IPv6: OpenVPN - Revision history

Unknown user: /* OpenVPN Server di Mikrotik */

2022-12-05T03:17:41Z

OpenVPN Server di Mikrotik

← Older revision		Revision as of 03:17, 5 December 2022
Line 89:		Line 89:
	secret add name=onno profile=vpn-profile password=123456		secret add name=onno profile=vpn-profile password=123456

	/ppp profile set default dhcpv6-pd-pool="		/ppp profile set default dhcpv6-pd-pool="vpn-pool-ipv6"
	~~/interface pppoe~~-~~server server~~
	~~add service~~-~~name=test interface=ether1~~

	/ppp		/ppp
	profile add name="vpn-profile-ipv6" use-encryption=yes ~~local~~-~~address=2345:200::1 dns~~-~~server=2345:200::1/64 remote-address~~=vpn-pool-ipv6		profile add name="vpn-profile-ipv6" use-encryption=yes dhcpv6-pd-pool="vpn-pool-ipv6" use-ipv6=yes
	secret add name=ipv6user profile=vpn-profile-ipv6 password=123456		secret add name=ipv6user profile=vpn-profile-ipv6 password=123456
	secret add name=ipv6user1 profile=vpn-profile-ipv6 password=123456		secret add name=ipv6user1 profile=vpn-profile-ipv6 password=123456
Line 105:		Line 103:
	set default-profile=vpn-profile certificate=server-certificate require-client-certificate=yes auth=sha1 cipher=aes128,aes192,aes256 enabled=yes		set default-profile=vpn-profile certificate=server-certificate require-client-certificate=yes auth=sha1 cipher=aes128,aes192,aes256 enabled=yes

	/interface ovpn-server~~-ipv6~~ server		/interface ovpn-server server
	set default-profile=vpn-profile-ipv6 certificate=server-certificate require-client-certificate=yes auth=sha1 cipher=aes128,aes192,aes256 enabled=yes		set default-profile=vpn-profile-ipv6 certificate=server-certificate require-client-certificate=yes auth=sha1 cipher=aes128,aes192,aes256 enabled=yes

Unknown user: /* OpenVPN user */

2022-12-05T03:06:22Z

OpenVPN user

← Older revision		Revision as of 03:06, 5 December 2022
Line 88:		Line 88:
	secret add name=user2 profile=vpn-profile password=123456		secret add name=user2 profile=vpn-profile password=123456
	secret add name=onno profile=vpn-profile password=123456		secret add name=onno profile=vpn-profile password=123456

			/ppp profile set default dhcpv6-pd-pool="
			/interface pppoe-server server
			add service-name=test interface=ether1

	/ppp		/ppp

Unknown user: /* OpenVPN Pool Address */

2022-12-05T02:53:10Z

OpenVPN Pool Address

← Older revision		Revision as of 02:53, 5 December 2022
Line 73:		Line 73:

	===OpenVPN Pool Address===		===OpenVPN Pool Address===

			/ip
			pool add name="vpn-pool" ranges=192.168.8.10-192.168.8.99

	/ipv6		/ipv6
	~~pool add name="vpn-pool" ranges=192.168.8.10-192.168.8.99~~
	pool add name="vpn-pool-ipv6" prefix=2345:200::/64 prefix-length=64		pool add name="vpn-pool-ipv6" prefix=2345:200::/64 prefix-length=64

Unknown user: /* OpenVPN user */

2022-12-05T02:51:37Z

OpenVPN user

← Older revision		Revision as of 02:51, 5 December 2022
Line 88:		Line 88:

	/ppp		/ppp
	profile add name="vpn-profile-ipv6" use-encryption=yes local-address=2345:200::1 dns-server=2345:200::1 remote-address=vpn-pool-ipv6		profile add name="vpn-profile-ipv6" use-encryption=yes local-address=2345:200::1 dns-server=2345:200::1/64 remote-address=vpn-pool-ipv6
	secret add name=ipv6user profile=vpn-profile-ipv6 password=123456		secret add name=ipv6user profile=vpn-profile-ipv6 password=123456
	secret add name=ipv6user1 profile=vpn-profile-ipv6 password=123456		secret add name=ipv6user1 profile=vpn-profile-ipv6 password=123456

Unknown user: /* Setup Router Mikrotik Biasa */

2022-12-05T02:49:21Z

Setup Router Mikrotik Biasa

← Older revision		Revision as of 02:49, 5 December 2022
Line 29:		Line 29:

	/ipv6 address add interface=bridge1 address=2345:100::1/64		/ipv6 address add interface=bridge1 address=2345:100::1/64
			/ipv6 route add gateway=bridge1

	==Certificate==		==Certificate==

Unknown user at 02:43, 5 December 2022

2022-12-05T02:43:37Z

← Older revision		Revision as of 02:43, 5 December 2022
Line 27:		Line 27:
	/ip firewall nat print		/ip firewall nat print
	/ip dhcp-server setup		/ip dhcp-server setup

			/ipv6 address add interface=bridge1 address=2345:100::1/64


	==Certificate==		==Certificate==
Line 71:		Line 74:
	===OpenVPN Pool Address===		===OpenVPN Pool Address===

