👻
openvpn を試す
環境
amd64のKVMの上の Debian12同士で openvpn によるVPN接続を試します。
インストール
両方のマシンに必要なパッケージを導入します。
(ここでは bridge-utils は、疎通確認のために仮想ブリッジを利用するためにインストールしています。)
$ sudo apt install bridge-utils openvpn
単純に接続
server 側で以下を実行します。(ターミナルを専有します)
$ sudo openvpn --remote 192.168.11.211 --dev tun1 --ifconfig 10.9.8.1 10.9.8.2
2025-07-08 07:24:30 DEPRECATION: No tls-client or tls-server option in configuration detected. OpenVPN 2.7 will remove the functionality to run a VPN without TLS. See the examples section in the manual page for examples of a similar quick setup with peer-fingerprint.
2025-07-08 07:24:30 OpenVPN 2.6.3 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
2025-07-08 07:24:30 library versions: OpenSSL 3.0.16 11 Feb 2025, LZO 2.10
2025-07-08 07:24:30 DCO version: N/A
2025-07-08 07:24:30 ******* WARNING *******: '--cipher none' was specified. This means NO encryption will be performed and tunnelled data WILL be transmitted in clear text over the network! PLEASE DO RECONSIDER THIS SETTING!
2025-07-08 07:24:30 ******* WARNING *******: '--auth none' was specified. This means no authentication will be performed on received packets, meaning you CANNOT trust that the data received by the remote side have NOT been manipulated. PLEASE DO RECONSIDER THIS SETTING!
2025-07-08 07:24:30 ******* WARNING *******: All encryption and authentication features disabled -- All data will be tunnelled as clear text and will not be protected against man-in-the-middle changes. PLEASE DO RECONSIDER THIS CONFIGURATION!
2025-07-08 07:24:30 TUN/TAP device tun1 opened
2025-07-08 07:24:30 net_iface_mtu_set: mtu 1500 for tun1
2025-07-08 07:24:30 net_iface_up: set tun1 up
2025-07-08 07:24:30 net_addr_ptp_v4_add: 10.9.8.1 peer 10.9.8.2 dev tun1
2025-07-08 07:24:30 TCP/UDP: Preserving recently used remote address: [AF_INET]192.168.11.211:1194
2025-07-08 07:24:30 UDPv4 link local (bound): [AF_INET][undef]:1194
2025-07-08 07:24:30 UDPv4 link remote: [AF_INET]192.168.11.211:1194
略
client 側で以下を実行します。(ターミナルを専有します)
$ sudo openvpn --remote 192.168.11.210 --dev tun1 --ifconfig 10.9.8.2 10.9.8.1
2025-07-08 07:25:27 DEPRECATION: No tls-client or tls-server option in configuration detected. OpenVPN 2.7 will remove the functionality to run a VPN without TLS. See the examples section in the manual page for examples of a similar quick setup with peer-fingerprint.
2025-07-08 07:25:27 OpenVPN 2.6.3 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
2025-07-08 07:25:27 library versions: OpenSSL 3.0.16 11 Feb 2025, LZO 2.10
2025-07-08 07:25:27 DCO version: N/A
2025-07-08 07:25:27 ******* WARNING *******: '--cipher none' was specified. This means NO encryption will be performed and tunnelled data WILL be transmitted in clear text over the network! PLEASE DO RECONSIDER THIS SETTING!
2025-07-08 07:25:27 ******* WARNING *******: '--auth none' was specified. This means no authentication will be performed on received packets, meaning you CANNOT trust that the data received by the remote side have NOT been manipulated. PLEASE DO RECONSIDER THIS SETTING!
2025-07-08 07:25:27 ******* WARNING *******: All encryption and authentication features disabled -- All data will be tunnelled as clear text and will not be protected against man-in-the-middle changes. PLEASE DO RECONSIDER THIS CONFIGURATION!
