Quelltext der Seite Potsdam-VPN

Das Potsdam-VPN ist ein Intra-City-VPN, das dazu dient, Inseln zusammenzuführen.

__TOC__

== Client einrichten ==
== Server aufsetzen ==
=== Keys generieren ===
=== OpenVPN einrichten ===
* apt-get install openvpn
* kopieren von ca.crt, dh2048.pem, <span style="color:red">$server$</span>.crt, <span style="color:red">$server$</span>.key nach /etc/openvpn/freifunk-potsdam/
* vim /etc/openvpn/pdmvpn.conf
 port 1195
 mode server
 proto udp
 dev tap0
 
 ca /etc/openvpn/freifunk-potsdam/ca.crt
 cert /etc/openvpn/freifunk-potsdam/<span style="color:red">$server$</span>.crt
 key /etc/openvpn/freifunk-potsdam/<span style="color:red">$server$</span>.key
 dh /etc/openvpn/freifunk-potsdam/dh2048.pem
 
 server 172.22.25<span style="color:red">X</span>.0 255.255.255.0
 
 client-config-dir /etc/openvpn/ccd
 
 topology subnet
 
 keepalive 60 240
 
 comp-lzo no
 cipher none
 
 user nobody
 group nogroup
 
 persist-key
 persist-tun
 
 log         /var/log/openvpn-pdmvpn-1195.log
 log-append  /var/log/openvpn-pdmvpn-1195.log
 
 verb 3

=== N2N für Server-zu-Server Kommunikation ===
mit N2N bilden wir ein P2P-VPN zwischen den verschiedenen Servern
* apt-get install n2n
* mindestens eine Supernode wird benötigt, um eine initiale Verbindung zum P2P-VPN herzustellen
 supernode -l 7654 -v
* Verbindung zum P2P-VPN herstellen
 N2N_KEY="***key***" edge -b -f -d n2n0 -c pdmvpn -u 99 -g 99 -m CA:FF:EE:BA:BE:0<span style="color:red">X</span> -a 172.22.250.<span style="color:red">X</span> -l vpn.freifunk-potsdam.de:7654

=== OLSR kompilieren und installieren ===
# apt-get install git build-essential bison flex libgps-dev
# git clone -b drophna_plugin https://github.com/seth0r/olsrd.git
# cd olsrd/
# make && make libs && make install && make libs_install
# vim /etc/olsrd/olsrd.conf

 RtTable         111
 RtTableDefault  112
 
 #RtTableTunnel   113
 #RtTableTunnelPriority 100000
 SmartGateway no
 SmartGatewayUplink "none"
 
 DebugLevel      0
 
 Interface "tap0"
 {
    Mode    "ether"
    Ip4Broadcast                255.255.255.255
    LinkQualityMult             default 0.25
 
    HelloInterval               3.0
    HelloValidityTime           125.0
    TcInterval                  2.0
    TcValidityTime              500.0
    MidInterval                 25.0
    MidValidityTime             500.0
    HnaInterval                 10.0
    HnaValidityTime             125.0
 }
 
 Interface "n2n0"
 {
    Mode    "ether"
    Ip4Broadcast                255.255.255.255
    LinkQualityMult             default 1.0
 
    HelloInterval               3.0
    HelloValidityTime           125.0
    TcInterval                  2.0
    TcValidityTime              500.0
    MidInterval                 25.0
    MidValidityTime             500.0
    HnaInterval                 10.0
    HnaValidityTime             125.0
 }
 
 Hna4
 {
    172.22.250.0    255.255.255.0
    172.22.25<span style="color:red">X</span>.0    255.255.255.0
 }
 
 LinkQualityFishEye 1
 LinkQualityAlgorithm "etx_ffeth"
 IpVersion       4
 ClearScreen     yes
 AllowNoInt      yes
 Willingness     3
 UseHysteresis   no
 LinkQualityLevel        2
 Pollrate        0.1
 TcRedundancy    2
 MprCoverage     5
 
 LoadPlugin "olsrd_jsoninfo.so.1.1"
 {
        PlParam "Port" "8080"
 }
 
 LoadPlugin "olsrd_nameservice.so.0.4"
 {
    PlParam "name" "pdmvpn<span style="color:red">X</span>"
    PlParam "suffix" ".olsr"
    PlParam "hosts-file" "/tmp/hosts.olsr"
 }
 
 LoadPlugin "olsrd_drophna.so.0.0.0"
 {
 }
=== Routing und Firewall ===
* apt-get install iproute iptables-persistent
* vim /etc/iproute2/rt_tables
 110     pdmvpn
 111     olsr
 112     olsr-default
 113     olsr-tunnel
* Forwarding aktivieren (wird nach Neustart aktiv)<br>vim /etc/sysctl.conf
 net.ipv4.conf.default.rp_filter=1
 net.ipv4.conf.all.rp_filter=1
 net.ipv4.tcp_syncookies=1
 net.ipv4.ip_forward=1
* iptables chans anlegen
 iptabels -N INFF
 iptables -N FF
* iptables rules einrichten
 iptables -A INPUT -i tap0 -j INFF
 iptables -A INPUT -i n2n0 -j INFF
 
 iptables -A INFF -p udp -m udp --dport 698 -j ACCEPT
 iptables -A INFF -p icmp -j ACCEPT
 iptables -A INFF -j LOG
 iptables -A INFF -j DROP
 
 iptables -A FORWARD -i tap0 -j FF
 iptables -A FORWARD -i n2n0 -j FF
 iptables -A FF -o tap0 -j ACCEPT
 iptables -A FF -o n2n0 -j ACCEPT
 
 iptables -A INPUT -i eth0 -p udp -m udp --dport 1195 -j ACCEPT
 iptables -A INPUT -i eth0 -p udp -m udp --dport 7654 -j ACCEPT