quizzz13.com

MOBILEVPNconOpenVPN-ZeroshellelapartecipazionestraordinariadiAndroideIpadIlsistemaoperativomultifunzionalecreatodaFulvio.
Ricciardi@zeroshell.
netwww.
zeroshell.
netOpenVpninpiùdi2minutiperconfigurareZeroshellperAndroidedIpad(Autore:fnc.
gulino@libero.
it)Hoconosciuto,scopertoeapprezzatoZeroshellmoltiannifa,hofattobuonusodellesuequalitàedessomiharicambiatosempreconlasuasolidità,semplicitàetranquilladedizione.
Finoaquandomisonoimbattutonella"patatabollente"dellaconnessioneinopenvpndeiterminalimobili,edinparticolarediSmartphoneAndroidedIpad(miniemaxi),chemihatoltoilsorrisoelaconvinzionechenullafosseimpossibileperilmagnificoZeroshell.
Dapremetterecheutilizzoopenvpninimplementazioninonzeroshellianedatempoimmemoreelasuaconfigurazioneintuttele"salse"hasemprerispostoallemieesigenze.
Vistiiprimifallimentihogirovagatonelforumedinreteperscoprireleragionideimieierroriedellamianonsempremanifestaignoranza,hoscopertoilinkchemihannoguidatoallasoluzioneedalritornodell'allegrianeimieipoveriocchistanchi.
Certodifarecosasimpaticaegraditamipermetteròdidivulgarequestamiasempliceesperienza.
"GrazieFulvio,egrazieatuttiquellicheinquestiannisonostatiarteficidellacreazioneesviluppodiunsistemaoperativodicontrolloegestionereteveramenteeccezionale.
"Partiamo!
Inreteenelforumsipuòfarriferimentoinparticolareaquestadocumentazioneperstabilireunaconnessioneopenvpnconandroidoconipad:1)http://www.
zeroshell.
org/forum/viewtopic.
phpp=4805#48052)http://www.
zeroshell.
org/forum/viewtopic.
phpt=3910&sid=d45e8047eedb9355c02b4ebfa025b27e,ineffettiunavoltastabilitocheiterminaliinquestionepossonosoloutilizzareitunnelcondeviceditipo"tun",bastafarequalchetentativopermodificareetrovareleconfigurazionicorrettedadareinpastoaiclientVpn(OpenvpnConnectAndroideOpenvnConnectIpad)edalserveropenvpndiZeroshell.
Sisuggerisceal2)disostituirenegliscriptdiavvio"/root/kerbynet.
cgi/scripts"leoccorrenze"grep-wtap*"conilcorrispettivo"tun",infineperrenderestabilelaconfigurazionealriavviosiconsiglial'usodeipostbootscript.
3)http://www.
zeroshell.
net/forum/viewtopic.
phpp=14404&sid=4e28ef84d3186cbe411bb2f03510194b.
Finquituttobene!
Ilproblemasorgeinvecesesivuolemantenereintattalafunzionalita"tap"utilissimaecomodissimaincontesto"Host-to-LAN"conZeroshell,oppuremantenereintattalacapacitàdiutilizzarel'interfacciawebdigestionepercontrolloemanutenzionedellevpncreate.
Lasoluzionetestataechediseguitoespongo,pensosiautile,perestenderelegiànotevoli"capacità"openvpnennianedelcaroZeroshell.
Iniziamoconmodificaregliscriptinquestione,evidenziateingiallolesempliciaggiunte,cheinsostanzacredononsnaturinolospiritodipartenzadelprogetto:"createvpn";#!
/bin/sh.
/etc/kerbynet.
conf.