	/ip		/ipv6
	pool add name="vpn-pool" ranges=192.168.8.10-192.168.8.99		pool add name="vpn-pool" ranges=192.168.8.10-192.168.8.99
			pool add name="vpn-pool-ipv6" prefix=2345:200::/64 prefix-length=64

	===OpenVPN user===		===OpenVPN user===
Line 82:		Line 86:
	secret add name=user2 profile=vpn-profile password=123456		secret add name=user2 profile=vpn-profile password=123456
	secret add name=onno profile=vpn-profile password=123456		secret add name=onno profile=vpn-profile password=123456

			/ppp
			profile add name="vpn-profile-ipv6" use-encryption=yes local-address=2345:200::1 dns-server=2345:200::1 remote-address=vpn-pool-ipv6
			secret add name=ipv6user profile=vpn-profile-ipv6 password=123456
			secret add name=ipv6user1 profile=vpn-profile-ipv6 password=123456
			secret add name=ipv6user2 profile=vpn-profile-ipv6 password=123456
			secret add name=ipv6onno profile=vpn-profile-ipv6 password=123456

	===OpenVPN Enable===		===OpenVPN Enable===
Line 88:		Line 99:
	set default-profile=vpn-profile certificate=server-certificate require-client-certificate=yes auth=sha1 cipher=aes128,aes192,aes256 enabled=yes		set default-profile=vpn-profile certificate=server-certificate require-client-certificate=yes auth=sha1 cipher=aes128,aes192,aes256 enabled=yes

			/interface ovpn-server-ipv6 server
			set default-profile=vpn-profile-ipv6 certificate=server-certificate require-client-certificate=yes auth=sha1 cipher=aes128,aes192,aes256 enabled=yes

	==Set Firewall Mikrotik==		==Set Firewall Mikrotik==
Line 100:		Line 113:
	/ip firewall filter		/ip firewall filter
	add chain=input protocol=tcp dst-port=1194 action=accept comment="Allow OpenVPN"		add chain=input protocol=tcp dst-port=1194 action=accept comment="Allow OpenVPN"




			Jika dibutuhkan kita bisa buka access port 1194

			/ipv6 firewall filter
			add chain=input protocol=tcp dst-port=1194 action=accept place-before=0 comment="Allow OpenVPN"

			atau

			/ipv6 firewall filter
			add chain=input protocol=tcp dst-port=1194 action=accept comment="Allow OpenVPN"



	==PC Kali Linux==		==PC Kali Linux==

Unknown user: Created page with "Sumber: https://www.medo64.com/2016/12/simple-openvpn-server-on-mikrotik/ Asumsi kita membuat sambungan OpenVPN dengan Server di balik Mikrotik sebagai berikut, File:Openv..."

2022-12-05T02:34:13Z

Created page with "Sumber: https://www.medo64.com/2016/12/simple-openvpn-server-on-mikrotik/ Asumsi kita membuat sambungan OpenVPN dengan Server di balik Mikrotik sebagai berikut, File:Openv..."

New page

Sumber: https://www.medo64.com/2016/12/simple-openvpn-server-on-mikrotik/

Asumsi kita membuat sambungan OpenVPN dengan Server di balik Mikrotik sebagai berikut,

[[File:Openvpn-mikrotik.png|center|600px|thumb]]

==Setup Router Mikrotik Biasa==

/ip dhcp-client print
/ip dhcp-client add interface=ether1 disable=no
/interface bridge
add name=bridge1
/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
add bridge=bridge1 interface=ether6
add bridge=bridge1 interface=ether7
add bridge=bridge1 interface=ether8
/ip address add interface=bridge1 address=192.168.100.1/24
/ip route add gateway=bridge1
/ip dns set servers=1.1.1.1
/ip dns set allow-remote-request=yes
/ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade
/ip firewall nat print
/ip dhcp-server setup

==Certificate==

===Certificate Generate===

/certificate
add name=ca-template common-name=example.com days-valid=3650 key-size=2048 key-usage=crl-sign,key-cert-sign
add name=server-template common-name=*.example.com days-valid=3650 key-size=2048 key-usage=digital-signature,key-encipherment,tls-server
add name=client-template common-name=client.example.com days-valid=3650 key-size=2048 key-usage=tls-client
add name=client1-template common-name=client1.example.com days-valid=3650 key-size=2048 key-usage=tls-client

===Certificate Sign===

'''SATU PER SATU''', jangan COPAS Sekaligus. Proses signing akan membutuhkan waktu, harap sabar.

