基于Mikrotik的RouterOS路由搭建OpenVPN服务

  • A+
所属分类:RouteOS  软路由

使用telnet 远程登录我的ROS系统

[admin@DTOPS-OVH-SG-Router-Node1] > quitConnection closed by foreign host.
[lookback@LookBack-MacBookPro ~]$ telnet 139.99.18.81 2301
[lookback@LookBack-MacBookPro ~]$ telnet 139.99.18.81 2301
Trying 139.99.18.81...
Connected to ip81.ip-139-99-18.net.
Login failed, incorrect username or password

Login: admin
   ape character is '^]'.                                                                                                                                                                                                                                                                                                                                    Password: 

  MMM      MMM       KKK                          TTTTTTTTTTT      KKK
  MMMM    MMMM       KKK                          TTTTTTTTTTT      KKK
  MMM MMMM MMM  III  KKK  KKK  RRRRRR     OOOOOO      TTT     III  KKK  KKK
  MMM  MM  MMM  III  KKKKK     RRR  RRR  OOO  OOO     TTT     III  KKKKK
  MMM      MMM  III  KKK KKK   RRRRRR    OOO  OOO     TTT     III  KKK KKK
  MMM      MMM  III  KKK  KKK  RRR  RRR   OOOOOO      TTT     III  KKK  KKK

  MikroTik RouterOS 6.43.2 (c) 1999-2018       http://www.mikrotik.com/

[?]             Gives the list of available commands
command [?]     Gives help on the command and list of arguments

[Tab]           Completes the command/word. If the input is ambiguous,
                a second [Tab] gives possible options

/               Move up to base level
..              Move up one level
/command        Use command at the base level

[admin@DTOPS-OVH-SG-Router-Node1] > 

为了做这个教程我把之前做好的环境都删除了

[admin@DTOPS-OVH-SG-Router-Node1] > /file pr
 # NAME                                                      TYPE                                 SIZE             CREATION-TIME       
 0 user-manager                                              directory                                             nov/19/2018 06:32:08
 1 user-manager/sqldb                                        file                                 80.0KiB          sep/30/2018 08:20:39
 2 user-manager/logsqldb                                     file                                 6.0KiB           sep/30/2018 08:20:39
 3 um-before-migration.tar                                   .tar file                            15.5KiB          sep/30/2018 08:20:39
 4 skins                                                     directory                                             jun/16/2018 12:06:32
 5 primary-slave                                             disk                                                  jun/16/2018 12:06:33
 6 autosupout.rif                                            .rif file                            647.0KiB         nov/15/2018 06:26:38
 7 auto-before-reset.backup                                  backup                               14.8KiB          sep/30/2018 08:20:29
 8 pub                                                       directory                                             nov/15/2018 06:26:35
 9 dhcp-6.43.4.npk                                           .npk file                            0                nov/19/2018 06:18:15
10 primary-slave/lost+found                                  directory                                             oct/18/2015 02:38:50
11 primary-slave/user-manager2                               user-manager store                                    sep/30/2018 08:15:35
[admin@DTOPS-OVH-SG-Router-Node1] > /ip pool print
 # NAME
 RANGES                         
 0 dhcp-pool-1            172.20.255.1-172.20.255.254,172.20.254.1-172.20.254.254    
[admin@DTOPS-OVH-SG-Router-Node1] > /interface ovpn-server print
Flags: X - disabled, D - dynamic, R - running 
 #     NAME                         USER       MTU CLIENT-ADDRESS     UPTIME   ENCODING  
[admin@DTOPS-OVH-SG-Router-Node1] >

首先我们来创建证书

[admin@DTOPS-OVH-SG-Router-Node1] > /certificate
[admin@DTOPS-OVH-SG-Router-Node1] /certificate> add name=ca-template common-name=ros-vpn-dtops.cc days-valid=3650 key-size=2048 key-usage=crl-sign,key-cert-sign
[admin@DTOPS-OVH-SG-Router-Node1] /certificate> add name=server-template common-name=*.ros-vpn-dtops.cc days-valid=3650 key-size=2048 key-usage=digital-signature,key-encipherment,tls-server
[admin@DTOPS-OVH-SG-Router-Node1] /certificate> add name=client-template common-name=client.ros-vpn-dtops.cc days-valid=3650 key-size=2048 key-usage=tls-client
[admin@DTOPS-OVH-SG-Router-Node1] /certificate> /