$SCRIPTS/net.
incNAME="$1"DESCRIPTION="$2"REMOTEIP="$3"PORT="$4"PROTO="$5"TLSROLE="$6"REMOTECN="$7"COMPRESSION="$8"CRYPTO="$9"PARAMETERS="${10}"AUTHENTICATION="${11}"PSK="${12}"GATEWAY="${13}"LOCALIP="${14}"[-z"$NAME"]&&exit1CONFIG="$REGISTER/system/net/interfaces/"VPNDIR="$CONFIG/$NAME"if["$NAME"==VPN00];thenDEV_TYPE="tun"elseDEV_TYPE="tap"fiifopenvpn--dev-type$DEV_TYPE--dev$NAME--mktun1>&2;thenmkdir-p$VPNDIR/TUNNELecho"$DESCRIPTION">$VPNDIR/Descriptionecho"$REMOTEIP">$VPNDIR/TUNNEL/RemoteIPecho"$LOCALIP">$VPNDIR/TUNNEL/LocalIPecho"$PORT">$VPNDIR/TUNNEL/Portecho"$PROTO">$VPNDIR/TUNNEL/Protoecho"$TLSROLE">$VPNDIR/TUNNEL/TLSRoleecho"$REMOTECN">$VPNDIR/TUNNEL/RemoteCNecho"$COMPRESSION">$VPNDIR/TUNNEL/Compressionecho"$CRYPTO">$VPNDIR/TUNNEL/Cryptoecho"$AUTHENTICATION">$VPNDIR/TUNNEL/Authenticationecho"$REMOTECN">$VPNDIR/TUNNEL/RemoteCNecho"$PSK">$VPNDIR/TUNNEL/PSKecho"$GATEWAY">$VPNDIR/Gatewayecho"$PARAMETERS">$VPNDIR/TUNNEL/Parametersechoup>$VPNDIR/STATUS$SCRIPTS/vpn_ctl$NAMEup&&$SCRIPTS/mrtg_reloadelseexit3fi"removevpn";#!
/bin/sh.
/etc/kerbynet.
conf.
$SCRIPTS/net.
incNAME="$1"[-z"$NAME"]&&exit1CONFIG="$REGISTER/system/net/interfaces/"VPNDIR="$CONFIG/$NAME"if[-r$VPNDIR/Bridge/Name];thenBR=`cat$VPNDIR/Bridge/Name`echo"devicememberof$BR(`ext_bridgename$BR`)">&2exit2elseif[-r$VPNDIR/Bond/Name];thenBD=`cat$VPNDIR/Bond/Name`echo"devicememberof$BD(`ext_bondname$BD`)">&2exit2else$SCRIPTS/vpn_ctl$NAMEdownifconfig$NAMEdownif["$NAME"==VPN00];thenDEV_TYPE="tun"elseDEV_TYPE="tap"fiopenvpn--rmtun--dev-type$DEV_TYPE--dev$NAMErm-rf$VPNDIR$SCRIPTS/nb_vpnfifi"tapcreate";#!
/bin/sh.
/etc/kerbynet.
conf.
$SCRIPTS/net.
incCONFIG="$REGISTER/system/net/interfaces"cd"$CONFIG"INTERFACES=`ls-dVPN[0123456789][01234567890]2>/dev/null`foriin$INTERFACES;doif["$i"==VPN00];thenDEV_TYPE="tun"elseDEV_TYPE="tap"fiifconfig$i2>/dev/null>/dev/null||openvpn--dev-type$DEV_TYPE--dev$i--mktun>/dev/null2>/dev/null$SCRIPTS/setvlans$idone"vpnconfig";#!
/bin/sh.
/etc/kerbynet.
conf.
$SCRIPTS/net.
incCONFIG="$REGISTER/system/net/interfaces"exportNOVPNWAIT=yescd"$CONFIG"if!
[-dVPN99];thenmkdirVPN99echoup>VPN99/STATUSecho"Host-to-LANOpenVPNInterface">VPN99/DescriptionVPNGW="`cat$REGISTER/system/openvpn/Gateway2>/dev/null`"VPNNM="`cat$REGISTER/system/openvpn/Netmask2>/dev/null`"mkdir-pVPN99/IP/00if[-z"$VPNGW"];thenVPNGW=192.
168.
250.
254VPNNM=255.
255.
255.
