Пересоздал сертификаты, ключи для openvpn. ipsec rsasigkey на одной из машин сделал, ведь как я понял на второй менять не нужно - IP то остался.
Не могу поднять сеть.
Конфиги Slackware (машина не менявшая IP)
Код: Выделить всё
root@drugz:/etc# cat ipsec.conf
# /etc/ipsec.conf - Openswan IPsec configuration file
# RCSID $Id: ipsec.conf.in,v 1.15.2.2 2005/11/14 20:10:27 paul Exp $
# This file: /usr/local/share/doc/openswan/ipsec.conf-sample
#
# Manual: ipsec.conf.5
version 2.0 # conforms to second version of ipsec.conf specification
# basic configuration
config setup
# plutodebug / klipsdebug = "all", "none" or a combation from below:
# "raw crypt parsing emitting control klips pfkey natt x509 private"
# eg:
# plutodebug="control parsing"
#
# Only enable klipsdebug=all if you are a developer
#
# NAT-TRAVERSAL support, see README.NAT-Traversal
forwardcontrol=yes
nat_traversal=yes
# virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%4:172.16.0.0/12
# Add connections here
# sample VPN connection
#conn sample
# # Left security gateway, subnet behind it, nexthop toward right.
# left=10.0.0.1
# leftsubnet=172.16.0.0/24
# leftnexthop=10.22.33.44
# # Right security gateway, subnet behind it, nexthop toward left.
# right=10.12.12.1
# rightsubnet=192.168.0.0/24
# rightnexthop=10.101.102.103
# # To authorize this connection, but not actually start it,
# # at startup, uncomment this.
# #auto=start
conn main-vpn
# Островского
left=83.246.142.71
leftid=main.aps-k.ru
leftsubnet=10.0.0.0/24
leftrsasigkey=0sAQNhhh7NemSj3WNq50QYMqIZdfDDBEgNAgnmItB5DCfoJLkfxpu+wnyDCoz
CaC/GrMFliZD/BOuDFt16oL+igrc0Wqe8NJNKkxk4QNB2zWkWnc7XssuMVrtMGt9Guf5RxMbXneIV8ZV63or+jpW2hzzm
oVtMoHsg75nTs2kMSBsPIGzE1IlRG21UQRRaDHUtWe07B95Udsxc872Kpi0YtorzHSp8X1pi3JZ7BcRd
W
XuBO72VN+iDElsEMjx0UTJHVL5i93jZffeniGrFtalcvg1D114MRPDbIYu8qn/4pj40vtlofQdzY1B209Zm4ifXpr+JzQo93MuDq0flQ+AgzE4Ionhet0IkXN2w2R/ittmNhAIh
leftnexthop=%defaultroute
# Соц
right=81.201.249.242
rightid=shop1.aps-k.ru
rightsubnet=10.0.2.0/24
rightrsasigkey=0sAQNIwY0b+g2rsgdgd0QAVBH1UPQctTxfDrG73Wx3AQb+GXbcvupDrAMiVz
4J5UQfSwy8QSGuspKVvpiueBwCm/rtSdrUbn9rm5T32KM/Hu59ATrki+horoT5AZqHsU6w4muNxZeIptiwUL+6CZVy7nNhk4aL99l21M1oFlCnu9nO/NNyeM/k7rhceYmqAbUHFAnCshBTUCJBI0l824as2neabG7r1C/VUvBtYO6VVq7Nph4SIUdkpsZ3g8rzOAUEFewjog9loLEiQ78quo3njiOY0gX4v0UNYbSI9eJllWHjE/4jl7ABVEBmzQet/W17MWRbWNSxC3pSv63APWknUQ9xMt8ED7vHUrMTyvWzVcokKpHt
#rightrsasigkey=0sAQNtVLmSaiT9Q15LAacJ5drfgMHw5KgcYVxtyVqXG9NE7a2egRMTU7qea
qpamkMdlR+sly6wPNtNCgsyB456PyYFs/fEFvkZ40fsNrMccCWIK0v4CGf5+Yj4OD3vlJmoayc3mhT0HuJLIP4O3x6VFCzHvnSgYmdGV4OpRe+rt2
fOx0um6gqibK/v3dENfj/f0kCoZhcM1gE99suuhnpRfIn/+WjwAooEOCSA9uiC8bMxtmhSEEuTETkElhY5u9EIXRDlVuTgSIfliDT79Yv9ZbfMiZytEdKfsFNK+Bq9
EjEcta2W+We4Uouwx7RpFn22zEvGsqaLauYVSgVYaRh0hHOIHryVe11XsXv4QMfbzG0141ap
rightnexthop=%defaultroute
auto=start
#Disable Opportunistic Encryption
include /etc/ipsec.d/examples/no_oe.confКод: Выделить всё
root@drugz:/etc/openvpn# cat hydra.conf
proto udp
dev tap
port 1194
ca /etc/openvpn/hydra/ca.crt
cert /etc/openvpn/hydra/comunico.crt
key /etc/openvpn/hydra/comunico.key
client
remote 10.0.2.1 1194Почему имя конфига hydra.conf не знаю.