给创建好的证书签名

[admin@DTOPS-OVH-SG-Router-Node1] > /certificate
[admin@DTOPS-OVH-SG-Router-Node1] /certificate> sign ca-template name=ca-certificate
  progress: done
[admin@DTOPS-OVH-SG-Router-Node1] /certificate> sign server-template name=server-certificate ca=ca-certificate
  progress: done
[admin@DTOPS-OVH-SG-Router-Node1] /certificate> sign client-template name=client-certificate ca=ca-certificate
  progress: done
[admin@DTOPS-OVH-SG-Router-Node1] /certificate> /
[admin@DTOPS-OVH-SG-Router-Node1] >

开始对签好名的证书导出到文件

[admin@DTOPS-OVH-SG-Router-Node1] > /certificate
[admin@DTOPS-OVH-SG-Router-Node1] /certificate> export-certificate ca-certificate export-passphrase=""
[admin@DTOPS-OVH-SG-Router-Node1] /certificate> export-certificate client-certificate export-passphrase=12345678
[admin@DTOPS-OVH-SG-Router-Node1] /certificate> /
[admin@DTOPS-OVH-SG-Router-Node1] > 

创建一个OpenVPN拨号专用的ip池

[admin@DTOPS-OVH-SG-Router-Node1] > /ip pool add name="openvpn-pool" ranges=172.20.253.1-172.20.253.254

添加用于OpenVPN拨号用的账号

[admin@DTOPS-OVH-SG-Router-Node1] > /ppp profile add name="openvpn-profile" use-encryption=yes local-address=172.20.0.1 dns-server=139.99.18.82,139.99.115.58 remote-address=openvpn-pool
[admin@DTOPS-OVH-SG-Router-Node1] > /ppp secret add name=lookback password=lookback123 profile=openvpn-profile service=ovpn

启用OpenVPN服务

[admin@DTOPS-OVH-SG-Router-Node1] > /interface ovpn-server server set default-profile=openvpn-profile certificate=server-certificate require-client-certificate=yes auth=sha1 cipher=aes128,aes192,aes256 enabled=yes

添加防火墙方向OpenVPN服务

[admin@DTOPS-OVH-SG-Router-Node1] > /ip firewall filter add chain=input protocol=tcp dst-port=1194 action=accept place-before=0 comment="Allow OpenVPN"

下载证书文件
基于Mikrotik的RouterOS路由搭建OpenVPN服务

基于Mikrotik的RouterOS路由搭建OpenVPN服务

[lookback@LookBack-MacBookPro ~]$ ls Desktop/OpenVPN/
cert_export_ca-certificate.crt          cert_export_client-certificate.crt      cert_export_client-certificate.key

去除私钥密码
基于Mikrotik的RouterOS路由搭建OpenVPN服务

[lookback@LookBack-MacBookPro ~]$ openssl rsa -in Desktop/OpenVPN/cert_export_client-certificate.key -out Desktop/OpenVPN/cert_export_client-certificate2.key    
Enter pass phrase for Desktop/OpenVPN/cert_export_client-certificate.key:
writing RSA key
[lookback@LookBack-MacBookPro ~]$ ls Desktop/OpenVPN/
cert_export_ca-certificate.crt          cert_export_client-certificate.crt      cert_export_client-certificate.key      cert_export_client-certificate2.key
[lookback@LookBack-MacBookPro ~]$ 

制作OpenVPN配置文件:

[lookback@LookBack-MacBookPro ~]$ cat > Desktop/OpenVPN/139.99.18.81.ovpn <<EOF
client
dev tun
proto tcp
remote 139.99.18.81 1194
resolv-retry infinite
nobind
persist-key
persist-tun
#ca ca.crt
#cert client.crt
#key client.key
remote-cert-tls server
cipher AES-128-CBC
auth SHA1
auth-user-pass
redirect-gateway def1
verb 3

