|
|
@@ -0,0 +1,277 @@
|
|
|
+# Installation
|
|
|
+- Wird an anderer Stelle des Wiki beschrieben
|
|
|
+
|
|
|
+# Allgemein
|
|
|
+- Informationen auf dieser Seite sind teilweise von anderen Wiki-Seiten übernommen.
|
|
|
+
|
|
|
+Hier sollen die Schritte nach der Installation von Debian 10 (buster) zum Aufbau eines VPN mit Tinc und Bird beschrieben werden.
|
|
|
+Für die meisten Befehle sind root Rechte erforderlich.
|
|
|
+
|
|
|
+# Hardware
|
|
|
+- APU mit Buster ohne grafische Oberfläche
|
|
|
+- Laptop mit Ubuntu 18.04
|
|
|
+
|
|
|
+Es werden für alle Interfaces statische IPV4 Adressen verwendet, auf dem Laptop ist auch DHCP aktiv.
|
|
|
+Die hier verwendeten Adressen sind dem Wiki [IP-Adressen](IP-Adressen) für berghofen entnommen.
|
|
|
+
|
|
|
+berghofen, wie auch die anderen Standorte, bestehen jeweils mindesten aus der APU und einem Laptop sowie einem Internetrouter (F!Box).
|
|
|
+An jedem Standort gibt es eine Tincverbindung zwischen APU und Laptop, lan genannt, und eine Tincverbindung zwischen APU und den anderen Standorten, wan.
|
|
|
+
|
|
|
+# Software
|
|
|
+- Debian 10.7 (buster), auf dem Laptop Ubuntu 18.04
|
|
|
+- Tinc 1.1pre17 oder tinc 1.0.36
|
|
|
+- Bird 2.07
|
|
|
+
|
|
|
+# Dateien der APU
|
|
|
+/etc/network/interfaces
|
|
|
+
|
|
|
+ # This file describes the network interfaces available on your system
|
|
|
+ # and how to activate them. For more information, see interfaces(5).
|
|
|
+
|
|
|
+ source /etc/network/interfaces.d/*
|
|
|
+
|
|
|
+ # The loopback network interface
|
|
|
+ auto lo
|
|
|
+ iface lo inet loopback
|
|
|
+ up ip addr add 193.43.220.130/32 dev lo
|
|
|
+ up /home/fb/bin/r
|
|
|
+
|
|
|
+ # The primary network interface
|
|
|
+ allow-hotplug enp1s0
|
|
|
+ iface enp1s0 inet static
|
|
|
+ address 192.168.178.51/24
|
|
|
+ # gateway 192.168.178.254 #default gateway wird von bird erledigt
|
|
|
+ broadcast 192.168.178.255
|
|
|
+ # dns-* options are implemented by the resolvconf package, if installed
|
|
|
+ dns-nameservers 192.168.178.254
|
|
|
+ dns-search fritz.box
|
|
|
+
|
|
|
+ allow-hotplug wan
|
|
|
+ iface wan inet static
|
|
|
+ address 193.43.220.162/27
|
|
|
+ broadcast 193.43.220.191
|
|
|
+ mtu 1504
|
|
|
+
|
|
|
+ allow-hotplug lan
|
|
|
+ iface lan inet static
|
|
|
+ address 192.168.34.1/24
|
|
|
+ broadcast 192.168.34.255
|
|
|
+ mtu 1504
|
|
|
+
|
|
|
+ #allow-hotplug wlp5s0
|
|
|
+ #iface wlp5s0 inet dhcp
|
|
|
+
|
|
|
+# Tinc Verzeichnistruktur Tinc APU und Laptop Einstellungen
|
|
|
+
|
|
|
+
|
|
|
+ etc/tinc/
|
|
|
+ |-- lan
|
|
|
+ | |-- hosts
|
|
|
+ | | |-- apu
|
|
|
+ | | `-- laptop
|
|
|
+ | |-- rsa_key.priv
|
|
|
+ | |-- ed25519_key.priv ## nur bei tinc 1.1
|
|
|
+ | `-- tinc.conf
|
|
|
+ `-- wan ## wan Verzeichis nur auf der APU
|
|
|
+ |-- hosts
|
|
|
+ | |-- berghofen
|
|
|
+ | |-- hoerde
|
|
|
+ | `-- nordstadt
|
|
|
+ |-- rsa_key.priv
|
|
|
+ |-- ed25519_key.priv ## nur bei tinc 1.1
|
|
|
+ `-- tinc.conf
|
|
|
+
|
|
|
+/etc/tinc/lan/tinc.conf
|
|
|
+
|
|
|
+ ## APU lan tinc.conf
|
|
|
+ Name = apu
|
|
|
+ Device = /dev/net/tun