2025-07-08 07:25:27 TUN/TAP device tun1 opened
2025-07-08 07:25:27 net_iface_mtu_set: mtu 1500 for tun1
2025-07-08 07:25:27 net_iface_up: set tun1 up
2025-07-08 07:25:27 net_addr_ptp_v4_add: 10.9.8.2 peer 10.9.8.1 dev tun1
2025-07-08 07:25:27 TCP/UDP: Preserving recently used remote address: [AF_INET]192.168.11.210:1194
2025-07-08 07:25:27 UDPv4 link local (bound): [AF_INET][undef]:1194
2025-07-08 07:25:27 UDPv4 link remote: [AF_INET]192.168.11.210:1194
2025-07-08 07:25:30 Peer Connection Initiated with [AF_INET]192.168.11.210:1194
2025-07-08 07:25:31 Initialization Sequence Completed
確認
server でトンネルデバイスが作成されたことを確認
$ ip l show tun1
3: tun1: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN mode DEFAULT group default qlen 500
link/none
$ ip a show tun1
3: tun1: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 500
link/none
inet 10.9.8.1 peer 10.9.8.2/32 scope global tun1
valid_lft forever preferred_lft forever
inet6 fe80::92a9:bdcf:bc94:d604/64 scope link stable-privacy
valid_lft forever preferred_lft forever
client でトンネルデバイスが作成されたことを確認
$ ip l show tun1
3: tun1: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN mode DEFAULT group default qlen 500
link/none
$ ip a show tun1
3: tun1: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 500
link/none
inet 10.9.8.2 peer 10.9.8.1/32 scope global tun1
valid_lft forever preferred_lft forever
inet6 fe80::3f3:d707:11bf:9cea/64 scope link stable-privacy
valid_lft forever preferred_lft forever
server で、疎通確認のための仮想ブリッジを作成して、ipアドレスを割り当てて、スタティックルート設定。
$ sudo brctl addbr br0
$ sudo ip address add 10.210.0.1/24 dev br0
$ sudo ip route add 10.211.0.0/24 dev tun1
$ sudo brctl show
bridge name bridge id STP enabled interfaces
br0 8000.f22eedd00dd4 no
$ sudo ip a show br0
4: br0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether f2:2e:ed:d0:0d:d4 brd ff:ff:ff:ff:ff:ff
inet 10.210.0.1/24 scope global br0
valid_lft forever preferred_lft forever
$ ip route show 10.211.0.0/24
10.211.0.0/24 dev tun1 scope link
client でも同様
$ sudo brctl addbr br0
$ sudo ip address add 10.211.0.1/24 dev br0
$ sudo ip route add 10.210.0.0/24 dev tun1
$ sudo brctl show
bridge name bridge id STP enabled interfaces
br0 8000.eaece7c7cb90 no
$ sudo ip a show br0
4: br0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether ea:ec:e7:c7:cb:90 brd ff:ff:ff:ff:ff:ff
inet 10.211.0.1/24 scope global br0
valid_lft forever preferred_lft forever
$ ip route show 10.210.0.0/24
10.210.0.0/24 dev tun1 scope link
クライアント側で疎通確認
$ ping 10.210.0.1 -c 4
PING 10.210.0.1 (10.210.0.1) 56(84) bytes of data.
64 bytes from 10.210.0.1: icmp_seq=1 ttl=64 time=0.708 ms
64 bytes from 10.210.0.1: icmp_seq=2 ttl=64 time=0.718 ms
64 bytes from 10.210.0.1: icmp_seq=3 ttl=64 time=0.716 ms
64 bytes from 10.210.0.1: icmp_seq=4 ttl=64 time=0.811 ms
--- 10.210.0.1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3058ms
rtt min/avg/max/mdev = 0.708/0.738/0.811/0.042 ms
サーバ側でパケットキャプチャした様子
$ sudo tcpdump -i tun1 -n
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on tun1, link-type RAW (Raw IP), snapshot length 262144 bytes
07:39:43.071799 IP 10.9.8.2 > 10.210.0.1: ICMP echo request, id 1797, seq 1, length 64
07:39:43.071829 IP 10.210.0.1 > 10.9.8.2: ICMP echo reply, id 1797, seq 1, length 64
設定ファイルの利用
サーバ 側の設定ファイル
/etc/openvpn/tun1.conf
dev tun1
ifconfig 10.9.8.1 10.9.8.2
client 側の設定ファイル
/etc/openvpn/tun1.conf
remote 192.168.11.210
dev tun1
ifconfig 10.9.8.2 10.9.8.1
両側で下記を実行して接続する。
$ sudo openvpn --config /etc/openvpn/tun1.conf
Static Key 認証
シークレットキーを生成する
$ sudo openvpn --genkey secret static.key
$ sudo cat static.key
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
b47a316fe9c64961fdea20d52aa26a1f
b1468ec3cf75df12888e96c19966a8e3
07f778b06d308fa9d1a027b48b334adc
5a2672e443f9880fff27d97eaec40e28
a6afcdd2e190f37956fda5bc65112860
88593e514aada32fe0dcc68bce6e0b7a
b41e41a0747185716dced1b61a6bb17a
0a338b25f0297bd5f76fb9a3d012b4dc
5ec9ccdc97fe42b8f8abab7623311c56
ce751d1b67b9a6e69ddc2cebb5c624ce
a0dd5bf7fa752d685a5872e01b724fa1
07067adff0a871c671551a7cf8bcc26e
de4f72bd46c79186185d97d9abb5e65f
13e12c866b2d72b83308a9a8fbf970a9
61ce8c75c32b53fe480f1aeaaf36e537
a057f4b65320f69b8ce2aa5dedf5f65c
-----END OpenVPN Static key V1-----
生成したシークレットキーを両側のサーバに /etc/openvpn/static.key として保存する
$ ls -l /etc/openvpn/static.key
-rw------- 1 root root 636 Jul 8 07:47 /etc/openvpn/static.key
サーバ側設定ファイル
/etc/openvpn/tun1.conf
dev tun1
ifconfig 10.9.8.1 10.9.8.2
cipher AES-256-CBC
secret /etc/openvpn/static.key
コマンド実行
$ sudo openvpn --config /etc/openvpn/tun1.conf
2025-07-08 08:09:04 DEPRECATED OPTION: The option --secret is deprecated.
