{"id":982,"date":"2024-11-25T09:55:25","date_gmt":"2024-11-25T01:55:25","guid":{"rendered":"https:\/\/blog.espnlol.com\/?p=982"},"modified":"2024-12-24T16:53:56","modified_gmt":"2024-12-24T08:53:56","slug":"%e9%85%8d%e7%bd%ae%e5%ae%a2%e6%88%b7%e7%ab%af%e7%89%b9%e5%ae%9a%e8%a7%84%e5%88%99%e5%92%8c%e8%ae%bf%e9%97%ae%e7%ad%96%e7%95%a5","status":"publish","type":"post","link":"https:\/\/blog.espnlol.com\/?p=982","title":{"rendered":"openvpn\u914d\u7f6e\u5ba2\u6237\u7aef\u7279\u5b9a\u89c4\u5219\u548c\u8bbf\u95ee\u7b56\u7565"},"content":{"rendered":"\n<h4 class=\"wp-block-heading\"><\/h4>\n\n\n\n<p>\u5047\u8bbe\u6211\u4eec\u6b63\u5728\u8bbe\u7f6e\u516c\u53f8 VPN\uff0c\u5e76\u4e14\u6211\u4eec\u60f3\u4e3a 3 \u4e2a\u4e0d\u540c\u7c7b\u522b\u7684\u7528\u6237\u5efa\u7acb\u5355\u72ec\u7684\u8bbf\u95ee\u7b56\u7565\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u7cfb\u7edf\u7ba1\u7406\u5458<\/strong>&nbsp;&#8211;\u5bf9\u7f51\u7edc\u4e0a\u6240\u6709\u673a\u5668\u7684\u5b8c\u5168\u8bbf\u95ee\u6743\u9650<\/li>\n\n\n\n<li><strong>\u5458\u5de5<\/strong>&nbsp;\u2014\u2014\u4ec5\u53ef\u8bbf\u95ee Samba\/\u7535\u5b50\u90ae\u4ef6\u670d\u52a1\u5668<\/li>\n\n\n\n<li><strong>\u627f\u5305\u5546<\/strong>\u00a0\u2014\u2014\u4ec5\u53ef\u8bbf\u95ee\u7279\u6b8a\u670d\u52a1\u56681<\/li>\n<\/ul>\n\n\n\n<p>\u6211\u4eec\u91c7\u53d6\u7684\u57fa\u672c\u65b9\u6cd5\u662f\uff1a(a) \u5c06\u6bcf\u4e2a\u7528\u6237\u7c7b\u522b\u9694\u79bb\u5230\u5176\u81ea\u5df1\u7684\u865a\u62df IP \u5730\u5740\u8303\u56f4\u5185\uff0c(b) \u901a\u8fc7\u8bbe\u7f6e\u4ee5\u5ba2\u6237\u7aef\u7684\u865a\u62df IP \u5730\u5740\u4e3a\u5173\u952e\u7684\u9632\u706b\u5899\u89c4\u5219\u6765\u63a7\u5236\u5bf9\u673a\u5668\u7684\u8bbf\u95ee\u3002<\/p>\n\n\n\n<p>\u5728\u6211\u4eec\u7684\u793a\u4f8b\u4e2d\uff0c\u5047\u8bbe\u6211\u4eec\u7684\u5458\u5de5\u6570\u91cf\u4e0d\u5b9a\uff0c\u4f46\u53ea\u6709\u4e00\u540d\u7cfb\u7edf\u7ba1\u7406\u5458\u548c\u4e24\u540d\u627f\u5305\u5546\u3002\u6211\u4eec\u7684 IP \u5206\u914d\u65b9\u6cd5\u662f\u5c06\u6240\u6709\u5458\u5de5\u653e\u5165 IP \u5730\u5740\u6c60\u4e2d\uff0c\u7136\u540e\u4e3a\u7cfb\u7edf\u7ba1\u7406\u5458\u548c\u627f\u5305\u5546\u5206\u914d\u56fa\u5b9a\u7684 IP \u5730\u5740\u3002<\/p>\n\n\n\n<p>\u8bf7\u6ce8\u610f\uff0c\u672c\u793a\u4f8b\u7684\u5148\u51b3\u6761\u4ef6\u4e4b\u4e00\u662f\u60a8\u5728 OpenVPN \u670d\u52a1\u5668\u8ba1\u7b97\u673a\u4e0a\u8fd0\u884c\u4e86\u8f6f\u4ef6\u9632\u706b\u5899\uff0c\u8fd9\u4f7f\u60a8\u53ef\u4ee5\u5b9a\u4e49\u7279\u5b9a\u7684\u9632\u706b\u5899\u89c4\u5219\u3002\u5728\u6211\u4eec\u7684\u793a\u4f8b\u4e2d\uff0c\u6211\u4eec\u5047\u8bbe\u9632\u706b\u5899\u662f