0fiecho$VPNGW>VPN99/IP/00/IPecho$VPNNM>VPN99/IP/00/Netmaskechoup>VPN99/IP/00/STATUSfiINTERFACES=`ls-dVPN[0123456789][01234567890]2>/dev/null`foriin$INTERFACES;doif["$i"==VPN00];thenDEV_TYPE="tun"elseDEV_TYPE="tap"fiififconfig$i2>/dev/null>/dev/null||openvpn--dev-type$DEV_TYPE--dev$i--mktun;then$SCRIPTS/setinterface$i#$SCRIPTS/setvlans$i$SCRIPTS/vpn_ctl$ifidone"vpn_ctl";#!
/bin/sh.
/etc/kerbynet.
conffunctionTERM(){I=0while[$I-lt30];doPID="`ps-ef|grepopenvpn|grep"--dev$1"|awk'{print$2}'`"if!
[-z"$PID"];thenkill-TERM$PIDsleep1elsereturn0fiI=$((I+1))donePID="`ps-ef|grepopenvpn|grep"--dev$1"|awk'{print$2}'`"if!
[-z"$PID"];thenkill-9$PIDsleep3fireturn1}INTERFACE="$1"STATUS="$2"[-z"$INTERFACE"]&&exit1CONFIG="$REGISTER/system/net/interfaces/$INTERFACE"if["$INTERFACE"==VPN99];thenexitfiif["$INTERFACE"==VPN00];thenDEV_TYPE="tun"elseDEV_TYPE="tap"fiifcd"$CONFIG"2>/dev/null;thenif[-z"$STATUS"];thenSTATUS=`cat$CONFIG/STATUS`fiif["$STATUS"==up];thenifTERM$INTERFACE;thenNUM=${INTERFACE:3:2}if["${NUM:0:1}"==0];thenNUM=${NUM:1:1}fiMGT=$[34000+$NUM]REMOTEIP=`catTUNNEL/RemoteIP`if!
[-z"$REMOTEIP"];thenREMOTEIP="--remote$REMOTEIP"fiLOCALIP="`$SCRIPTS/vpn_localip$INTERFACE2>/dev/null`"if!
[-z"$LOCALIP"];thenLOCALIP="--local$LOCALIP"fiPORT=`catTUNNEL/Port`PROTO=`catTUNNEL/Proto`AUTHENTICATION=`catTUNNEL/Authentication2>/dev/null`TLSROLE=`catTUNNEL/TLSRole`REMOTECN=`catTUNNEL/RemoteCN`COMPRESSION=`catTUNNEL/Compression`CRYPTO=`catTUNNEL/Crypto`PARAMETERS="`catTUNNEL/Parameters`"if!
[-z"$REMOTECN"];thenREMOTECN="--tls-remote`echo$REMOTECN|sed-r's/g'`"fiif["$TLSROLE"==Server];thenTLSROLE=serverRESTART=7elseTLSROLE=clientRESTART=11fiif["$PROTO"==TCP];thenPROTO=tcp-$TLSROLEelsePROTO=udpfiif["$COMPRESSION"==yes];thenCOMPRESSION="--comp-lzo"elseCOMPRESSION=""fiif["$CRYPTO"!
=yes];thenCRYPTO="--ciphernone"elseCRYPTO=""fiif["$AUTHENTICATION"=PSK];thenAUTHSTRING="--secret/tmp/$INTERFACE.
psk"echo"-----BEGINOpenVPNStatickeyV1-tmp/$INTERFACE.
psk"cat$CONFIG/TUNNEL/PSK>>"/tmp/$INTERFACE.
psk"echo"-----ENDOpenVPNStatickeyV1-tmp/$INTERFACE.
psk"chmod600/tmp/$INTERFACE.
pskelseAUTHSTRING="--tls-$TLSROLE--dh$SSLDIR/dh.
pem--ca$SSLDIR/trusted_CAs.
pem--cert$CONFIG/TLS/cert.
pem--key$CONFIG/TLS/key.
pem$REMOTECN"fiif!
ps-ef|grep-w"checkvpn"|grep-q-w$INTERFACE;then$SCRIPTS/checkvpn$INTERFACE&fiif!
