暂无描述
您最多选择25个主题 主题必须以字母或数字开头,可以包含连字符 (-),并且长度不得超过35个字符
Thomas Buck 10b859df14 modified vpn role to allow routing to private net 3 年前
..
defaults modified vpn role to allow routing to private net 3 年前
files Remove Google Authenticator / Two-Factor Authentification 5 年前
handlers Fix systemd configuration of OpenVPN server 8 年前
tasks modified vpn role to allow routing to private net 3 年前
templates modified vpn role to allow routing to private net 3 年前
README.md modified vpn role to allow routing to private net 3 年前

README.md

OpenVPN

This is the standard ‘upstream’ sovereign OpenVPN stuff. The files that you need are now in secret/sovereign-openvpn-files. Make sure LZO compression is enabled and that you provide the ta.key file for the TLS-Auth option with a direction of ‘1’.

The one major change is the option of enabling ‘openvpn_enable_sub_routing’ in your config. See the defaults in here for the available settings.

This then looks something like:

   ----------
  | VPS      |
  | 10.8.0.1 |
   ----------
     |
     | Internet
     | VPN
     |            -----------
     |-----------| Phone     |
     |           | 10.8.0.42 |
     |            -----------
     |
   --|------------------------------------------
  |  |                                     Home |
  |  |                                          |
  |  |      -------------       -------------   |
  |  |     | Router      |     | Bridge      |  |
  |   -----| 192.168.0.1 |-----| 192.168.0.2 |  |
  |        |             |     | 10.8.0.2    |  |
  |         -------------       -------------   |
  |               |                             |
  |               |                             |
  |         -------------                       |
  |        | Server      |                      |
  |        | 192.168.0.3 |                      |
  |         -------------                       |
   ---------------------------------------------

In this scenario, your devices ‘on the go’, like the Phone above, want to connect to devices in your home network, like the Server, via the VPN connection over our sovereign VPS. This can easily accomplished with these configs. For the devices in your home network to be able to reach the devices on the VPN network, you need to add a static route to the Router above, that routes all traffic for 10.8.0.0/24 via 192.168.0.2, the Bridge.

On the Bridge, do something like this, after installing eg. Ubuntu Server on the machine:

ssh-copy-id -i ~/.ssh/id_ecdsa thomas@vpn-bridge
scp sovereign/secret/sovereign-openvpn-files/eddie.xythobuz.de/etc/openvpn/nas/xythobuz.de.ovpn bridge:~/client.ovpn
ssh bridge
sudo apt-get install openvpn
sudo cp client.ovpn /etc/openvpn/client_vpn.conf

sudo vim /etc/sysctl.conf
# uncomment line net.ipv4.ip_forward=1

sudo reboot

This will then allow devices connected to the VPN to just reach the 192.168.0.X devices without any further configuration.