Linux&nbsp;&nbsp;<strong>iptables<\/strong>\u3002<\/p>\n\n\n\n<p>\u9996\u5148\u6211\u4eec\u6839\u636e\u7528\u6237\u7c7b\u522b\u521b\u5efa\u4e00\u4e2a\u865a\u62dfIP\u5730\u5740\u6620\u5c04\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td><strong>\u73ed\u7ea7<\/strong><\/td><td><strong>\u865a\u62df IP \u8303\u56f4<\/strong><\/td><td><strong>\u5141\u8bb8 LAN \u8bbf\u95ee<\/strong><\/td><td><strong>\u5e38\u7528\u540d\u79f0<\/strong><\/td><\/tr><tr><td>\u96c7\u5458<\/td><td>10.8.0.0\/24<\/td><td>Samba\/\u7535\u5b50\u90ae\u4ef6\u670d\u52a1\u5668\u4f4d\u4e8e 10.66.4.4<\/td><td>[\u591a\u53d8\u7684]<\/td><\/tr><tr><td>\u7cfb\u7edf\u7ba1\u7406\u5458<\/td><td>10.8.1.0\/24<\/td><td>\u6574\u4e2a 10.66.4.0\/24 \u5b50\u7f51<\/td><td>\u7cfb\u7edf\u7ba1\u7406\u54581<\/td><\/tr><tr><td>\u627f\u5305\u5546<\/td><td>10.8.2.0\/24<\/td><td>\u627f\u5305\u5546\u670d\u52a1\u5668\u4f4d\u4e8e 10.66.4.12<\/td><td>\u627f\u5305\u55461\u3001\u627f\u5305\u55462<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>\u63a5\u4e0b\u6765\uff0c\u8ba9\u6211\u4eec\u5c06\u6b64\u6620\u5c04\u8f6c\u6362\u4e3a OpenVPN \u670d\u52a1\u5668\u914d\u7f6e\u3002\u9996\u5148\uff0c\u786e\u4fdd\u60a8\u5df2\u6309\u7167&nbsp;<a href=\"https:\/\/openvpn.net\/community-resources\/how-to\/#expanding-the-scope-of-the-vpn-to-include-additional-machines-on-either-the-client-or-server-subnet\">\u4e0a\u8ff0<\/a>\u6b65\u9aa4&nbsp;\u4f7f 10.66.4.0\/24 \u5b50\u7f51\u53ef\u4f9b\u6240\u6709\u5ba2\u6237\u7aef\u4f7f\u7528\uff08\u867d\u7136\u6211\u4eec\u5c06\u914d\u7f6e\u8def\u7531\u4ee5\u5141\u8bb8\u5ba2\u6237\u7aef\u8bbf\u95ee\u6574\u4e2a 10.66.4.0\/24 \u5b50\u7f51\uff0c\u4f46\u6211\u4eec\u5c06\u4f7f\u7528\u9632\u706b\u5899\u89c4\u5219\u65bd\u52a0\u8bbf\u95ee\u9650\u5236\u4ee5\u5b9e\u73b0\u4e0a\u8ff0\u7b56\u7565\u8868\uff09\u3002<\/p>\n\n\n\n<p><strong>\u9996\u5148\uff0c\u4e3a\u6211\u4eec\u7684tun<\/strong>\u63a5\u53e3\u5b9a\u4e49\u4e00\u4e2a\u9759\u6001\u5355\u5143\u53f7&nbsp;&nbsp;\uff0c\u4ee5\u4fbf\u6211\u4eec\u7a0d\u540e\u53ef\u4ee5\u5728\u9632\u706b\u5899\u89c4\u5219\u4e2d\u5f15\u7528\u5b83\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">dev tun0<\/pre>\n\n\n\n<p>\u5728\u670d\u52a1\u5668\u914d\u7f6e\u6587\u4ef6\u4e2d\uff0c\u5b9a\u4e49\u5458\u5de5IP\u5730\u5740\u6c60\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">server 10.8.0.0 