<ca>
$(cat Desktop/OpenVPN/cert_export_ca-certificate.crt)
</ca>

<cert>
$(cat Desktop/OpenVPN/cert_export_client-certificate.crt)
</cert>

<key>
$(cat Desktop/OpenVPN/cert_export_client-certificate2.key)
</key>

EOF
[lookback@LookBack-MacBookPro ~]$ cat Desktop/OpenVPN/139.99.18.81.ovpn
client
dev tun
proto tcp
remote 139.99.18.81 1194
resolv-retry infinite
nobind
persist-key
persist-tun
#ca ca.crt
#cert client.crt
#key client.key
remote-cert-tls server
cipher AES-128-CBC
auth SHA1
auth-user-pass
redirect-gateway def1
verb 3

<ca>
-----BEGIN CERTIFICATE-----
MIIDIDCCAgigAwIBAgIIFSnsJ9PMqmcwDQYJKoZIhvcNAQELBQAwGzEZMBcGA1UE
AwwQcm9zLXZwbi1kdG9wcy5jYzAeFw0xODExMjIwNDA4MTVaFw0yODExMTkwNDA4
MTVaMBsxGTAXBgNVBAMMEHJvcy12cG4tZHRvcHMuY2MwggEiMA0GCSqGSIb3DQEB
AQUAA4IBDwAwggEKAoIBAQCsPw1VT2KvJrkK+d4OB9C/IiYS9HJKGrvV2jlpsvfr
4r7Z0XEHPZfGN/oOCx5dqkVzpQrhCkniuGGScP+FQ10A7nIxSILl/SWLgdsM29gr
JBzj6O4clKIhadlIBlHosIu16SaesTx5IKCmapyBX21NYoEjTev387FGLZOwcNx4
ZWr9NQ2NiwRhzh2Cu27TxdvIzWxIjjVuJpSj41UXJXhtjVAIar8IrK7HyqjDg3fB
BVjWGcXq9sBo9EDEcq7ArKg18ptLROS4JAwDuzRlQJbt+6ykyQexEsrH/O3Q81nd
i5CPtGI/NbrNVFgaP3Z0O3rvGfUzCPfUP7+PKY+16upLAgMBAAGjaDBmMA8GA1Ud
EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBTJh1HnISeQwWf9
bInPaQdZI0BjQjAkBglghkgBhvhCAQ0EFxYVR2VuZXJhdGVkIGJ5IFJvdXRlck9T
MA0GCSqGSIb3DQEBCwUAA4IBAQAjbjih4aGGKE+NRlxvtPG/rRCgBYjZrmuug3S9
0Mks3TLylWSehhrpmEdCByGFx2CaU2sA5kIyf9S+sii+TBuiyiLVRsOUWG9jtQx4
4vpyxt/lmJpzZsMFAc0jG67ZkKhETGte7RQ+D8J+gtBKDgIMeub/WP6GfGRPnlE4
MaxFeOmHSSdrs9L0/fsDPPO1k80Fd6NSL9VPLPrxH6HWbd4xLaAdx7FaO4Hj2sQN
pt1QryFDKhzlydAFORy/kRudil2Or+tEjYFqkADvHm+0d0O5ykuaNqqONnXhRxor
JhggpPntQMuN+3BzZej8rFlJES7tP4+5mqrpIVjkDYF9p5Ec
-----END CERTIFICATE-----
</ca>

