IPv6: OpenVPN: Ubuntu roadwarrior: Difference between revisions

From OnnoCenterWiki
Jump to navigationJump to search
← Older edit
Onnowpurbo (talk | contribs)
69,477 edits
Onnowpurbo (talk | contribs)
69,477 edits
Onnowpurbo (talk | contribs)
69,477 edits
 
(19 intermediate revisions by the same user not shown)
Line 2: Line 2:




OpenVPN is very popular open-source software application that implements virtual private networks (VPN). It uses a custom security protocol that utilizes SSL/TLS for key exchange. We very often configure only IPv4 for the VPN service. But if you have IPv6, why not enable it for VPN?
Aplikasi open source untuk mengimplementasi Virtual Private Network (VPN) yang cukup populer adalah OpenVPN. OpenVPN menggunakan protocol SSL / TLS untuk mempertukarkan kunci. Pada kesempatan ini akan di terangkan cara mengaktifkan OpenVPN untuk IPv6.


First, let’s quickly see how can we install OpenVPN in an Ubuntu server; we will then enable IPv6.
==Contoh Topology==


1. Install OpenVPN
Jaringan dibuat di GNS3 menggunakan NAT (192.168.122.1), 2 Server 202.x.x.x satu berfungsi sebagai client, satu lagi berfungsi sebagai server.


In this example, I am using an OpenVPN road warrior installer. Download the initial script and run the command:


$ wget https://git.io/vpn -O openvpn-install.sh
2222::/64 -- B Client 10.10.10.2 --  10.10.10.1 A Server  ---- NAT 192.168.122.1


$ sudo bash openvpn-install.sh
==Konfigurasi Jaringan==


You need to define the external IP address on which you will run the service:
===Server A===


a. External IP address on which you will run the service
dhclient enp0s3
b. Port No
ifconfig enp0s8 10.10.10.1 netmask 255.255.255.0
c. DNS you want to use
ip addr add 2001::1/64 dev enp0s3


This will create the necessary certificates and create the first client.
echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
echo 1 > /proc/sys/net/ipv6/conf/default/forwarding
echo 1 > /proc/sys/net/ipv6/conf/enp0s3/forwarding
echo 1 > /proc/sys/net/ipv6/conf/enp0s8/forwarding
echo 1 > /proc/sys/net/ipv6/conf/tun0/forwarding


That’s it. Your OpenVPN server has been configured and is ready to use. You can see the added firewall rules /etc/rc.local file:
===Client B===


$ cat /etc/rc.local
ifconfig enp0s3 10.10.10.2 netmask 255.255.255.0
iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
ip addr add 2222::1/64 dev enp0s8
iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT
route add default gw 10.10.10.1
iptables -I INPUT -p udp --dport 1194 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to 203.0.113.10


Type the following command to start the OpenVPN service:
echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
echo 1 > /proc/sys/net/ipv6/conf/default/forwarding
echo 1 > /proc/sys/net/ipv6/conf/enp0s3/forwarding
echo 1 > /proc/sys/net/ipv6/conf/enp0s8/forwarding
echo 1 > /proc/sys/net/ipv6/conf/tun0/forwarding


$ sudo /etc/init.d/openvpn start
==Server: Instalasi OpenVPN==


The client certificate will be stored in the home directory.
Agar mudah kita menggunakan OpenVPN road warrior installer. Download dan jalankan script untuk instalasi menggunakan perintah


fakrul-apnic.ovpn
sudo su
rm /var/lib/dpkg/lock
apt update


To connect from MacOSX, you can use TunnelBlick.
cd /usr/local/src
wget https://git.io/vpn -O openvpn-install.sh
sudo bash openvpn-install.sh


To add a new client, run the openvpn-install.sh script. Choose option 1 to add a new client and the certificate will be stored in the home folder.
Beberapa informasi yang dibutuhkan


B. Enable IPv6
* IP address OpenVPN:
* Public IP address / hostname:
* Protocol UDP / TCP
* Port: 1194 (UDP)
* DNS: Google
* Client name: coba1


Now let’s enable IPv6. For the configuration I am using IP 2001:db8:ee00:ee00::10/64 for the VPN server.
Jika OpenVPN serve telah di konfigurasi dan siap pakai. Akan tampak di rules firewall di /etc/rc.local kira-kira


2001:db8:ee00:abcd::/64 has been routed to the OpenVPN server host. That mean users connected via OpenVPN will get an address from 2001:db8:ee00:abcd::/64
$ cat /etc/rc.local
# iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
# iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT
# iptables -I INPUT -p udp --dport 1194 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24-j SNAT --to 10.10.10.1


