使用者想操作市面上的路由器，能操作的功能都受限於裝置提供商的限制；但若將路由器刷成類似於Linux的OpenWRT文件系統，不但可解決此問題，還有多達1000以上的功能安裝包可供使用者選擇，非常便於使用者開發。
將路由器韌體刷成OpenWRT系統，其實就是在路由器上安裝OpenWRT的概念，常見的方法有以下三種：
1. 於路由器本身的頁面上傳OpenWRT韌體進行更新
2. 透過tftp上傳OpenWRT韌體進行更新
3. TTL寫入OpenWRT
本篇文章僅介紹安裝OpenVPN的過程
延伸閱讀
基於OpenWRT之QOS排程Client端（Router）設定
1. 安裝包
# opkg update
# opkg install wget
# opkg install openvpn-openssl
# wget https://www.ovpn.com/download/openwrt/install.sh --no-check-certificate -O /tmp/install.sh && cd /tmp/ && chmod 0777 install.sh && ./install.sh && rm install.sh
2. 編輯Config
# vi /etc/config/openvpn
========================================
option enabled 1
option client 1
option dev tun
option proto udp
list remote “my_server_IP 1194”
option resolv_retry infinite
option route_nopull 1 #禁止走默認VPN路由表
option nobind 1
option persist_key 1
option persist_tun 1
option user nobody
option ca /etc/openvpn/ca.crt
option cert /etc/openvpn/client01.crt
option key /etc/openvpn/client01.key
option verb 3
3. 使用文件軟連結（非必要）
# vi /etc/openvpn/openvpn.conf4. 重啟/停止OpenVPN
# /etc/init.d/openvpn start && logread -f
# /etc/init.d/openvpn restart
# /etc/init.d/openvpn stop
5. 配置iptables
- 允許br-lan端口流量被轉發
- 允許tun0端口流量被轉發
- 設置tun0出口流量NAT出去，允許路由器LAN流量走VPN通道
# iptables -I FORWARD -o br-lan -j ACCEPT
# iptables -I FORWARD -o tun0 -j ACCEPT
# iptables -t nat -I POSTROUTING -o tun0 -j MASQUERADE
6. iptables分流
6.1 新增路由表讓特定ip走VPN
# vi /etc/iproute2/rt_tables
===============================
98 route_vpn
6.2 將destination IP與gfwlist裡匹配的封包標記0xffff
# ipset -N gfwlist iphash
# iptables -t mangle -N fwmark
# iptables -t mangle -A OUTPUT -j fwmark
# iptables -t mangle -A PREROUTING -j fwmark
# iptables -t mangle -A fwmark -m set --match-set gfwlist dst -j MARK --set-mark 0xffff
6.3 將標記0xffff的封包指定到路由表route_vpn
# ip rule add fwmark 0xffff table route_vpn6.4 查看路由表route_vpn的路由規則
# ip route show table route_vpn #可查看路由表路由6.5 清空路由表route_vpn的規則
ip route flush table route_vpn6.6 自訂路由表route_vpn的規則
ip route add 0.0.0.0/1 via $tun_ip1 dev tun0 table route_vpn
ip route add 10.8.0.1 via $tun_ip1 dev tun0 table route_vpn
ip route add 128.0.0.0/1 via $tun_ip1 dev tun0 table route_vpn
VPN Server端設定
1. 需要的安裝包
# sudo apt-get update
# sudo apt-get install openvpn easy-rsa
2. 編輯easy-rsa Config
# sudo mkdir /etc/openvpn/easy-rsa/
# sudo cp -r /usr/share/easy-rsa/* /etc/openvpn/easy-rsa/
# sudo vi /etc/openvpn/easy-rsa/vars
=========================================================
export KEY_COUNTRY="US"
export KEY_PROVINCE="NC"
export KEY_CITY="Winston-Salem"
export KEY_ORG="Example Company"
export KEY_EMAIL="steve@example.com"