2025-07-08 08:09:04 DEPRECATION: No tls-client or tls-server option in configuration detected. OpenVPN 2.7 will remove the functionality to run a VPN without TLS. See the examples section in the manual page for examples of a similar quick setup with peer-fingerprint.
2025-07-08 08:09:04 OpenVPN 2.6.3 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
2025-07-08 08:09:04 library versions: OpenSSL 3.0.16 11 Feb 2025, LZO 2.10
2025-07-08 08:09:04 DCO version: N/A
2025-07-08 08:09:04 TUN/TAP device tun1 opened
2025-07-08 08:09:04 net_iface_mtu_set: mtu 1500 for tun1
2025-07-08 08:09:04 net_iface_up: set tun1 up
2025-07-08 08:09:04 net_addr_ptp_v4_add: 10.9.8.1 peer 10.9.8.2 dev tun1
2025-07-08 08:09:04 Could not determine IPv4/IPv6 protocol. Using AF_INET
2025-07-08 08:09:04 UDPv4 link local (bound): [AF_INET][undef]:1194
2025-07-08 08:09:04 UDPv4 link remote: [AF_UNSPEC]
2025-07-08 08:09:10 Peer Connection Initiated with [AF_INET]192.168.11.211:1194
2025-07-08 08:09:10 Initialization Sequence Completed
クライアント側設定ファイル
/etc/openvpn/tun1.conf
remote 192.168.11.210
dev tun1
ifconfig 10.9.8.2 10.9.8.1
cipher AES-256-CBC
secret /etc/openvpn/static.key
コマンド実行
$ sudo openvpn --config /etc/openvpn/tun1.conf
2025-07-08 08:09:10 DEPRECATED OPTION: The option --secret is deprecated.
2025-07-08 08:09:10 DEPRECATION: No tls-client or tls-server option in configuration detected. OpenVPN 2.7 will remove the functionality to run a VPN without TLS. See the examples section in the manual page for examples of a similar quick setup with peer-fingerprint.
2025-07-08 08:09:10 OpenVPN 2.6.3 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
2025-07-08 08:09:10 library versions: OpenSSL 3.0.16 11 Feb 2025, LZO 2.10
2025-07-08 08:09:10 DCO version: N/A
2025-07-08 08:09:10 TUN/TAP device tun1 opened
2025-07-08 08:09:10 net_iface_mtu_set: mtu 1500 for tun1
2025-07-08 08:09:10 net_iface_up: set tun1 up
2025-07-08 08:09:10 net_addr_ptp_v4_add: 10.9.8.2 peer 10.9.8.1 dev tun1
2025-07-08 08:09:10 TCP/UDP: Preserving recently used remote address: [AF_INET]192.168.11.210:1194
2025-07-08 08:09:10 UDPv4 link local (bound): [AF_INET][undef]:1194
2025-07-08 08:09:10 UDPv4 link remote: [AF_INET]192.168.11.210:1194
2025-07-08 08:09:14 Peer Connection Initiated with [AF_INET]192.168.11.210:1194
2025-07-08 08:09:15 Initialization Sequence Completed
証明書認証
証明書の発行は step-ca を利用してみる。
# ls -l /root/.step/certs/intermediate_ca.crt /root/.step/certs/root_ca.crt
-rw------- 1 1000 1000 676 Dec 16 2023 /root/.step/certs/intermediate_ca.crt
-rw------- 1 1000 1000 619 Dec 16 2023 /root/.step/certs/root_ca.crt
サーバ証明書を作成する
# step ca certificate test-server test-server.crt test-server.key
# ls -l test-server.*
-rw------- 1 root root 1486 Jul 8 21:43 test-server.crt
-rw------- 1 root root 227 Jul 8 21:43 test-server.key
クライアント証明書を作成する
# step ca certificate test@example.net test-client.crt test-client.key
# ls -l test-client.*
-rw------- 1 root root 1498 Jul 8 21:45 test-client.crt
-rw------- 1 root root 227 Jul 8 21:45 test-client.key
サーバ側にサーバ証明書を配置して起動する。
$ sudo openvpn \
--dev tun1 \
--ifconfig 10.9.8.1 10.9.8.2 \
--tls-server \
--ca /etc/openvpn/root_ca.crt \
--cert /etc/openvpn/test-server.crt \
--key /etc/openvpn/test-server.key \
--reneg-sec 60 \