$SCRIPTS/vpn_checknbgw$INTERFACE;thenGW="`cat$CONFIG/Gateway2>/dev/null`"GWDESC="`cat$REGISTER/system/net/nb/Gateways/$GW/Description2>/dev/null`"if[!
-f/tmp/$INTERFACE.
nogw];thentouch/tmp/$INTERFACE.
nogwlogger-t${INTERFACE}_L2L"UnabletoconnectusingtheselectedGateway($GWDESC)"elserm/tmp/$INTERFACE.
nogwfiexit25fi$SCRIPTS/nb_vpnifbash-c"openvpn--dev$INTERFACE$LOCALIP$REMOTEIP--port$PORT--proto$PROTO$AUTHSTRING--dev-type$DEV_TYPE--float--keepalive111--script-security3--management127.
0.
0.
1$MGT--daemon${INTERFACE}_L2L$COMPRESSION$CRYPTO$PARAMETERS--down'$SCRIPTS/vpn_mii'";thenSEM="/tmp/VPN_MII_$INTERFACE"rm-f$SEM$SCRIPTS/vpn_mii$INTERFACE[-z"$NOVPNWAIT"]&&sleep5elseexit5fielseexit2fielsekill`ps-ef|grep-wcheckvpn|grep-w$INTERFACE|awk'{print$2}'`2>/dev/nullTERM$INTERFACE||exit1ifconfig$INTERFACEdownfifi"vpn_start";#!
/bin/sh.
/etc/kerbynet.
conffunctionTERM(){killall-w-TERMvpn2>/dev/null}ENABLED=`cat$REGISTER/system/openvpn/Enabled2>/dev/null`TERMNETMASK=`cat$REGISTER/system/openvpn/Netmask2>/dev/null`GW=`cat$REGISTER/system/openvpn/Gateway2>/dev/null`if[-n"$GW"];thenif["$GW"!
="`cat$REGISTER/system/net/interfaces/VPN99/IP/00/IP2>/dev/null`"-o"$NETMASK"!
="`cat$REGISTER/system/net/interfaces/VPN99/IP/00/Netmask2>/dev/null`"];thenif!
[-r$REGISTER/system/net/interfaces/VPN99/Bridge/Name];thenmkdir-p$REGISTER/system/net/interfaces/VPN99/IP/00/echo$GW>$REGISTER/system/net/interfaces/VPN99/IP/00/IPecho$NETMASK>$REGISTER/system/net/interfaces/VPN99/IP/00/Netmaskechoup>$REGISTER/system/net/interfaces/VPN99/IP/00/STATUS$SCRIPTS/setinterfaceVPN99fifi$SCRIPTS/dns_hupfiiptables-tnat-DPOSTROUTING-jOpenVPN2>/dev/nulliptables-tnat-FOpenVPN2>/dev/nulliptables-tnat-XOpenVPN2>/dev/nullif["$ENABLED"==yes];then$SCRIPTS/vpn_restart_x509PROTO=`cat$REGISTER/system/openvpn/Proto2>/dev/null`PORT=`cat$REGISTER/system/openvpn/Port2>/dev/null`PARAM=`cat$REGISTER/system/openvpn/Parameters2>/dev/null`AUTHENTICATION=`cat$REGISTER/system/openvpn/Authentication2>/dev/null`IPMIN=`cat$REGISTER/system/openvpn/IPMin2>/dev/null`IPMAX=`cat$REGISTER/system/openvpn/IPMax2>/dev/null`DNS=`cat$REGISTER/system/openvpn/DNS2>/dev/null`NAT=`cat$REGISTER/system/openvpn/NAT2>/dev/null`if["$AUTHENTICATION"==Password];thenNOCERTREQ="--client-cert-not-required"fiif["$AUTHENTICATION"!