Конфиги Gentoo (машина поменявшая IP)
Код: Выделить всё
plur ipsec # cat ipsec.conf
# /etc/ipsec.conf - Openswan IPsec configuration file
# RCSID $Id: ipsec.conf.in,v 1.15.2.2 2005/11/14 20:10:27 paul Exp $
# This file: /usr/local/share/doc/openswan/ipsec.conf-sample
#
# Manual: ipsec.conf.5
version 2.0 # conforms to second version of ipsec.conf specification
# basic configuration
config setup
# plutodebug / klipsdebug = "all", "none" or a combation from below:
# "raw crypt parsing emitting control klips pfkey natt x509 private"
# eg:
# plutodebug="control parsing"
#
# Only enable klipsdebug=all if you are a developer
#
# NAT-TRAVERSAL support, see README.NAT-Traversal
forwardcontrol=yes
nat_traversal=yes
# virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%4:172.16.0.0/12
# Add connections here
# sample VPN connection
#conn sample
# # Left security gateway, subnet behind it, nexthop toward right.
# left=10.0.0.1
# leftsubnet=172.16.0.0/24
# leftnexthop=10.22.33.44
# # Right security gateway, subnet behind it, nexthop toward left.
# right=10.12.12.1
# rightsubnet=192.168.0.0/24
# rightnexthop=10.101.102.103
# # To authorize this connection, but not actually start it,
# # at startup, uncomment this.
# #auto=start
conn main-vpn
# Островского
left=83.246.142.71
leftid=main.aps-k.ru
leftsubnet=10.0.0.0/24
leftrsasigkey=0sAQNhhh7NemSj3WNq50QYMqIZdfDDBEgNAgnmItB5DCfoJLkfxpu+wnyDCoz
CaC/GrMFliZD/BOuDFt16oL+igrc0Wqe8NJNKkxk4QNB2zWkWnc7XssuMVrtMGt9Guf5RxMbXneIV8ZV63or+jpW2hzzm
oVtMoHsg75nTs2kMSBsPIGzE1IlRG21UQRRaDHUtWe07B95Udsxc872Kpi0YtorzHSp8X1pi3JZ7BcRd
W
XuBO72VN+iDElsEMjx0UTJHVL5i93jZffeniGrFtalcvg1D114MRPDbIYu8qn/4pj40vtlofQdzY1B209Zm4ifXpr+JzQo93MuDq0flQ+AgzE4Ionhet0IkXN2w2R/ittmNhAIh
leftnexthop=%defaultroute
# Соц
right=81.201.249.242
rightid=shop1.aps-k.ru
rightsubnet=10.0.2.0/24
rightrsasigkey=0sAQNIwY0b+g2rsgdgd0QAVBH1UPQctTxfDrG73Wx3AQb+GXbcvupDrAMiVz
4J5UQfSwy8QSGuspKVvpiueBwCm/rtSdrUbn9rm5T32KM/Hu59ATrki+horoT5AZqHsU6w4muNxZeIptiwUL+6CZVy7nNhk4aL99l21M1oFlCnu9nO/NNyeM/k7rhceYmqAbUHFAnCshBTUCJBI0l824as2neabG7r1C/VUvBtYO6VVq7Nph4SIUdkpsZ3g8rzOAUEFewjog9loLEiQ78quo3njiOY0gX4v0UNYbSI9eJllWHjE/4jl7ABVEBmzQet/W17MWRbWNSxC3pSv63APWknUQ9xMt8ED7vHUrMTyvWzVcokKpHt
rightnexthop=%defaultroute
auto=start
#Disable Opportunistic Encryption
include /etc/ipsec.d/examples/no_oe.confКод: Выделить всё
plur openvpn # cat openvpn.conf
proto udp
dev tap
port 1194
up /etc/openvpn/up.sh
daemon
ca /etc/openvpn/vserver/keys/ca.crt
cert /etc/openvpn/vserver/keys/server.crt
key /etc/openvpn/vserver/keys/server.key
dh /etc/openvpn/vserver/keys/dh1024.pem
verb 3
persist-key
log-append /var/log/openvpn.log
comp-lzo
tls-auth /etc/openvpn/vserver/keys/ta.key 0
server 10.10.10.0 255.255.255.0Сертификаты создавал через easy-rsa
. vars
./clean-all
./build-ca
./build-key-server
./build-key comunico