防火牆 ( 可 搭配 OWASP (Open Web Application Security Project) 維護的免費核心規則集 Core Rule Set CRS 初始設計 為 Apache HTTP Server 之模組 後續發展成 htt
Thumbnail
之前我已經成功在fedora架設nextcloud了,不過現在還無法讓其他台電腦連到NextCloud所以這部份需要設定的有 firewall(防火牆) Apache HTTP服務器的NextCloud網站設定文件 NextCloud配置文件。 請防火牆開放80port 顯示系統內建服務名稱
Thumbnail
之前我已經成功在fedora架設nextcloud了,不過現在還無法讓其他台電腦連到NextCloud所以這部份需要設定的有 firewall(防火牆) Apache HTTP服務器的NextCloud網站設定文件 NextCloud配置文件。 請防火牆開放80port 顯示系統內建服務名稱
Thumbnail
打包網頁 在部署網站之前,我們要先來打包我們的網頁前端專案 為什麼要打包呢?什麼是打包呢?這有點像是編譯,如果你寫過 C 應該講到這裡就理解為什麼要這樣做了 在網頁開發中網頁內容最原始就是直接用 html 下去寫,但一個成熟的開發者會善用框架來開發,不論是用 vue 或 react,樣式的部分也會從
Thumbnail
打包網頁 在部署網站之前,我們要先來打包我們的網頁前端專案 為什麼要打包呢?什麼是打包呢?這有點像是編譯,如果你寫過 C 應該講到這裡就理解為什麼要這樣做了 在網頁開發中網頁內容最原始就是直接用 html 下去寫,但一個成熟的開發者會善用框架來開發,不論是用 vue 或 react,樣式的部分也會從
Thumbnail
原文:迷途小資男 接下來,就是要使用 MobaXterm 來 SSH 連線到 VM 主機。 連線的方式如上,若是 DNS 可以解析到 域名,那就在 Remote Host 打上域名,若是還不能夠成功解析,那就先打上公用 IP(外部 IP) 成功的話就設看到這個畫面。 BUT! 編輯設定檔
Thumbnail
原文:迷途小資男 接下來,就是要使用 MobaXterm 來 SSH 連線到 VM 主機。 連線的方式如上,若是 DNS 可以解析到 域名,那就在 Remote Host 打上域名,若是還不能夠成功解析,那就先打上公用 IP(外部 IP) 成功的話就設看到這個畫面。 BUT! 編輯設定檔
追蹤感興趣的內容從 Google News 追蹤更多 vocus 的最新精選內容追蹤 Google News