Moxa Technologies UC-8100-LX, Руководство пользователя программного обеспечения, Страница: 61 / 90

UC-8100-LX Software Manual General Debian Package Usage
5-17
OpenVPN support user/pass, pre-shared key, certificates etc. to authenticate users To begin with, check to
make sure that the system has a virtual device
/dev/net/tun .
An Ethernet bridge is used to connect different Ethernet networks together. The Ethernets are bundled into one
bigger, “logical” Ethernet. Each Ethernet corresponds to one physical interface (or port) that is connected to the
bridge.
# modprobe tun
On each OpenVPN machine, you should generate a working directory, such as /etc/openvpn , where script
files and key files reside. Once established, all operations will be performed in that directory.
OpenVPN daemon has been installed but disabled by default.
Enable openvpn manually sudo /etc/init.d/openvpn start
Disable openvpn manually sudo /etc/init.d/openvpn stop
Enable openvpn insserv -d openvpn
Disable openvpn insserv -r openvpn
104B
Static-Key VPN
In the server's /etc/openvpn directory, run the following command to generate a static key
moxa@Moxa:/etc/openvpn$ sudo openvpn --genkey --secret static.key
Copy this static key to the clients /etc/openvpn directory using a secure channel like scp or sftp.
On the server, create a new /etc/openvpn/tun0.conf file and add the following:
dev tun0
ifconfig 10.9.8.1 10.9.8.2
secret /etc/openvpn/static.key
Where 10.9.8.x is your VPN subnetwork, 10.9.8.1 will be IP of the server, 10.9.8.2 is IP of client.
On the client, copy /etc/openvpn/static.key from server and create a new /etc/openvpn/tun0.conf file and add
the following:
remote your-server.org
dev tun0
ifconfig 10.9.8.2 10.9.8.1
secret /etc/openvpn/static.key
Start OpenVPN by hand on both sides with the following command
moxa@Moxa:/etc/openvpn$ sudo openvpn --config /etc/openvpn/tun0.conf --verb 6 //
verbose output.
ATTENTION
Firewall should create policy for OpenVPN-related application
On the server's firewall, open up UDP 1194 (default port). If you are using ?shorewall, on both devices, add a
new VPN zone to represent tun0 and create a default policy for it. This means adding something to the following
files in /etc/shorewall:
zone
interfaces
policy
Bear in mind that 90% of all connection problems encountered by new OpenVPN users are firewall-related.
NOTE Click the following links for more information on OpenVPN.
https://wiki.debian.org/OpenVPN
http://openvpn.net/