於OpenWRT系統實現OpenVPN客户端

使用者想操作市面上的路由器，能操作的功能都受限於裝置提供商的限制；但若將路由器刷成類似於Linux的OpenWRT文件系統，不但可解決此問題，還有多達1000以上的功能安裝包可供使用者選擇，非常便於使用者開發。

1. 於路由器本身的頁面上傳OpenWRT韌體進行更新
2. 透過tftp上傳OpenWRT韌體進行更新
3. TTL寫入OpenWRT

延伸閱讀

Client端（Router）設定

1. 安裝包

# opkg update
# opkg install wget
# opkg install openvpn-openssl
# wget https://www.ovpn.com/download/openwrt/install.sh --no-check-certificate -O /tmp/install.sh && cd /tmp/ && chmod 0777 install.sh && ./install.sh && rm install.sh

2. 編輯Config

# vi /etc/config/openvpn
========================================
option enabled 1
option client 1
option dev tun
option proto udp
list remote “my_server_IP 1194”
option resolv_retry infinite
option route_nopull 1       #禁止走默認VPN路由表
option nobind 1
option persist_key 1
option persist_tun 1
option user nobody
option ca /etc/openvpn/ca.crt
option cert /etc/openvpn/client01.crt
option key /etc/openvpn/client01.key
option verb 3

3. 使用文件軟連結（非必要）

# vi /etc/openvpn/openvpn.conf

4. 重啟/停止OpenVPN

# /etc/init.d/openvpn start && logread -f
# /etc/init.d/openvpn restart
# /etc/init.d/openvpn stop

5. 配置iptables

• 允許br-lan端口流量被轉發
• 允許tun0端口流量被轉發
• 設置tun0出口流量NAT出去，允許路由器LAN流量走VPN通道

# iptables -I FORWARD -o br-lan -j ACCEPT
# iptables -I FORWARD -o tun0 -j ACCEPT
# iptables -t nat -I POSTROUTING -o tun0 -j MASQUERADE

6. iptables分流

# vi /etc/iproute2/rt_tables
===============================
  98 route_vpn

# ipset -N gfwlist iphash
# iptables -t mangle -N fwmark
# iptables -t mangle -A OUTPUT -j fwmark
# iptables -t mangle -A PREROUTING -j fwmark
# iptables -t mangle -A fwmark -m set --match-set gfwlist dst -j MARK --set-mark 0xffff

# ip rule add fwmark 0xffff table route_vpn

# ip route show table route_vpn #可查看路由表路由

ip route flush table route_vpn

ip route add 0.0.0.0/1 via $tun_ip1 dev tun0 table route_vpn
ip route add 10.8.0.1 via $tun_ip1 dev tun0 table route_vpn
ip route add 128.0.0.0/1 via $tun_ip1 dev tun0 table route_vpn

VPN Server端設定

1. 需要的安裝包

# sudo apt-get update
# sudo apt-get install openvpn easy-rsa

2. 編輯easy-rsa Config

# sudo mkdir /etc/openvpn/easy-rsa/
# sudo cp -r /usr/share/easy-rsa/* /etc/openvpn/easy-rsa/
# sudo vi /etc/openvpn/easy-rsa/vars
=========================================================
  export KEY_COUNTRY="US"
  export KEY_PROVINCE="NC"
  export KEY_CITY="Winston-Salem"
  export KEY_ORG="Example Company"
  export KEY_EMAIL="[email protected]"
  export KEY_CN=MyVPN
  export KEY_ALTNAMES=AltMyVPN
  export KEY_NAME=MyVPN
  export KEY_OU=MyVPN
  export KEY_CONFIG=$EASY_RSA/openssl-1.0.0.cnf