Step 1: We need to edit the OpenVPN configuration file and enable IPv6 tunnel service
Jalankan OpenVPN, ketik


vi /etc/openvpn/server.conf
sudo /etc/init.d/openvpn start


Add the following:
Sertifikat client di simpan di home directory supaya mudah di ambil,


server-ipv6 2001:0db8:ee00:abcd::/64
mv /root/coba1.ovpn /home/onno/coba1.ovpn
tun-ipv6
chmod -Rf 777 /home/onno/coba1.ovpn
push tun-ipv6
chown -Rf onno: /home/onno/coba1.ovpn
ifconfig-ipv6 2001:0db8:ee00:abcd::1 2001:0db8:ee00:abcd::2
push "route-ipv6 2001:0db8:ee00:ee00::2/64"
push "route-ipv6 2000::/3"


Step 2: Enable IPv6 forwarding:
==AKtifkan IPv6==


echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
Interface tun0 di server biasanya


Step 3: Reload OpenVPN Service
tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.8.0.1  netmask 255.255.255.0  destination 10.8.0.1
        inet6 fe80::4d06:4709:ba3f:7120  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 6  bytes 288 (288.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0


sudo /etc/init.d/openvpn restart
Langkah selanjutnya adalah mengaktifkan IPv6.


Try to connect your OpenVPN client.
Misalnya,


From the Tunnelblick log you can verify the IP addresses:
* IPv6 Server : 2001::1/64
* IPv6 Routed : 2222::/59 (ada 32 network /64)


Test the IPv6 reachability by accessing http://test-ipv6.com/
Edit server.conf
 
vi /etc/openvpn/server.conf


Note:
Tambahkan:
1. To make IPv6 forwarding persistent, remember to uncomment in /etc/sysctl.conf:


net.ipv6.conf.all.forwarding = 1
server-ipv6 2001::1/64
tun-ipv6
push tun-ipv6
ifconfig-ipv6 2222::1 2222::2
push "route-ipv6 2222::2/59"
push "route-ipv6 2000::/3"


2. Make sure that you route 2001:db8:ee00:abcd::/64 to your OpenVPN Server. I have done this from my Cisco router:
Reload OpenVPN Service


ipv6 route 2001:db8:ee00:abcd::/64 2001:db8:ee00:ee00::10
sudo /etc/init.d/openvpn restart


So you now have native IPv6 and can access all IPv6-enabled services. As a roaming user, it will give you better security.
==Client==


Install openvpn


echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
echo 1 > /proc/sys/net/ipv6/conf/default/forwarding
echo 1 > /proc/sys/net/ipv6/conf/enp0s3/forwarding
echo 1 > /proc/sys/net/ipv6/conf/enp0s8/forwarding


rm /var/lib/dpkg/lock
apt update
apt install openvpn


Download file .ovpn client. Coba sambungkan


openvpn --config coba1.ovpn
Test the IPv6 reachability by accessing http://test-ipv6.com/


==Referensi==
==Referensi==
Line 97: Line 138:
==Pranala Menarik==
==Pranala Menarik==


* [[OpenVPN]]
* [[OpenVPN: IPv4 /32 single client]]
* [[IPv6]]
* [[OpenVPN: IPv4 /32 multi-client]]
* [[OpenVPN: IPv4 routed LAN]]
* [[OpenVPN: IPv4 routed 2 LAN]]
* [[OpenVPN: IPv6 /128 single client]]
* [[OpenVPN: IPv6 routed LAN]]
* [[OpenVPN: IPv6 routed 2 LAN]]
 
* [[IPv6: OpenVPN: Ubuntu roadwarrior]]
* [[OpenVPN: Simple Server using Script]]
* [[OpenVPN: Free VPN untuk Ubuntu]]
* [[Instalasi OpenVPN]]
* [[Instalasi OpenVPN Client di Linux]]
* [[Capture Screen Proses Instalasi OpenVPN di Windows]]
* [[Instalasi OpenVPN di Windows]]
* [[WNDW: OpenVPN]]
* [[OpenVPN: Instalasi di Ubuntu 16.04]]
* [[OpenVPN: Instalasi di Ubuntu 18.04]]
* [[OpenVPN: Briding dan Routing]]

Latest revision as of 01:19, 31 March 2020

sumber: https://blog.apnic.net/2017/06/09/using-openvpn-ipv6/


Aplikasi open source untuk mengimplementasi Virtual Private Network (VPN) yang cukup populer adalah OpenVPN. OpenVPN menggunakan protocol SSL / TLS untuk mempertukarkan kunci. Pada kesempatan ini akan di terangkan cara mengaktifkan OpenVPN untuk IPv6.