/certificate
sign ca-template name=ca-certificate
sign server-template name=server-certificate ca=ca-certificate
sign client-template name=client-certificate ca=ca-certificate
sign client1-template name=client1-certificate ca=ca-certificate

===Certificate Trust===

/certificate
set ca-certificate trusted=yes
set server-certificate trusted=yes

===Certificate Export===

/certificate
export-certificate ca-certificate export-passphrase=""
export-certificate client-certificate export-passphrase=123456789
export-certificate client1-certificate export-passphrase=123456789

Cek bahwa sudah di generate menggunakan

/file print

==OpenVPN Server di Mikrotik==

===OpenVPN Pool Address===

/ip
pool add name="vpn-pool" ranges=192.168.8.10-192.168.8.99

===OpenVPN user===

/ppp
profile add name="vpn-profile" use-encryption=yes local-address=192.168.8.250 dns-server=192.168.8.250 remote-address=vpn-pool
secret add name=user profile=vpn-profile password=123456
secret add name=user1 profile=vpn-profile password=123456
secret add name=user2 profile=vpn-profile password=123456
secret add name=onno profile=vpn-profile password=123456

===OpenVPN Enable===

/interface ovpn-server server
set default-profile=vpn-profile certificate=server-certificate require-client-certificate=yes auth=sha1 cipher=aes128,aes192,aes256 enabled=yes

==Set Firewall Mikrotik==

Jika dibutuhkan kita bisa buka access port 1194

/ip firewall filter
add chain=input protocol=tcp dst-port=1194 action=accept place-before=0 comment="Allow OpenVPN"

atau

/ip firewall filter
add chain=input protocol=tcp dst-port=1194 action=accept comment="Allow OpenVPN"

==PC Kali Linux==

===Download crt & key===

cd /etc/openvpn/client

ftp (IP OpenVPN Mikrotik) 192.168.0.219
username admin
password
mget *
quit

===Edit client.ovpn===

cd /etc/openvpn/client
vi client.ovpn

client
dev tun
proto tcp
# remote (IP Mikrotik OpenVPN) 1194
remote 192.168.0.219 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/client/cert_export_ca-certificate.crt
cert /etc/openvpn/client/cert_export_client-certificate.crt
key /etc/openvpn/client/cert_export_client-certificate.key
remote-cert-tls server
cipher AES-256-CBC
auth SHA1
auth-user-pass
route 192.168.100.0 255.255.255.0 # Paksakan routing di belakang Mikrotik

===PC Run OpenVPN===

cd /etc/openvpn/client
sudo openvpn --config client.ovpn

Enter Auth Username: user
Enter Auth Password: 123456
Enter Private Key Password: 123456789

===Interface tun tambahan===

Di CLI Kali Linux, ketik

ifconfig

Jika OpenVPN Berhasil di aktifkan, akan muncul

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1500
inet 192.168.8.99 netmask 255.255.255.0 destination 192.168.8.99
inet6 fe80::959a:7bd0:a3f3:3cc6 prefixlen 64 scopeid 0x20<link>
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 500 (UNSPEC)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 22 bytes 2384 (2.3 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

===Tambahkan Routing ke LAN di Belakang Mikrotik===

route add -net 192.168.100.0/24 gw 192.168.8.250 dev tun0

==PC Client==

===PC Download File===

Bisa di download ke PC / client menggunakan ftp, file yang dibutuhkan adalah

cert_export_ca-certificate.crt
cert_export_client-certificate.crt
cert_export_client-certificate.key

Nantinya bisa di rename menjadi

ca.crt, client.crt, & client.key

dengan ftp

cd /etc/openvpn/client
ftp 192.168.88.198
username admin
password

mget *
quit

cd /etc/openvpn/client
mv cert_export_ca-certificate.crt ca.crt
mv cert_export_client1-certificate.crt client1.crt
mv cert_export_client1-certificate.key client1.key
mv cert_export_client-certificate.crt client.crt
mv cert_export_client-certificate.key client.key

===PC Buat Konfigurasi ovpn===

Buat client.ovpn

cd /etc/openvpn/client/
sudo vi client.ovpn

client
dev tun
proto tcp
# remote (IP OpenVPN Mikrotik) 1194
remote 192.168.0.219 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
remote-cert-tls server
cipher AES-128-CBC
auth SHA1
auth-user-pass
# redirect-gateway def1

===PC Run OpenVPN===

cd /etc/openvpn/client
sudo openvpn --config client.ovpn

Enter Auth Username: user
Enter Auth Password: password
Enter Private Key Password: 12345678

===PC Cek===

Pastikan ada interface tun

ifconfig

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1500
inet 192.168.8.99 netmask 255.255.255.0 destination 192.168.8.99
inet6 fe80::76b3:bffd:1b3a:b9ea prefixlen 64 scopeid 0x20<link>
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (UNSPEC)
RX packets 1275 bytes 1208481 (1.2 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 1328 bytes 148649 (148.6 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

Pastikan ada routing

netstat -nr

192.168.8.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0

==Ubah client.key==

Langkah yang sedikit mengganggu adalah meminta kata private key password (selain username/password). Mikrotik tidak mengizinkan export key tanpa itu tapi untungnya kita bisa menggunakan OpenSSL untuk mengubahnya:

openssl rsa -in client.key -out client.key

Enter pass phrase for cert_export_client1.key:
writing RSA key

Teknik ini bisa di coba2, tampaknya kita tetap harus memasukan username/password/private key password.

==Referensi==

* https://www.medo64.com/2016/12/simple-openvpn-server-on-mikrotik/