export KEY_CN=MyVPN
export KEY_ALTNAMES=AltMyVPN
export KEY_NAME=MyVPN
export KEY_OU=MyVPN
export KEY_CONFIG=$EASY_RSA/openssl-1.0.0.cnf
3. 查看openssl版本
# dpkg -s openssl
# openssl version
4. 複製key config file
# cp /etc/ssl/openssl.cnf /etc/openvpn/easy-rsa/openssl-1.0.0.cnf4.1 openssl-1.0.0.cnf
# For use with easy-rsa version 2.0 and OpenSSL 1.0.0*
# This definition stops the following lines choking if HOME isn't
# defined.
HOME = .
RANDFILE = $ENV::HOME/.rnd
openssl_conf = openssl_init
[ openssl_init ]
# Extra OBJECT IDENTIFIER info:
#oid_file = $ENV::HOME/.oid
oid_section = new_oids
engines = engine_section
# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions =
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)
[ new_oids ]
# We can add new OIDs in here for use by 'ca' and 'req'.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6
####################################################################
[ ca ]
default_ca = CA_default # The default ca section
####################################################################
[ CA_default ]
dir = $ENV::KEY_DIR # Where everything is kept
certs = $dir # Where the issued certs are kept
crl_dir = $dir # Where the issued crl are kept
database = $dir/index.txt # database index file.
new_certs_dir = $dir # default place for new certs.
certificate = $dir/ca.crt # The CA certificate
serial = $dir/serial # The current serial number
crl = $dir/crl.pem # The current CRL
private_key = $dir/ca.key # The private key
RANDFILE = $dir/.rand # private random number file
x509_extensions = usr_cert # The extentions to add to the cert
# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crl_extensions = crl_ext
default_days = 3650 # how long to certify for
default_crl_days= 30 # how long before next CRL
default_md = sha256 # use public key default MD
preserve = no # keep passed DN ordering
# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy = policy_anything
# For the CA policy
[ policy_match ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
name = optional
emailAddress = optional
# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
name = optional
emailAddress = optional
####################################################################
[ req ]
default_bits = $ENV::KEY_SIZE
default_keyfile = privkey.pem
default_md = sha256
distinguished_name = req_distinguished_name
attributes = req_attributes
x509_extensions = v3_ca # The extentions to add to the self signed cert
# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret
# This sets a mask for permitted string types. There are several options.
# default: PrintableString, T61String, BMPString.
# pkix : PrintableString, BMPString (PKIX recommendation after 2004).
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
string_mask = nombstr
# req_extensions = v3_req # The extensions to add to a certificate request
[ req_distinguished_name ]
countryName = Country Name (2 letter code)
countryName_default = $ENV::KEY_COUNTRY
countryName_min = 2
countryName_max = 2
stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = $ENV::KEY_PROVINCE
localityName = Locality Name (eg, city)
localityName_default = $ENV::KEY_CITY
0.organizationName = Organization Name (eg, company)
0.organizationName_default = $ENV::KEY_ORG
# we can do this but it is not needed normally :-)
#1.organizationName = Second Organization Name (eg, company)
#1.organizationName_default = World Wide Web Pty Ltd
organizationalUnitName = Organizational Unit Name (eg, section)
#organizationalUnitName_default =
commonName = Common Name (eg, your name or your server\'s hostname)
commonName_max = 64
name = Name
name_max = 64
emailAddress = Email Address
emailAddress_default = $ENV::KEY_EMAIL
emailAddress_max = 40
# JY -- added for batch mode
organizationalUnitName_default = $ENV::KEY_OU
commonName_default = $ENV::KEY_CN
name_default = $ENV::KEY_NAME
# SET-ex3 = SET extension number 3
[ req_attributes ]
challengePassword = A challenge password
challengePassword_min = 4
challengePassword_max = 20
unstructuredName = An optional company name
[ usr_cert ]
# These extensions are added when 'ca' signs a request.
# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.
basicConstraints=CA:FALSE
# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.