<cert>
-----BEGIN CERTIFICATE-----
MIIDPDCCAiSgAwIBAgIIaYYxJrBmU5QwDQYJKoZIhvcNAQELBQAwGzEZMBcGA1UE
AwwQcm9zLXZwbi1kdG9wcy5jYzAeFw0xODExMjIwNDA4MzBaFw0yODExMTkwNDA4
MzBaMCIxIDAeBgNVBAMMF2NsaWVudC5yb3MtdnBuLWR0b3BzLmNjMIIBIjANBgkq
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAymqBCtpOAUztveZIqeLjxmzpdoDyjIHO
LuVDifjs4Ax1VNM0vjJPpmcMsu2iCUURsE0KI2PSeIzfcgrfVpltUEXwJ5zHyPim
4lNt3KPQX4G97KH/W0GVPdssj7XR1Hi64wO+Csu0wcNNZKcM1Ct9Y/k60oHJ+q96
44oc1Qn4u/R4HkZEQY4NrAQPziUvs4Zm/DW9AVATmmAfQ56o7KRIYW5bw3jEnrcu
KFqdkUNu4//kr+x1az/QroUm5Aj01ZSKENpBMPrFhuaiJ9Ve5zT/2iPMWvC1NYq0
89KSOCLLB4aCble1sBsXp52mmszrQ0mw3AHsYdIuIylIMQaHaaLYywIDAQABo30w
ezATBgNVHSUEDDAKBggrBgEFBQcDAjAdBgNVHQ4EFgQUyu2FpYZXyJAlnKBIfWXb
Nn0XN/UwHwYDVR0jBBgwFoAUyYdR5yEnkMFn/WyJz2kHWSNAY0IwJAYJYIZIAYb4
QgENBBcWFUdlbmVyYXRlZCBieSBSb3V0ZXJPUzANBgkqhkiG9w0BAQsFAAOCAQEA
KOP9hgBpo68oQ01P8NyaQWXGLpxgDLAi0GHSCCWT0eF7B8k+PEwQqMYizIwjej2f
qdDL4LJ0lyyRWuCekA2DkkM845OJ5o56HRB+SoD3Dj9XGyx7HVtrA0zCg4jUeVdD
4ZJhrJ+aWgleHZ/X4Z7HVMbOr3PhApNVxBdIZ3ad4oIDWpro2aGVEBMjVA1d63vD
EGtmkftfim9g09zxtUaT5viHB09s+t79v+Q/SIsAVVmNc7zUtK4aMZve3E6Ijz8Y
9UPX2d40OuyjPk+S5g/rjkDEJS0kOQtIuOKCGKy2zPqCCW5mrDAIJBk+ub7/Frw5
FLpsmgv29C9619MSY/VeiA==
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAymqBCtpOAUztveZIqeLjxmzpdoDyjIHOLuVDifjs4Ax1VNM0
vjJPpmcMsu2iCUURsE0KI2PSeIzfcgrfVpltUEXwJ5zHyPim4lNt3KPQX4G97KH/
W0GVPdssj7XR1Hi64wO+Csu0wcNNZKcM1Ct9Y/k60oHJ+q9644oc1Qn4u/R4HkZE
QY4NrAQPziUvs4Zm/DW9AVATmmAfQ56o7KRIYW5bw3jEnrcuKFqdkUNu4//kr+x1
az/QroUm5Aj01ZSKENpBMPrFhuaiJ9Ve5zT/2iPMWvC1NYq089KSOCLLB4aCble1
sBsXp52mmszrQ0mw3AHsYdIuIylIMQaHaaLYywIDAQABAoIBAGc96XGypUTOixhn
47obCtiDZpTV8mCuOI78yvUNrSwdzp6kV2uHV87lEroUsKgPvZTxxnEEki6Ak9uk
JgQSn4npEjPyKIieIuifaxK1zytXjpqqigdurQNuzgzCzTKVHaV6nCz/d8O4rLng
5o81W3Bph5IlNvMRHBoAsPIMcvzSLSb8TnSAvPTLTtidl1ajvXPmAs+uNpv6mQx+
ha7ezT0cGql/hWle876P5UK7j9tJBdXBbL1oCYETqvzDb0/cyRfQohvbqFMVTQpi
dC02vUdWn4AsHwDH4vetg1XkSszKM7gZJ/A2jlTCk8ogcxO9yxr6OIIq0omPm7Qh
z2eqCVkCgYEA7P1WstsSX2+UQ2W5lsZ4iOrDsfH0Ec7PvxbiC1RmAxh+c+l6ceFm
PMVtRGk1BfcVNSS0pIyvm0FfcTUSqgH3Qv08g3Goy/TuDGby78KMAhyzVn9bTpt7
tayzAkMRb3dsDxS/FFTvmpMzfTGmn/CSCRWpDjDzy1Ox+DySXnvcUpcCgYEA2qcv
eX/qW4FOsZDE/MxnzN62UCg75I26UiqsGkGlJWss8gxK/jDThOR5G/XdLTibPk6n
HN+ZUq5N6Jf9tnjQjyVe4Ygat7GmPXQeqe6nNewIxAtztbT8lJk55lWNW8TgvXN9
kKCPQF5ZsRsfh71JQHyUArn9weMzavnbUMO8Fe0CgYEAlOEWHSg445GCD9ERBSJL
yJ/LLre0P5evtPkYKkvsBhfWINVVIcOa6aSRXz/Emqm9PfSAMztaemtYHRNdVUYE
4qWZ5W16wB5viYUHKw4JzK3hD/7UCo7s6ZXDozEk++SHEvZSj+BH4dCFsSmG5sVH
yMM9v/eKwHokvLC4tviS0aMCgYEAyw1pVB7LR/D8YH+9v7ofRy0oB6ZlgGlxty5z
puqBcA9orNtnpUk4lPgL1EBuBrnDyYgHPxQS8ap3JWJItfTaUaT1yOG5Vg++/uDg
PRUo6TVqKo0sBnmt+l2VXGbkoG1j++vNlsrUXYWBK6yxij/pT96hISsSEcVpkZW4
6vbqqz0CgYBx5i3xN1RHdjITGGC5rMBK/9nnpURDKLNv0uz0CRMXbmeIDQod7DlQ
vGXrDFqjise0FC8TAPbhTBcnHP8tctzvd7Uq6uGTS75Q196H1RTktLWDQWqkX5e9
/PXPNB0Wx7YziLQSTdJGKfUh3Ilvo1gR2zVgzdcDeHan3frVNE7Ykg==
-----END RSA PRIVATE KEY-----
</key>
[lookback@LookBack-MacBookPro ~]$ 

