Como configurar o Softehter VPN Client no Linux: Via vpngate.net
Procedimento de configuração do cliente no Linux
- Download do cliente VPN de softether.org
- Minha plataforma é Debian 7 X64
- compile o cliente vpn em sua plataforma no diretório cliente vpn não compactado
- basta digitar "fazer" e aceitar todos os contratos de licença e você deve ser O.K.
- inicie o serviço vpnclient como raiz
- conecte-se ao vpnclient local usando "vpncmd" (modo de usuário normal, sem privilégios de root necessários "), crie uma NIC virtual local.
vpncmd
VPN Client>remoteenable
RemoteEnable command - Allow Remote Management of VPN Client Service
The command completed successfully.
VPN Client>niccreate
NicCreate command - Create New Virtual Network Adapter
Virtual Network Adapter Name: se
The command completed successfully.
VPN Client>niclist
NicList command - Get List of Virtual Network Adapters
Item |Value
----------------------------+-----------------------------------
Virtual Network Adapter Name|se
Status |Enabled
MAC Address |00ACDD071970
Version |Version 2.00 Build 9387 (English)
The command completed successfully.
-
vá para "vpngate.net", encontre um servidor vpn apropriado
-
Configure uma conta vpn no vpncmd.
Eu exporto o arquivo de configuração da conta vpn abaixo, você pode adaptá-lo para sua necessidade.
VPN Client>accountimport
AccountImport command - Import VPN Connection Setting
Import Source File Name: /home/luke/japan0.vpn
The VPN Connection Setting "japan0" was imported.
The command completed successfully.
VPN Client>accountget japan0
AccountGet command - Get Setting of VPN Connection Setting
Item |Value
-----------------------------------------------------+------------------------
VPN Connection Setting Name |japan0
Destination VPN Server Host Name |222.228.120.128
Destination VPN Server Port Number |1950
Destination VPN Server Virtual Hub Name |vpngate
Proxy Server Type |Direct TCP/IP Connection
Verify Server Certificate |Disable
Device Name Used for Connection |se
Authentication Type |Anonymous Authentication
User Name |vpn
Number of TCP Connections to Use in VPN Communication|1
Interval between Establishing Each TCP Connection |1
Connection Life of Each TCP Connection |Infinite
Use Half Duplex Mode |Disable
Encryption by SSL |Enable
Data Compression |Disable
Connect by Bridge / Router Mode |Disable
Connect by Monitoring Mode |Disable
No Adjustment for Routing Table |Disable
Do not Use QoS Control Function |Disable
The command completed successfully.
VPN Client>accountlist
AccountList command - Get List of VPN Connection Settings
Item |Value
----------------------------+-----------------------------------------------
VPN Connection Setting Name |japan0
Status |Offline
VPN Server Hostname |222.228.120.128:1950 (Direct TCP/IP Connection)
Virtual Hub |vpngate
Virtual Network Adapter Name|se
The command completed successfully.
VPN Client>accountconnect japan0
AccountConnect command - Start Connection to VPN Server using VPN Connection Setting
The command completed successfully.
VPN Client>accountlist
AccountList command - Get List of VPN Connection Settings
Item |Value
----------------------------+-----------------------------------------------
VPN Connection Setting Name |japan0
Status |Connected
VPN Server Hostname |222.228.120.128:1950 (Direct TCP/IP Connection)
Virtual Hub |vpngate
Virtual Network Adapter Name|se
The command completed successfully.
o arquivo de exportação da conta "/home/luke/japan0.vpn":
# VPN Client VPN Connection Setting File
#
# This file is exported using the VPN Client Manager.
# The contents of this file can be edited using a text editor.
#
# When this file is imported to the Client Connection Manager
# it can be used immediately.
declare root
{
bool CheckServerCert false
uint64 CreateDateTime 0
uint64 LastConnectDateTime 0
bool StartupAccount false
uint64 UpdateDateTime 0
declare ClientAuth
{
uint AuthType 0
string Username vpn
}
declare ClientOption
{
string AccountName japan0
uint AdditionalConnectionInterval 1
uint ConnectionDisconnectSpan 0
string DeviceName se
bool DisableQoS false
bool HalfConnection false
bool HideNicInfoWindow false
bool HideStatusWindow false
string Hostname 222.228.120.128
string HubName vpngate
uint MaxConnection 1
bool NoRoutingTracking false
bool NoTls1 false
bool NoUdpAcceleration false
uint NumRetry 4294967295
uint Port 1950
uint PortUDP 0
string ProxyName $
byte ProxyPassword $
uint ProxyPort 0
uint ProxyType 0
string ProxyUsername $
bool RequireBridgeRoutingMode false
bool RequireMonitorMode false
uint RetryInterval 15
bool UseCompress false
bool UseEncrypt true
}
}
- Agora a conta vpn está conectada. No Linux, a tabela de roteamento não é modificada automaticamente como no Windows. Precisamos ajustar manualmente as informações de roteamento para que o SoftEther VPN funcione.