=X509];thenAUTHSCRIPT="--auth-user-pass-verify$SCRIPTS/ov_pw_authvia-env--username-as-common-name"PUSHAUTH="auth-user-pass"fiif[-n"$IPMIN"-a-n"$IPMAX"];thenPOOL="--ifconfig-pool$IPMIN$IPMAX$NETMASK"if["$NAT"==yes];theniptables-tnat-NOpenVPNiptables-tnat-AOpenVPN-miprange--src-range$IPMIN-$IPMAX-jMASQUERADEiptables-tnat-APOSTROUTING-jOpenVPNfifiif[-n"$DNS"];thenRESOLVER="dhcp-optionDNS$DNS"fiif[-n"$GW"];thenNETS=`cat$REGISTER/system/openvpn/Nets2>/dev/null`PUSHGW="route-gateway$GW"if[-z"$NETS"];thenREDIRECTGW="redirect-gateway"else#PUSHNETS0="routeremote_host255.
255.
255.
255net_gateway1"#modificaperevitareproblemidiroutingederrorineilog.
PUSHNETS0="routeremote_host255.
255.
255.
255vpn_gateway1"forNETin$NETS;doIPNET=`echo$NET|awk-F/'{print$1}'`MASKNET=`echo$NET|awk-F/'{print$2}'`if!
echo$MASKNET|grep-q'\.
';thenMASKNET=`$SCRIPTS/netmask$MASKNET`fiPUSHNETS="$PUSHNETS--push\"route$IPNET$MASKNET\""donefifiMGT=34099bash-c"vpn--dev-typetap--devVPN99--modeserver--tls-server--proto$PROTO--port$PORT--dh/etc/ssl/dh.
pem--ca$REGISTER/system/openvpn/Auth/X509/CAFile--cert$REGISTER/system/openvpn/TLS/cert.
pem--key$REGISTER/system/openvpn/TLS/key.
pem$NOCERTREQ$AUTHSCRIPT--daemonVPN99_H2L--comp-lzo$POOL--push'$PUSHGW'--push'$REDIRECTGW'--push'$RESOLVER'--push'$PUSHNETS0'$PUSHNETS--client-connect$SCRIPTS/ov_connect--client-disconnect$SCRIPTS/ov_disconnect--mute3--management127.
0.
0.
1$MGT--keepalive560--duplicate-cn--script-security3$PARAM"fiDopoavermodificatogliscriptedaverlisostituitiaglioriginalisipuòconessicreareilprimoedunicotunnelVPN00ditipo"tun".
(Volendoèpossibile,facendoulteriorimodificheagliscript,costruirealtritunnel.
)Siprocederàcreando,adesempiosottoladirectory"/Database"diZeroshell,unacartellachechiameremo"script_vpn"enellaqualeandremoacopiareifilemodificatidinostrointeresse:root@zeroshellroot>mkdir/Database/script_vpnroot@zeroshellroot>ll/Database/script_vpn/total28-rw-r--r--1rootroot0Feb917:52VPN00.
log-rw-r--r--1rootroot1231Feb412:38createvpn-rw-r--r--1rootroot663Feb412:38removevpn-rwxr-xr-x1rootroot1309Feb918:12start_VPN00-rw-r--r--1rootroot402Feb412:38tapcreate-rw-r--r--1rootroot3976Feb412:38vpn_ctl-rw-r--r--1rootroot3458Feb412:38vpn_start-rw-r--r--1rootroot926Feb412:38vpnconfigloscript"start_VPN00"èloscriptdafarpartirecomepostalboot,ilcuicontenutoè:root@zeroshellroot>cat/Database/script_vpn/start_VPN00#!