# This is OK for an SSL server.
# nsCertType = server
# For an object signing certificate this would be used.
# nsCertType = objsign
# For normal client use this is typical
# nsCertType = client, email
# and for everything including object signing:
# nsCertType = client, email, objsign
# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
# This will be displayed in Netscape's comment listbox.
nsComment = "Easy-RSA Generated Certificate"
# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always
extendedKeyUsage=clientAuth
keyUsage = digitalSignature
# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
subjectAltName=$ENV::KEY_ALTNAMES
# Copy subject details
# issuerAltName=issuer:copy
#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem
#nsBaseUrl
#nsRevocationUrl
#nsRenewalUrl
#nsCaPolicyUrl
#nsSslServerName
[ server ]
# JY ADDED -- Make a cert with nsCertType set to "server"
basicConstraints=CA:FALSE
nsCertType = server
nsComment = "Easy-RSA Generated Server Certificate"
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always
extendedKeyUsage=serverAuth
keyUsage = digitalSignature, keyEncipherment
subjectAltName=$ENV::KEY_ALTNAMES
[ v3_req ]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
[ v3_ca ]
# Extensions for a typical CA
# PKIX recommendation.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
# This is what PKIX recommends but some broken software chokes on critical
# extensions.
#basicConstraints = critical,CA:true
# So we do this instead.
basicConstraints = CA:true
# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign
# Some might want this also
# nsCertType = sslCA, emailCA
# Include email address in subject alt name: another PKIX recommendation
# subjectAltName=email:copy
# Copy issuer details
# issuerAltName=issuer:copy
# DER hex encoding of an extension: beware experts only!
# obj=DER:02:03
# Where 'obj' is a standard or added object
# You can even override a supported extension:
# basicConstraints= critical, DER:30:03:01:01:FF
[ crl_ext ]
# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
# issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always,issuer:always
[ engine_section ]
#
# If you are using PKCS#11
# Install engine_pkcs11 of opensc (www.opensc.org)
# And uncomment the following
# verify that dynamic_path points to the correct location
#
#pkcs11 = pkcs11_section
[ pkcs11_section ]
engine_id = pkcs11
dynamic_path = /usr/lib/engines/engine_pkcs11.so
MODULE_PATH = $ENV::PKCS11_MODULE_PATH
PIN = $ENV::PKCS11_PIN
init = 0
5. 生成伺服器端相關證書密鑰
# source vars
# ./clean-all ##使用./clean-all 會清空之前的證書
# ./build-ca
# ./build-key-server server01
##Common Name 必填，且不能与 build-dh 相同，否則會報錯：failed to update database</n> TXT_DB error number 2
# ./build-dh
##openvpn --genkey --secret keys/ta.key 目前不生成，若有需要可生成
# cd keys/
# cp server01.crt server01.key ca.crt ta.key dh2048.pem /etc/openvpn/
# cd /etc/openvpn/easy-rsa/
6. 生成客戶端證書
# source vars
# ./build-key client01
7. 吊銷證書
**********************************************************************
# ./revoke-full client (填要註銷的common name)
crl-verify /etc/openvpn/easy-rsa/keys/crl.pem #加在server.conf
#crl-verify /etc/openvpn/easy-rsa/keys/crl.pem #註釋此行可還原吊銷的用戶
**********************************************************************
# sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/
# sudo gzip -d /etc/openvpn/server.conf.gz
8. 編輯server config
# sudo vi /etc/openvpn/server.conf #目前有開的
============================================================
port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server01.crt
key /etc/openvpn/server01.key