3. 查看openssl版本

# dpkg -s openssl
# openssl version

4. 複製key config file

# cp /etc/ssl/openssl.cnf /etc/openvpn/easy-rsa/openssl-1.0.0.cnf

# For use with easy-rsa version 2.0 and OpenSSL 1.0.0*
# This definition stops the following lines choking if HOME isn't
# defined.
HOME			= .
RANDFILE		= $ENV::HOME/.rnd
openssl_conf		= openssl_init
[ openssl_init ]
# Extra OBJECT IDENTIFIER info:
#oid_file		= $ENV::HOME/.oid
oid_section		= new_oids
engines			= engine_section
# To use this configuration file with the "-extfile" option of the
# "openssl x509" utility, name here the section containing the
# X.509v3 extensions to use:
# extensions		=
# (Alternatively, use a configuration file that has only
# X.509v3 extensions in its main [= default] section.)
[ new_oids ]
# We can add new OIDs in here for use by 'ca' and 'req'.
# Add a simple OID like this:
# testoid1=1.2.3.4
# Or use config file substitution like this:
# testoid2=${testoid1}.5.6
####################################################################
[ ca ]
default_ca	= CA_default		# The default ca section
####################################################################
[ CA_default ]
dir		= $ENV::KEY_DIR		# Where everything is kept
certs		= $dir			# Where the issued certs are kept
crl_dir		= $dir			# Where the issued crl are kept
database	= $dir/index.txt	# database index file.
new_certs_dir	= $dir			# default place for new certs.
certificate	= $dir/ca.crt	 	# The CA certificate
serial		= $dir/serial 		# The current serial number
crl		= $dir/crl.pem 		# The current CRL
private_key	= $dir/ca.key		# The private key
RANDFILE	= $dir/.rand		# private random number file
x509_extensions	= usr_cert		# The extentions to add to the cert
# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
# so this is commented out by default to leave a V1 CRL.
# crl_extensions	= crl_ext
default_days	= 3650			# how long to certify for
default_crl_days= 30			# how long before next CRL
default_md	= sha256		# use public key default MD
preserve	= no			# keep passed DN ordering
# A few difference way of specifying how similar the request should look
# For type CA, the listed attributes must be the same, and the optional
# and supplied fields are just that :-)
policy		= policy_anything
# For the CA policy
[ policy_match ]
countryName		= match
stateOrProvinceName	= match
organizationName	= match
organizationalUnitName	= optional
commonName		= supplied
name			= optional
emailAddress		= optional
# For the 'anything' policy
# At this point in time, you must list all acceptable 'object'
# types.
[ policy_anything ]
countryName		= optional
stateOrProvinceName	= optional
localityName		= optional
organizationName	= optional
organizationalUnitName	= optional
commonName		= supplied
name			= optional
emailAddress		= optional
####################################################################
[ req ]
default_bits		= $ENV::KEY_SIZE
default_keyfile 	= privkey.pem
default_md		= sha256
distinguished_name	= req_distinguished_name
attributes		= req_attributes
x509_extensions	= v3_ca	# The extentions to add to the self signed cert
# Passwords for private keys if not present they will be prompted for
# input_password = secret
# output_password = secret
# This sets a mask for permitted string types. There are several options.
# default: PrintableString, T61String, BMPString.
# pkix	 : PrintableString, BMPString (PKIX recommendation after 2004).
# utf8only: only UTF8Strings (PKIX recommendation after 2004).
# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
# MASK:XXXX a literal mask value.
string_mask = nombstr
# req_extensions = v3_req # The extensions to add to a certificate request
[ req_distinguished_name ]
countryName			= Country Name (2 letter code)
countryName_default		= $ENV::KEY_COUNTRY
countryName_min			= 2
countryName_max			= 2
stateOrProvinceName		= State or Province Name (full name)
stateOrProvinceName_default	= $ENV::KEY_PROVINCE
localityName			= Locality Name (eg, city)
localityName_default		= $ENV::KEY_CITY
0.organizationName		= Organization Name (eg, company)
0.organizationName_default	= $ENV::KEY_ORG