基于Mikrotik的RouterOS路由搭建OpenVPN服务

测试连接
基于Mikrotik的RouterOS路由搭建OpenVPN服务

基于Mikrotik的RouterOS路由搭建OpenVPN服务

基于Mikrotik的RouterOS路由搭建OpenVPN服务

基于Mikrotik的RouterOS路由搭建OpenVPN服务

基于Mikrotik的RouterOS路由搭建OpenVPN服务

整体过程总结

[admin@DTOPS-OVH-SG-Router-Node1] > /certificate
[admin@DTOPS-OVH-SG-Router-Node1] /certificate> add name=ca-template common-name=ros-vpn-dtops.cc days-valid=3650 key-size=2048 key-usage=crl-sign,key-cert-sign
[admin@DTOPS-OVH-SG-Router-Node1] /certificate> add name=server-template common-name=*.ros-vpn-dtops.cc days-valid=3650 key-size=2048 key-usage=digital-signature,key-encipherment,tls-server
[admin@DTOPS-OVH-SG-Router-Node1] /certificate> add name=client-template common-name=client.ros-vpn-dtops.cc days-valid=3650 key-size=2048 key-usage=tls-client
[admin@DTOPS-OVH-SG-Router-Node1] /certificate> sign ca-template name=ca-certificate
  progress: done
[admin@DTOPS-OVH-SG-Router-Node1] /certificate> sign server-template name=server-certificate ca=ca-certificate
  progress: done
[admin@DTOPS-OVH-SG-Router-Node1] /certificate> sign client-template name=client-certificate ca=ca-certificate
  progress: done
[admin@DTOPS-OVH-SG-Router-Node1] /certificate> export-certificate ca-certificate export-passphrase=""
[admin@DTOPS-OVH-SG-Router-Node1] /certificate> export-certificate client-certificate export-passphrase=12345678
[admin@DTOPS-OVH-SG-Router-Node1] /certificate> /ip pool add name="openvpn-pool" ranges=172.20.253.1-172.20.253.254
[admin@DTOPS-OVH-SG-Router-Node1] /certificate> /ppp profile add name="openvpn-profile" use-encryption=yes local-address=172.20.0.1 dns-server=139.99.18.82,139.99.115.58 remote-address=openvpn-pool
[admin@DTOPS-OVH-SG-Router-Node1] /certificate> /ppp secret add name=lookback profile=openvpn-profile password=lookback123
[admin@DTOPS-OVH-SG-Router-Node1] /certificate> /interface ovpn-server server set default-profile=openvpn-profile certificate=server-certificate require-client-certificate=yes auth=sha1 cipher=aes128,aes192,aes256 enabled=yes
[admin@DTOPS-OVH-SG-Router-Node1] /certificate> /
[admin@DTOPS-OVH-SG-Router-Node1] > /ip firewall filter add chain=input protocol=tcp dst-port=1194 action=accept place-before=0 comment="Allow OpenVPN"
[admin@DTOPS-OVH-SG-Router-Node1] > quit

基于Mikrotik的RouterOS路由搭建OpenVPN服务

lookback

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: