VPNを検証してみた 2010年5月4日
ネットスクエアの志藤です。
今日はOpenVPNを触ってみたので
そのログと感想を書きたいと思います。
↓↓↓作業ログ（ここから）↓↓↓
# rpm -ivh openvpn-as-1.3.5-CentOS5.i386.rpm
準備中… ########################################### [100%]
1:openvpn-as ########################################### [100%]
Please configure OpenVPN-AS by running /usr/local/openvpn_as/bin/ovpn-init
# /usr/local/openvpn_as/bin/ovpn-init
OpenVPN Access Server
Initial Configuration Tool
——————————————————
OpenVPN Access Server End User License Agreement (OpenVPN-AS EULA)
1. Copyright Notice: OpenVPN Access Server License;
Copyright (c) 2009-2010 OpenVPN Technologies, Inc.. All rights reserved.
“OpenVPN” is a trademark of OpenVPN Technologies, Inc.
2. Redistribution of OpenVPN Access Server binary forms and documents,
are permitted provided that redistributions of OpenVPN Access Server
binary forms and documents must reproduce the above copyright notice.
3. You agree not to reverse engineer, decompile, disassemble, modify, translate,
make any attempt to discover the source code of this software, or create
derivative works from this software.
4. The OpenVPN Access Server is bundled with other open source software
components, some of which fall under different licenses. By using
OpenVPN or any of the bundled components, you agree to be bound by
the conditions of the license for each respective component.
See /usr/local/openvpn_as/license.txt in the Access Server distribution
for more info.
5. THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESSED OR IMPLIED WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
OPENVPN TECHNOLOGIES, INC BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Please enter ‘yes’ to indicate your agreement [no]: yes
Once you provide a few initial configuration settings,
OpenVPN Access Server can be configured by accessing
its Admin Web UI using your Web browser.
Please specify the network interface and IP address to be
used by the Admin Web UI:
(1) all interfaces: 0.0.0.0
(2) eth0: XXX.XXX.XXX.XXX
Please enter the option number from the list above (1-2).
> Press Enter for default [2]: 2
Please specify the port number for the Admin Web UI.
> Press ENTER for default [943]:
Please specify the TCP port number for the OpenVPN Daemon
> Press ENTER for default [1194]:
Should client traffic be routed by default through the VPN?
> Press ENTER for default [yes]:no
Should RFC1918 private subnets be accessible to clients by default?
> Press ENTER for default [yes]:no
To initially login to the Admin Web UI, you must use a
username and password that successfully authenticate you
with the host UNIX system (you can later modify the settings
so that RADIUS or LDAP is used for authentication instead).
You can login to the Admin Web UI as ‘root’ with your existing
root password or specify a different user account to use for this
purpose. If you choose to use a non-root account, you can create
a new user account or specify an existing user account.
Do you wish to login as ‘root’?
> Press ENTER for default [yes]:no
> Please specify your OpenVPN-AS license key (or leave blank to specify later):
Initializing OpenVPN…
Writing as configuration file…
Perform sa init…
Wiping any previous userdb…
Creating default profile…
Modifying default profile…
Adding new user to userdb…
Modifying new user as superuser in userdb…
Getting hostname…
Hostname: zoo.net-squares.com
Preparing web certificates…
Getting web user account…
Adding web group account…
Adding web user account…
Adding web group…
Adjusting license directory ownership…
Initializing userdb…
Generating init scripts…
Generating PAM config…
Generating init scripts auto command…
Starting openvpnas…
NOTE: Your system clock must be correct for OpenVPN Access Server
to perform correctly. Please ensure that your time and date
are correct on this system.
Initial Configuration Complete!
You can now continue configuring OpenVPN Access Server by
directing your Web browser to this URL:
https://XXX.XXX.XXX.XXX:943/admin
Login as “root” with the same password used to authenticate
to this UNIX host.
See the Release Notes for this release at:
http://www.openvpn.net/access-server/rn/openvpn_as_1_3_5.html
↑↑↑作業ログ（ここまで）↑↑↑
感想としては、「え、これで終わり？」というぐらい簡単でした。
設定は全然変更していないわけではないですが、
基本はここを参考にして、
あとは社内ＬＡＮにルーティングさせるための設定を１箇所追加したら繋がりました。
当然セキュアな通信が行われているし、
VPNだとリモートデスクトップも社内にいるのと同じ感覚で使えるのでとっても便利です。
ＧＷや年末年始の大型連休になると会社の近くにいるとは限りませんから、
リモートメンテできる環境を構築しておくべきですね。
↓↓↓作業ログ（ここから）↓↓↓
# rpm -ivh openvpn-as-1.3.5-CentOS5.i386.rpm
準備中… ########################################### [100%]
1:openvpn-as ########################################### [100%]
Please configure OpenVPN-AS by running /usr/local/openvpn_as/bin/ovpn-init
# /usr/local/openvpn_as/bin/ovpn-init
OpenVPN Access Server
Initial Configuration Tool
——————————————————
OpenVPN Access Server End User License Agreement (OpenVPN-AS EULA)
1. Copyright Notice: OpenVPN Access Server License;
Copyright (c) 2009-2010 OpenVPN Technologies, Inc.. All rights reserved.
“OpenVPN” is a trademark of OpenVPN Technologies, Inc.
2. Redistribution of OpenVPN Access Server binary forms and documents,
are permitted provided that redistributions of OpenVPN Access Server
binary forms and documents must reproduce the above copyright notice.
3. You agree not to reverse engineer, decompile, disassemble, modify, translate,
make any attempt to discover the source code of this software, or create
derivative works from this software.
4. The OpenVPN Access Server is bundled with other open source software
components, some of which fall under different licenses. By using
OpenVPN or any of the bundled components, you agree to be bound by
the conditions of the license for each respective component.
See /usr/local/openvpn_as/license.txt in the Access Server distribution
for more info.
5. THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESSED OR IMPLIED WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
OPENVPN TECHNOLOGIES, INC BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Please enter ‘yes’ to indicate your agreement [no]: yes
Once you provide a few initial configuration settings,
OpenVPN Access Server can be configured by accessing
its Admin Web UI using your Web browser.
Please specify the network interface and IP address to be
used by the Admin Web UI:
(1) all interfaces: 0.0.0.0
(2) eth0: XXX.XXX.XXX.XXX
Please enter the option number from the list above (1-2).
> Press Enter for default [2]: 2
Please specify the port number for the Admin Web UI.
> Press ENTER for default [943]:
Please specify the TCP port number for the OpenVPN Daemon
> Press ENTER for default [1194]:
Should client traffic be routed by default through the VPN?
> Press ENTER for default [yes]:no
Should RFC1918 private subnets be accessible to clients by default?
> Press ENTER for default [yes]:no
To initially login to the Admin Web UI, you must use a
username and password that successfully authenticate you
with the host UNIX system (you can later modify the settings
so that RADIUS or LDAP is used for authentication instead).
You can login to the Admin Web UI as ‘root’ with your existing
root password or specify a different user account to use for this
purpose. If you choose to use a non-root account, you can create
a new user account or specify an existing user account.
Do you wish to login as ‘root’?
> Press ENTER for default [yes]:no
> Please specify your OpenVPN-AS license key (or leave blank to specify later):
Initializing OpenVPN…
Writing as configuration file…
Perform sa init…
Wiping any previous userdb…
Creating default profile…
Modifying default profile…
Adding new user to userdb…
Modifying new user as superuser in userdb…
Getting hostname…
Hostname: zoo.net-squares.com
Preparing web certificates…
Getting web user account…
Adding web group account…
Adding web user account…
Adding web group…
Adjusting license directory ownership…
Initializing userdb…
Generating init scripts…
Generating PAM config…
Generating init scripts auto command…
Starting openvpnas…
NOTE: Your system clock must be correct for OpenVPN Access Server
to perform correctly. Please ensure that your time and date
are correct on this system.
Initial Configuration Complete!
You can now continue configuring OpenVPN Access Server by
directing your Web browser to this URL:
https://XXX.XXX.XXX.XXX:943/admin
Login as “root” with the same password used to authenticate
to this UNIX host.
See the Release Notes for this release at:
http://www.openvpn.net/access-server/rn/openvpn_as_1_3_5.html
↑↑↑作業ログ（ここまで）↑↑↑
感想としては、「え、これで終わり？」というぐらい簡単でした。
設定は全然変更していないわけではないですが、
基本はここを参考にして、
あとは社内ＬＡＮにルーティングさせるための設定を１箇所追加したら繋がりました。
当然セキュアな通信が行われているし、
VPNだとリモートデスクトップも社内にいるのと同じ感覚で使えるのでとっても便利です。
ＧＷや年末年始の大型連休になると会社の近くにいるとは限りませんから、
リモートメンテできる環境を構築しておくべきですね。