/bin/sh#StartupScript#Sisostituisconolecopieoriginaliconifilemodificatirm-f/root/kerbynet.
cgi/scripts/createvpncp-f/Database/script_vpn/createvpn/root/kerbynet.
cgi/scriptsrm-f/root/kerbynet.
cgi/scripts/removevpncp-f/Database/script_vpn/removevpn/root/kerbynet.
cgi/scriptsrm-f/root/kerbynet.
cgi/scripts/tapcreatecp-f/Database/script_vpn/tapcreate/root/kerbynet.
cgi/scriptsrm-f/root/kerbynet.
cgi/scripts/vpn_ctlcp-f/Database/script_vpn/vpn_ctl/root/kerbynet.
cgi/scriptsrm-f/root/kerbynet.
cgi/scripts/vpn_startcp-f/Database/script_vpn/vpn_start/root/kerbynet.
cgi/scriptsrm-f/root/kerbynet.
cgi/scripts/vpnconfigcp-f/Database/script_vpn/vpnconfig/root/kerbynet.
cgi/scriptscd/root/kerbynet.
cgi/scriptschmod755createvpnremovevpntapcreatevpn_ctlvpnconfig#Sichiudeedeliminaildevice"tap"didefaultesicreaedapreildeviceditipo"tun"/sbin/ifconfigVPN00downopenvpn--rmtun--dev-typetap--devVPN00openvpn--mktun--dev-typetun--devVPN00/sbin/ifconfigVPN00uplastringadainserirein"setup-start/cron"è:/Database/script_vpn/start_VPN00&>/Database/script_vpn/VPN00.
log&avremoquindi,ancheconilrebootdelsistema,semprelanostraconfigurazioneOpenvpndifigura,dovelaOpenVPNVirtualPrivateNetworkLANtoLANVPN00ècondeviceditipo"tun",laOpenVPNVirtualPrivateNetworkLANtoLANVPN01ècondeviceditipo"tap"elaOpenVPNHost-to-LANVPN99continuaadessereditipo"tap":Lastringadaimpostareadesempiosuopenvpn"zeroshell"latoserverè:--ifconfig10.
10.
13.
110.
10.
13.
2--cipherBF-CBC--push'ifconfig10.
10.
13.
210.
10.
13.
1'--push'route192.
168.
250.
0255.
255.
255.
0vpn_gateway'--push'route192.
168.
xxx.
xxx255.
255.
255.
255vpn_gateway'--push'route192.
168.
xxx.
yyy255.
255.
255.
255vpn_gateway'.
Lafigurariportalaconfigurazionelatoserverchericalcaleesperienzeriportatedaivariamicineiforum:http://www.
renatomorano.
net/p=892http://www.
renatomorano.
net/p=757http://www.
zeroshell.
net/forum/viewtopic.
phpt=444Invecelatoclient(androidoipad)siavrà:"client.
ovpn";#Sampleclient-sideOpenVPN2.
0configfile##forconnectingtomulti-clientserver.
##Thisconfigurationcanbeusedbymultiple##clients,howevereachclientshouldhave##itsowncertandkeyfiles.
##OnWindows,youmightwanttorenamethis##filesoithasa.
ovpnextension#devtunremotexxx.
yyy.
zzz.
kkkport1195prototcp-clienttls-clientpullifconfig10.
10.
13.
210.
10.
13.
1cipherBF-CBCdev-typetunfloatkeepalive111script-security3-----BEGINCERTIFICATE-----vxjsòaòòkaòkòka.
.
.
.
.
.
.
-----ENDCERTIFICATE----------BEGINCERTIFICATE-----sdkhhdsjsdh.
-----ENDCERTIFICATE----------BEGINRSAPRIVATEKEY-----dfihdfihdfhvdh.
-----ENDRSAPRIVATEKEY-----Occorrefareancoraalcunepiccoleprecisazioni;laconfigurazioneespostahadeilimiti,nelsensochesiinstauraunacorrispondenzaunoadunofrailclientedilserver,quindiinpartesisnaturalafilosofiadelLantoLan,dedicandountunneldibenpiùampiecapacitàadunasolaoccorrenza.
Lasoluzionetrovataperòrisolveilprobleminodipartenza,cioèlapossibilitàdiinterconnettereallamialanclientvpnAndroideIpad.
Adiscolpasipuòaggiungerechenonèdifficilemodificareleconfigurazionilatoserverperconsentirel'utilizzoinpullancheconquestatopologia.
Questoètutto!