- O ponto chave aqui é: DHCP a NIC virtual para obter o IP virtual do servidor VPN; adicione uma rota ao servidor VPN através do seu gateway normal original e modifique a rota padrão para usar a VPN NIC e o gateway da VPN (o endereço virtual).
Antes de ajustarmos a tabela de roteamento, habilite o ip forward em "/etc/sysctl.conf"
net.ipv4.ip_forward=1
e carregue-o por:
sysctl -p
Agora vamos mudar a tabela de roteamento.
luke@luke-debian:~$ ip addr show vpn_se
10: vpn_se: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 500
link/ether 00:ac:dd:07:19:70 brd ff:ff:ff:ff:ff:ff
inet6 fe80::2ac:ddff:fe07:1970/64 scope link
valid_lft forever preferred_lft forever
luke@luke-debian:~$ sudo dhclient vpn_se
luke@luke-debian:~$ ip addr show vpn_se
10: vpn_se: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 500
link/ether 00:ac:dd:07:19:70 brd ff:ff:ff:ff:ff:ff
inet 10.211.1.63/16 brd 10.211.255.255 scope global vpn_se
inet6 fe80::2ac:ddff:fe07:1970/64 scope link
valid_lft forever preferred_lft forever
luke@luke-debian:~$ ip neigh
192.168.100.1 dev wlan0 lladdr 00:1c:f0:4d:a0:a8 REACHABLE
10.211.254.254 dev vpn_se lladdr 00:ac:50:16:c8:27 REACHABLE
172.31.224.99 dev vpn_se lladdr 00:ae:df:62:34:d9 STALE
Após o processo dhcp, vpn_se adquire um endereço IP virtual "inet 10.211.1.63/16" do servidor vpn, e podemos ver em "ip neigh" que o endereço IP virtual do servidor vpn é "10.211.254.254".
Agora vamos adicionar duas rotas para facilitar todo o tráfego por meio da nova VPN de criação. Meu laptop está conectado ao roteador 192.168.100.1 via wireless "wlan0".
$ ip route
default via 192.168.100.1 dev wlan0
10.211.0.0/16 dev vpn_se proto kernel scope link src 10.211.1.63
169.254.0.0/16 dev wlan0 scope link metric 1000
172.16.125.0/24 dev vmnet1 proto kernel scope link src 172.16.125.1
192.168.86.0/24 dev vmnet8 proto kernel scope link src 192.168.86.1
192.168.100.0/24 dev wlan0 proto kernel scope link src 192.168.100.101
$ sudo ip route add 222.228.120.128/32 via 192.168.100.1 dev wlan0
$ sudo ip route del default
$ sudo ip route add default via 10.211.254.254 dev vpn_se
$ ip route show
default via 10.211.254.254 dev vpn_se
10.211.0.0/16 dev vpn_se proto kernel scope link src 10.211.1.63
192.168.100.0/24 dev wlan0 proto kernel scope link src 192.168.100.101
222.228.120.128 via 192.168.100.1 dev wlan0
luke@luke-debian:~$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_req=1 ttl=47 time=263 ms
64 bytes from 8.8.8.8: icmp_req=2 ttl=47 time=270 ms
^C
--- 8.8.8.8 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 263.462/266.788/270.114/3.326 ms
$ ping youtube.com
PING youtube.com (74.125.235.201) 56(84) bytes of data.
64 bytes from kix01s01-in-f9.1e100.net (74.125.235.201): icmp_req=1 ttl=55 time=209 ms
64 bytes from kix01s01-in-f9.1e100.net (74.125.235.201): icmp_req=2 ttl=55 time=214 ms
64 bytes from kix01s01-in-f9.1e100.net (74.125.235.201): icmp_req=3 ttl=55 time=253 ms
64 bytes from kix01s01-in-f9.1e100.net (74.125.235.201): icmp_req=4 ttl=55 time=207 ms
luke@luke-debian:~$ traceroute 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
1 * * *
2 * * *
3 * * *
4 * * *
5 * * *
6 *^C
Depois que a rota é configurada corretamente, podemos ver que o roteamento padrão foi direcionado para o túnel VPN. Podemos confirmar isso a partir da saída do "traceroute", já que nem todos os saltos podem ser exibidos.
Um script bash economizará muita digitação.
$ cat /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo
iface lo inet loopback
auto-hotplug vpn_se
iface vpn_se inet dhcp
$ cat route.sh
#!/bin/bash
if [ "x$2" == "x" ];
then
echo "vpn server ip missing! ./route.sh add/del vpn_server_ip "
else
case "$1" in
add)
# restore default route to home network
ip route delete default
ip route add default via 192.168.100.1 dev wlan0
# obtain ip address for vpn_se
ifdown vpn_se
ifup vpn_se
# add route to vpn server
ip route add $2/32 via 192.168.100.1 dev wlan0
ip route delete default
ip route add default via 10.211.254.254 dev vpn_se
;;
del)
ip route del $2/32
ip route del default
ip route add default via 192.168.100.1 dev wlan0
ifdown vpn_se
;;
esac
fi