255.255.255.0<\/pre>\n\n\n\n<p>\u4e3a\u7cfb\u7edf\u7ba1\u7406\u5458\u548c\u627f\u5305\u5546 IP \u8303\u56f4\u6dfb\u52a0\u8def\u7531\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">route 10.8.1.0 255.255.255.0\nroute 10.8.2.0 255.255.255.0<\/pre>\n\n\n\n<p>\u56e0\u4e3a\u6211\u4eec\u5c06\u4e3a\u7279\u5b9a\u7684\u7cfb\u7edf\u7ba1\u7406\u5458\u548c\u627f\u5305\u5546\u5206\u914d\u56fa\u5b9a\u7684 IP \u5730\u5740\uff0c\u6240\u4ee5\u6211\u4eec\u5c06\u4f7f\u7528\u5ba2\u6237\u7aef\u914d\u7f6e\u76ee\u5f55\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">client-config-dir ccd<\/pre>\n\n\n\n<p>\u73b0\u5728\u5c06\u7279\u6b8a\u7684\u914d\u7f6e\u6587\u4ef6\u653e\u5728&nbsp;<strong>ccd<\/strong>&nbsp;\u5b50\u76ee\u5f55\u4e2d\uff0c\u4e3a\u6bcf\u4e2a\u975e\u5458\u5de5 VPN \u5ba2\u6237\u7aef\u5b9a\u4e49\u56fa\u5b9a IP \u5730\u5740\u3002<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"ccd-sysadmin1\">ccd\/\u7cfb\u7edf\u7ba1\u7406\u54581<\/h3>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">ifconfig-push 10.8.1.1 10.8.1.2<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"ccd-contractor1\">ccd\/\u627f\u5305\u55461<\/h3>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">ifconfig-push 10.8.2.1 10.8.2.2<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"ccd-contractor2\">ccd\/\u627f\u5305\u55462<\/h3>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">ifconfig-push 10.8.2.5 10.8.2.6<\/pre>\n\n\n\n<p>\u6bcf\u5bf9&nbsp;<strong>ifconfig-push<\/strong>&nbsp;\u5730\u5740\u4ee3\u8868\u865a\u62df\u5ba2\u6237\u7aef\u548c\u670d\u52a1\u5668 IP \u7aef\u70b9\u3002\u5b83\u4eec\u5fc5\u987b\u53d6\u81ea\u8fde\u7eed\u7684 \/30 \u5b50\u7f51\uff0c\u4ee5\u4fbf\u4e0e Windows \u5ba2\u6237\u7aef\u548c TAP-Windows \u9a71\u52a8\u7a0b\u5e8f\u517c\u5bb9\u3002\u5177\u4f53\u6765\u8bf4\uff0c\u6bcf\u4e2a\u7aef\u70b9\u5bf9\u7684 IP \u5730\u5740\u4e2d\u7684\u6700\u540e\u4e00\u4e2a\u516b\u4f4d\u5b57\u8282\u5fc5\u987b\u53d6\u81ea\u4ee5\u4e0b\u96c6\u5408\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">[  1,  2] [  5,  6] [  9, 10] [ 13, 14] [ 17, 18]\n[ 21, 22] [ 25, 26] [ 29, 30] [ 33, 34] [ 37, 38]\n[ 41, 42] [ 45, 46] [ 49, 50] [ 53, 54] [ 57, 58]\n[ 61, 62] [ 65, 66] [ 69, 70] [ 73, 74] [ 77, 78]\n[ 81, 82] [ 85, 86] [ 89, 90] [ 93, 94] [ 97, 