# we can do this but it is not needed normally :-)
#1.organizationName		= Second Organization Name (eg, company)
#1.organizationName_default	= World Wide Web Pty Ltd
organizationalUnitName		= Organizational Unit Name (eg, section)
#organizationalUnitName_default	=
commonName			= Common Name (eg, your name or your server\'s hostname)
commonName_max			= 64
name				= Name
name_max			= 64
emailAddress			= Email Address
emailAddress_default		= $ENV::KEY_EMAIL
emailAddress_max		= 40
# JY -- added for batch mode
organizationalUnitName_default = $ENV::KEY_OU
commonName_default = $ENV::KEY_CN
name_default = $ENV::KEY_NAME
# SET-ex3			= SET extension number 3
[ req_attributes ]
challengePassword		= A challenge password
challengePassword_min		= 4
challengePassword_max		= 20
unstructuredName		= An optional company name
[ usr_cert ]
# These extensions are added when 'ca' signs a request.
# This goes against PKIX guidelines but some CAs do it and some software
# requires this to avoid interpreting an end user certificate as a CA.
basicConstraints=CA:FALSE
# Here are some examples of the usage of nsCertType. If it is omitted
# the certificate can be used for anything *except* object signing.
# This is OK for an SSL server.
# nsCertType			= server
# For an object signing certificate this would be used.
# nsCertType = objsign
# For normal client use this is typical
# nsCertType = client, email
# and for everything including object signing:
# nsCertType = client, email, objsign
# This is typical in keyUsage for a client certificate.
# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
# This will be displayed in Netscape's comment listbox.
nsComment			= "Easy-RSA Generated Certificate"
# PKIX recommendations harmless if included in all certificates.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always
extendedKeyUsage=clientAuth
keyUsage = digitalSignature
# This stuff is for subjectAltName and issuerAltname.
# Import the email address.
# subjectAltName=email:copy
subjectAltName=$ENV::KEY_ALTNAMES
# Copy subject details
# issuerAltName=issuer:copy
#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
#nsBaseUrl
#nsRevocationUrl
#nsRenewalUrl
#nsCaPolicyUrl
#nsSslServerName
[ server ]
# JY ADDED -- Make a cert with nsCertType set to "server"
basicConstraints=CA:FALSE
nsCertType                     = server
nsComment                      = "Easy-RSA Generated Server Certificate"
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always
extendedKeyUsage=serverAuth
keyUsage = digitalSignature, keyEncipherment
subjectAltName=$ENV::KEY_ALTNAMES
[ v3_req ]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
[ v3_ca ]
# Extensions for a typical CA
# PKIX recommendation.
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer:always
# This is what PKIX recommends but some broken software chokes on critical
# extensions.
#basicConstraints = critical,CA:true
# So we do this instead.
basicConstraints = CA:true
# Key usage: this is typical for a CA certificate. However since it will
# prevent it being used as an test self-signed certificate it is best
# left out by default.
# keyUsage = cRLSign, keyCertSign
# Some might want this also
# nsCertType = sslCA, emailCA
# Include email address in subject alt name: another PKIX recommendation
# subjectAltName=email:copy
# Copy issuer details
# issuerAltName=issuer:copy
# DER hex encoding of an extension: beware experts only!
# obj=DER:02:03
# Where 'obj' is a standard or added object
# You can even override a supported extension:
# basicConstraints= critical, DER:30:03:01:01:FF
[ crl_ext ]
# CRL extensions.
# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
# issuerAltName=issuer:copy
authorityKeyIdentifier=keyid:always,issuer:always
[ engine_section ]
#
# If you are using PKCS#11
# Install engine_pkcs11 of opensc (www.opensc.org)
# And uncomment the following
# verify that dynamic_path points to the correct location
#
#pkcs11 = pkcs11_section
[ pkcs11_section ]
engine_id = pkcs11
dynamic_path = /usr/lib/engines/engine_pkcs11.so
MODULE_PATH = $ENV::PKCS11_MODULE_PATH
PIN = $ENV::PKCS11_PIN
init = 0