dh /etc/openvpn/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
push "redirect-gateway def1 bypass-dhcp"
keepalive 10 120
cipher AES-256-CBC
max-clients 1000
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 3
explicit-exit-notify 1
#腳本啟動
script-security 2
;down-pre
;up "/etc/openvpn/upp.sh" #server啟動後執行的腳本
;down "/etc/openvpn/down.sh" #server關閉要執行的腳本
;client-connect "/etc/openvpn/upp.sh" #client連線後，server要執行的腳本(尚未測試成功)
;client-disconnect "/etc/openvpn/down.sh"
9. 開啟轉發功能
# sudo vi /etc/sysctl.conf
##net.ipv4.ip_forward=1 (uncomment this line)
# sudo sysctl -p /etc/sysctl.conf #成功會顯示 net.ipv4.ip_forward=1
10. 設置iptables，配置NAT將VPN網段IP轉發到eth0網卡
# iptables -t nat -A POSTROUTING -s 10.88.0.0/24 -o ens4 -j MASQUERADE #自動獲取eth0網卡的IP地址11. 設置OpenVPN端口通過
# iptables -A INPUT -p TCP --dport 1194 -j ACCEPT
# iptables -A INPUT -p UDP --dport 1194 -j ACCEPT
# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
12. 設置filter
# iptables -A INPUT -i ens4 -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
# iptables -A INPUT -i tun0 -j ACCEPT
# iptables -A FORWARD -i tun0 -j ACCEPT
# iptables -A FORWARD -i tun0 -o ens4 -m state --state RELATED,ESTABLISHED -j ACCEPT
# iptables -A FORWARD -i ens4 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
# iptables -A OUTPUT -o tun0 -j ACCEPT
13. 啟動 OpenVPN server
# sudo systemctl start openvpn@server
# sudo systemctl stop openvpn@server
# sudo systemctl status openvpn@server
14. 驗證是否啟動成功
# sudo journalctl -xe
# openvpn --config /etc/openvpn/server.conf
15. Build client key script
(Just need to modify $Snum and $key_num, then can create keys automatically.)
1. Install packet
# sudo apt-get install tcl tk expect
2. Put produce_key and pkanswer files in the directory /etc/openvpn/easy-rsa
3. # chmod 777 produce_key pkanswer
4. Set the key common name (EX, client6.1, 6 : server number, 1 : client number) by modifying $Snum and $key_num inside the produce_key
5. Run the script
# ./produce_key #It needs about 8 to 10 seconds to build one key
15.1 produce_key
#!/bin/sh
#Set the server number
Snum="6"
#---------------------
#Check the current max existing number of client key automatically
num="1"
while find /etc/openvpn/easy-rsa/keys -iname "client*" | grep $Snum.$num > /dev/null; do
num=`expr $num + 1`
done
#If you want to check the current max existing number of client key manually,
#Uncommon this line and key-in your number
#num="4"
#----------------------------------------------------------------------------
#Set the number of keys you want to build
key_num="1"
#----------------------------------------
Cnum="$num"
key_count=1
while [ $key_count -le $key_num ]; do
./pkanswer $Snum $Cnum
echo "client_num:$Cnum"
Cnum=`expr $Cnum + 1`
key_count=`expr $key_count + 1`
done
15.2 pkanswer
#!/usr/bin/expect
#Passing parameters
set Snum [lindex $argv 0]
set Cnum [lindex $argv 1]
#Command that requires interaction
spawn ./build-key client$Snum.$Cnum
#Keywords of section that need interaction
expect "Country Name*"
#String that need to enter after the keywords appear
send "\n"
expect "stateOrProvinceName*"
send "\n"
expect "Locality Name*"
send "\n"
expect "Organization Name*"
send "\n"
expect "Organizational Unit*"
send "\n"
expect "Common Name*"
send "\n"
expect "Name*"
send "\n"
expect "Email Address*"
send "\n"
expect "A challenge password*"
send "fourgamers\n"
expect "An optional company name*"
send "N-Warp\n"
expect "Sign the certificate"
send "y\n"
expect "requests certified"
send "y\n"
interact
#expect eof
感謝您耐心閱讀
本專題將會持續收錄Violet的職場筆記，
若有理解不對的地方，歡迎留言指教！
若喜歡我的文章，歡迎贊助支持，您的支持將會成為我繼續創作的動力！