98]\n[101,102] [105,106] [109,110] [113,114] [117,118]\n[121,122] [125,126] [129,130] [133,134] [137,138]\n[141,142] [145,146] [149,150] [153,154] [157,158]\n[161,162] [165,166] [169,170] [173,174] [177,178]\n[181,182] [185,186] [189,190] [193,194] [197,198]\n[201,202] [205,206] [209,210] [213,214] [217,218]\n[221,222] [225,226] [229,230] [233,234] [237,238]\n[241,242] [245,246] [249,250] [253,254]<\/pre>\n\n\n\n<p>\u8fd9\u6837\u5c31\u5b8c\u6210\u4e86 OpenVPN \u7684\u914d\u7f6e\u3002\u6700\u540e\u4e00\u6b65\u662f\u6dfb\u52a0\u9632\u706b\u5899\u89c4\u5219\u4ee5\u5b8c\u6210\u8bbf\u95ee\u7b56\u7565\u3002\u5728\u672c\u793a\u4f8b\u4e2d\uff0c\u6211\u4eec\u5c06\u4f7f\u7528 Linux&nbsp;&nbsp;<strong>iptables<\/strong>&nbsp;\u8bed\u6cd5\u4e2d\u7684\u9632\u706b\u5899\u89c4\u5219\uff1a<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\"># Employee rule\niptables -A FORWARD -i tun0 -s 10.8.0.0\/24 -d 10.66.4.4 -j ACCEPT\n\n# Sysadmin rule\niptables -A FORWARD -i tun0 -s 10.8.1.0\/24 -d 10.66.4.0\/24 -j ACCEPT\n\n# Contractor rule\niptables -A FORWARD -i tun0 -s 10.8.2.0\/24 -d 10.66.4.12 -j ACCEPT<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>\u5047\u8bbe\u6211\u4eec\u6b63\u5728\u8bbe\u7f6e\u516c\u53f8 VPN\uff0c\u5e76\u4e14\u6211\u4eec\u60f3\u4e3a 3 \u4e2a\u4e0d\u540c\u7c7b\u522b\u7684\u7528\u6237\u5efa\u7acb\u5355\u72ec\u7684\u8bbf\u95ee\u7b56 &hellip; <a href=\"https:\/\/blog.espnlol.com\/?p=982\">\u7ee7\u7eed\u9605\u8bfb <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[31],"tags":[],"class_list":["post-982","post","type-post","status-publish","format-standard","hentry","category-openwrt"],"_links":{"self":[{"href":"https:\/\/blog.espnlol.com\/index.php?rest_route=\/wp\/v2\/posts\/982","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.espnlol.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.espnlol.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.espnlol.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.espnlol.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=982"}],"version-history":[{"count":3,"href":"https:\/\/blog.espnlol.com\/index.php?rest_route=\/wp\/v2\/posts\/982\/revisions"}],"predecessor-version":[{"id":987,"href":"https:\/\/blog.espnlol.com\/index.php?rest_route=\/wp\/v2\/posts\/982\/revisions\/987"}],"wp:attachment":[{"href":"https:\/\/blog.espnlol.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=982"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.espnlol.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=982"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.espnlol.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=982"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}