5. 生成伺服器端相關證書密鑰

# source vars
# ./clean-all   ##使用./clean-all 會清空之前的證書
# ./build-ca
# ./build-key-server server01
##Common Name 必填，且不能与 build-dh 相同，否則會報錯：failed to update database</n> TXT_DB error number 2

# ./build-dh
##openvpn --genkey --secret keys/ta.key 目前不生成，若有需要可生成
# cd keys/
# cp server01.crt server01.key ca.crt ta.key dh2048.pem /etc/openvpn/
# cd /etc/openvpn/easy-rsa/

6. 生成客戶端證書

# source vars
# ./build-key client01

7. 吊銷證書

**********************************************************************
# ./revoke-full client  (填要註銷的common name) 
crl-verify /etc/openvpn/easy-rsa/keys/crl.pem  #加在server.conf
#crl-verify /etc/openvpn/easy-rsa/keys/crl.pem #註釋此行可還原吊銷的用戶
**********************************************************************
# sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/
# sudo gzip -d /etc/openvpn/server.conf.gz

8. 編輯server config

# sudo vi /etc/openvpn/server.conf  #目前有開的
============================================================
  port 1194
  proto udp
  dev tun
  ca /etc/openvpn/ca.crt
  cert /etc/openvpn/server01.crt
  key /etc/openvpn/server01.key
  dh /etc/openvpn/dh2048.pem
  server 10.8.0.0 255.255.255.0
  ifconfig-pool-persist /var/log/openvpn/ipp.txt
  push "redirect-gateway def1 bypass-dhcp"
  keepalive 10 120
  cipher AES-256-CBC
  max-clients 1000
  user nobody
  group nogroup
  persist-key
  persist-tun
  status /var/log/openvpn-status.log
  verb 3
  explicit-exit-notify 1
  #腳本啟動
  script-security 2 
  ;down-pre
  ;up "/etc/openvpn/upp.sh"  #server啟動後執行的腳本
  ;down "/etc/openvpn/down.sh" #server關閉要執行的腳本
  ;client-connect "/etc/openvpn/upp.sh"  #client連線後，server要執行的腳本(尚未測試成功)
  ;client-disconnect "/etc/openvpn/down.sh"

9. 開啟轉發功能

# sudo vi /etc/sysctl.conf
##net.ipv4.ip_forward=1   (uncomment this line)
# sudo sysctl -p /etc/sysctl.conf   #成功會顯示 net.ipv4.ip_forward=1

10. 設置iptables，配置NAT將VPN網段IP轉發到eth0網卡

# iptables -t nat -A POSTROUTING -s 10.88.0.0/24 -o ens4 -j MASQUERADE  #自動獲取eth0網卡的IP地址

11. 設置OpenVPN端口通過

# iptables -A INPUT -p TCP --dport 1194 -j ACCEPT
# iptables -A INPUT -p UDP --dport 1194 -j ACCEPT
# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

12. 設置filter

# iptables -A INPUT -i ens4 -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT
# iptables -A INPUT -i tun0 -j ACCEPT
# iptables -A FORWARD -i tun0 -j ACCEPT
# iptables -A FORWARD -i tun0 -o ens4 -m state --state RELATED,ESTABLISHED -j ACCEPT
# iptables -A FORWARD -i ens4 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
# iptables -A OUTPUT -o tun0 -j ACCEPT

13. 啟動 OpenVPN server

# sudo systemctl start openvpn@server
# sudo systemctl stop openvpn@server
# sudo systemctl status openvpn@server

14. 驗證是否啟動成功

# sudo journalctl -xe
# openvpn --config /etc/openvpn/server.conf

15. Build client key script

(Just need to modify $Snum and $key_num, then can create keys automatically.)
1. Install packet
   # sudo apt-get install tcl tk expect
2. Put produce_key and pkanswer files in the directory /etc/openvpn/easy-rsa
3. # chmod 777 produce_key pkanswer
4. Set the key common name (EX, client6.1, 6 : server number, 1 : client number) by modifying $Snum and $key_num inside the produce_key
5. Run the script 
   # ./produce_key	#It needs about 8 to 10 seconds to build one key

#!/bin/sh
#Set the server number
Snum="6"
#---------------------
#Check the current max existing number of client key automatically
num="1"
while find /etc/openvpn/easy-rsa/keys -iname "client*" | grep $Snum.$num > /dev/null; do
	num=`expr $num + 1`
done
#If you want to check the current max existing number of client key manually,
#Uncommon this line and key-in your number
#num="4"
#----------------------------------------------------------------------------
#Set the number of keys you want to build
key_num="1"
#----------------------------------------
Cnum="$num"
key_count=1
while [ $key_count -le $key_num ]; do
	./pkanswer $Snum $Cnum
	echo "client_num:$Cnum"
	Cnum=`expr $Cnum + 1`
	key_count=`expr $key_count + 1`
done

#!/usr/bin/expect
#Passing parameters
set Snum [lindex $argv 0]
set Cnum [lindex $argv 1]
#Command that requires interaction
spawn ./build-key client$Snum.$Cnum
#Keywords of section that need interaction
expect "Country Name*"
#String that need to enter after the keywords appear
send "\n"	
expect "stateOrProvinceName*"
send "\n"
expect "Locality Name*"
send "\n"
expect "Organization Name*"
send "\n"
expect "Organizational Unit*"
send "\n"
expect "Common Name*"
send "\n"
expect "Name*"
send "\n"
expect "Email Address*"
send "\n"
expect "A challenge password*"
send "fourgamers\n"
expect "An optional company name*"
send "N-Warp\n"
expect "Sign the certificate"
send "y\n"
expect "requests certified"
send "y\n"
interact
#expect eof