--cipher AES-256-CBC \
--auth SHA512 \
--tls-version-min 1.3 \
--dh none \
--auth-nocache
2025-07-09 07:10:04 OpenVPN 2.6.3 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
2025-07-09 07:10:04 library versions: OpenSSL 3.0.16 11 Feb 2025, LZO 2.10
2025-07-09 07:10:04 DCO version: N/A
2025-07-09 07:10:04 TUN/TAP device tun1 opened
2025-07-09 07:10:04 net_iface_mtu_set: mtu 1500 for tun1
2025-07-09 07:10:04 net_iface_up: set tun1 up
2025-07-09 07:10:04 net_addr_ptp_v4_add: 10.9.8.1 peer 10.9.8.2 dev tun1
2025-07-09 07:10:04 Could not determine IPv4/IPv6 protocol. Using AF_INET
2025-07-09 07:10:04 UDPv4 link local (bound): [AF_INET][undef]:1194
2025-07-09 07:10:04 UDPv4 link remote: [AF_UNSPEC]
2025-07-09 07:10:51 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305
2025-07-09 07:10:51 peer info: IV_PROTO=746
2025-07-09 07:10:51 [test@example.net] Peer Connection Initiated with [AF_INET]192.168.11.211:1194
2025-07-09 07:10:52 Initialization Sequence Completed
クライアント側にクライアント証明書を配置して起動する。
$ sudo openvpn \
--remote 192.168.11.210 \
--dev tun1 \
--ifconfig 10.9.8.2 10.9.8.1 \
--tls-client \
--ca /etc/openvpn/root_ca.crt \
--cert /etc/openvpn/test-client.crt \
--key /etc/openvpn/test-client.key \
--reneg-sec 60 \
--cipher AES-256-CBC \
--auth SHA512 \
--tls-version-min 1.3 \
--auth-nocache
2025-07-09 07:10:51 library versions: OpenSSL 3.0.16 11 Feb 2025, LZO 2.10
2025-07-09 07:10:51 DCO version: N/A
2025-07-09 07:10:51 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
2025-07-09 07:10:51 TUN/TAP device tun1 opened
2025-07-09 07:10:51 net_iface_mtu_set: mtu 1500 for tun1
2025-07-09 07:10:51 net_iface_up: set tun1 up
2025-07-09 07:10:51 net_addr_ptp_v4_add: 10.9.8.2 peer 10.9.8.1 dev tun1
2025-07-09 07:10:51 TCP/UDP: Preserving recently used remote address: [AF_INET]192.168.11.210:1194
2025-07-09 07:10:51 UDPv4 link local (bound): [AF_INET][undef]:1194
2025-07-09 07:10:51 UDPv4 link remote: [AF_INET]192.168.11.210:1194
2025-07-09 07:10:51 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305
2025-07-09 07:10:51 peer info: IV_PROTO=746
2025-07-09 07:10:51 [test-server] Peer Connection Initiated with [AF_INET]192.168.11.210:1194
2025-07-09 07:10:52 Initialization Sequence Completed
設定ファイルの利用
サーバ側の設定ファイル
/etc/openvpn/server.conf
port 1194
proto udp
dev tun
ca /etc/openvpn/root_ca.crt
cert /etc/openvpn/test-server.crt
key /etc/openvpn/test-server.key
dh none
auth SHA512
cipher AES-256-CBC
auth-nocache
topology subnet
server 10.9.8.0 255.255.255.0
push "route 10.210.0.0 255.255.255.0"
client-to-client
keepalive 10 120
persist-key
persist-tun
explicit-exit-notify 1
サービスの起動
$ sudo systemctl start openvpn@server
$ sudo systemctl status openvpn@server
クライアント側の設定ファイル
/etc/openvpn/client.conf
client
dev tun
proto udp
remote 192.168.11.210 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
<ca>
-----BEGIN CERTIFICATE-----
ルート証明書
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
クライアント証明書
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
中間証明書
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN EC PRIVATE KEY-----
クライアント証明書秘密鍵
-----END EC PRIVATE KEY-----
</key>
cipher AES-256-CBC
auth SHA512
証明書はファイル名で記載することもできるが、上記のようにインラインで記載することもできる。
クライアント側から接続する。
$ sudo openvpn --config /etc/openvpn/client.conf
Discussion