Contoh Topology

Jaringan dibuat di GNS3 menggunakan NAT (192.168.122.1), 2 Server 202.x.x.x satu berfungsi sebagai client, satu lagi berfungsi sebagai server. 


2222::/64 -- B Client 10.10.10.2 --  10.10.10.1 A Server  ---- NAT 192.168.122.1

Konfigurasi Jaringan

Server A

dhclient enp0s3
ifconfig enp0s8 10.10.10.1 netmask 255.255.255.0
ip addr add 2001::1/64 dev enp0s3

echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
echo 1 > /proc/sys/net/ipv6/conf/default/forwarding
echo 1 > /proc/sys/net/ipv6/conf/enp0s3/forwarding
echo 1 > /proc/sys/net/ipv6/conf/enp0s8/forwarding
echo 1 > /proc/sys/net/ipv6/conf/tun0/forwarding

Client B

ifconfig enp0s3 10.10.10.2 netmask 255.255.255.0
ip addr add 2222::1/64 dev enp0s8
route add default gw 10.10.10.1

echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
echo 1 > /proc/sys/net/ipv6/conf/default/forwarding
echo 1 > /proc/sys/net/ipv6/conf/enp0s3/forwarding
echo 1 > /proc/sys/net/ipv6/conf/enp0s8/forwarding
echo 1 > /proc/sys/net/ipv6/conf/tun0/forwarding

Server: Instalasi OpenVPN

Agar mudah kita menggunakan OpenVPN road warrior installer. Download dan jalankan script untuk instalasi menggunakan perintah 

sudo su
rm /var/lib/dpkg/lock
apt update

cd /usr/local/src
wget https://git.io/vpn -O openvpn-install.sh
sudo bash openvpn-install.sh

Beberapa informasi yang dibutuhkan

  • IP address OpenVPN:
  • Public IP address / hostname:
  • Protocol UDP / TCP
  • Port: 1194 (UDP)
  • DNS: Google
  • Client name: coba1

Jika OpenVPN serve telah di konfigurasi dan siap pakai. Akan tampak di rules firewall di /etc/rc.local kira-kira 

$ cat /etc/rc.local
# iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
# iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT
# iptables -I INPUT -p udp --dport 1194 -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24-j SNAT --to 10.10.10.1

Jalankan OpenVPN, ketik 

sudo /etc/init.d/openvpn start

Sertifikat client di simpan di home directory supaya mudah di ambil, 

mv /root/coba1.ovpn /home/onno/coba1.ovpn
chmod -Rf 777 /home/onno/coba1.ovpn
chown -Rf onno: /home/onno/coba1.ovpn

AKtifkan IPv6

Interface tun0 di server biasanya 

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.8.0.1  netmask 255.255.255.0  destination 10.8.0.1
        inet6 fe80::4d06:4709:ba3f:7120  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 6  bytes 288 (288.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Langkah selanjutnya adalah mengaktifkan IPv6.

Misalnya,

  • IPv6 Server : 2001::1/64
  • IPv6 Routed : 2222::/59 (ada 32 network /64)

Edit server.conf 

vi /etc/openvpn/server.conf

Tambahkan: 

server-ipv6 2001::1/64
tun-ipv6
push tun-ipv6
ifconfig-ipv6 2222::1 2222::2
push "route-ipv6 2222::2/59"
push "route-ipv6 2000::/3"

Reload OpenVPN Service 

sudo /etc/init.d/openvpn restart

Client

Install openvpn 

echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
echo 1 > /proc/sys/net/ipv6/conf/default/forwarding
echo 1 > /proc/sys/net/ipv6/conf/enp0s3/forwarding
echo 1 > /proc/sys/net/ipv6/conf/enp0s8/forwarding

rm /var/lib/dpkg/lock
apt update
apt install openvpn

Download file .ovpn client. Coba sambungkan 

openvpn --config coba1.ovpn

Test the IPv6 reachability by accessing http://test-ipv6.com/

Referensi

Pranala Menarik

Retrieved from "https://lms.onnocenter.or.id/wiki/index.php?title=IPv6:_OpenVPN:_Ubuntu_roadwarrior&oldid=60664"