|
|
|
+ Mode = switch
|
|
|
+ AddressFamily = ipv4
|
|
|
+ BindToAddress = 192.168.178.51
|
|
|
+ Port = 10001
|
|
|
+ MaxTimeout = 30
|
|
|
+ GraphDumpFile = /var/run/tinc.lan.dot
|
|
|
+ ConnectTo = laptop
|
|
|
+
|
|
|
+/etc/tinc/wan/tinc.conf
|
|
|
+
|
|
|
+ ## APU wan tinc.conf
|
|
|
+ Name = berghofen
|
|
|
+ Device = /dev/net/tun
|
|
|
+ Mode = switch
|
|
|
+ AddressFamily = ipv4
|
|
|
+ BindToaddress = 192.168.178.51
|
|
|
+ Port = 661
|
|
|
+ MaxTimeout = 30
|
|
|
+ GraphDumpFile = /var/run/tinc.wan.dot
|
|
|
+ ConnectTo = hoerde
|
|
|
+ ConnectTo = nordstadt
|
|
|
+
|
|
|
+Inhalt der hosts Dateien
|
|
|
+
|
|
|
+Die ED25519PublicKey Zeile existiert nur bei tinc 1.1
|
|
|
+
|
|
|
+/etc/tinc/lan/hosts/apu auf APU und laptop
|
|
|
+
|
|
|
+ Address = 192.168.178.51
|
|
|
+ Port = 10001
|
|
|
+
|
|
|
+ -----BEGIN RSA PUBLIC KEY-----
|
|
|
+ Schlüsseldaten
|
|
|
+ -----END RSA PUBLIC KEY-----
|
|
|
+ Ed25519PublicKey = WmAmMY95+B/A9FDQz7ZiV6WQcG2qAUUclRP52dwXSdD
|
|
|
+
|
|
|
+
|
|
|
+/etc/tinc/lan/hosts/laptop auf APU und laptop
|
|
|
+
|
|
|
+ Address = 192.168.178.52
|
|
|
+ Port = 10001
|
|
|
+
|
|
|
+ -----BEGIN RSA PUBLIC KEY-----
|
|
|
+ Schlüsseldaten
|
|
|
+ -----END RSA PUBLIC KEY-----
|
|
|
+ Ed25519PublicKey = WCkEAe/gohI7JAGLiHPKdE+ayxYrG1wuTfQQijAROuD
|
|
|
+
|
|
|
+
|
|
|
+/etc/tinc/wan/hosts/berghofen auf APU
|
|
|
+
|
|
|
+ -----BEGIN RSA PUBLIC KEY-----
|
|
|
+ Schlüsseldaten
|
|
|
+ -----END RSA PUBLIC KEY-----
|
|
|
+ Ed25519PublicKey = Tkhp7t+MsmQKsWIkO5qimTKoWdkvRigKwctxtfOu2MF
|
|
|
+
|
|
|
+
|
|
|
+/etc/tinc/wan/hosts/hoerde auf APU
|
|
|
+
|
|
|
+ Address = 130.180.53.22
|
|
|
+ Port = 661
|
|
|
+
|
|
|
+ -----BEGIN RSA PUBLIC KEY-----
|
|
|
+ Schlüsseldaten
|
|
|
+ -----END RSA PUBLIC KEY-----
|
|
|
+ Ed25519PublicKey = MjaltxtfPP1SdHgNH/dUuHmbYDXFdZMEUUbl0Qi/YCA
|
|
|
+
|
|
|
+
|
|
|
+/etc/tinc/wan/hosts/nordstadt auf APU
|
|
|
+
|
|
|
+ Address = 91.204.4.53
|
|
|
+ Port = 661
|
|
|
+
|
|
|
+ -----BEGIN RSA PUBLIC KEY-----
|
|
|
+ Schlüsseldaten
|
|
|
+ -----END RSA PUBLIC KEY-----
|
|
|
+ Ed25519PublicKey = 4znU87BKnctOFb+/JQhIltGtYN3h3czOVInolRPWgvA
|
|
|
+
|
|
|
+Beide Tinc Instanzen können auf der APU parallel gestartet werden
|
|
|
+
|
|
|
+ systemctl start tinc@lan
|
|
|
+ systemctl start tinc@wan
|
|
|
+
|
|
|
+
|
|
|
+# Bird auf der APU
|
|
|
+
|
|
|
+/etc/iproute2/rt_tables identisch auf APU / laptop
|
|
|
+
|
|
|
+ #
|
|
|
+ # reserved values
|
|
|
+ #
|
|
|
+ 255 local
|
|
|
+ 254 main
|
|
|
+ 253 default
|
|
|
+ 0 unspec
|
|
|
+ #
|
|
|
+ # local
|
|
|
+ #
|
|
|
+ 1 tinc
|
|
|
+
|
|
|
+
|
|
|
+- Die bird.conf des laptops ist bis auf andere IP adressen und der fehlende Eintrag für interface wan identisch
|
|
|
+
|
|
|
+
|
|
|
+/etc/bird/bird.conf
|
|
|
+
|
|
|
+ router id 193.43.220.130; /* public IP APU */
|
|
|
+
|
|
|
+ log syslog { debug, info, trace, remote }; /* optional */
|
|
|
+
|
|
|
+ define AS35675_all = [
|
|
|
+ 193.43.220.0/23
|
|
|
+ ];
|
|
|
+
|
|
|
+ define AS35675_any = [
|
|
|
+ 193.43.220.0/23+
|
|
|
+ ];
|
|
|
+
|
|
|
+ protocol device device0 {
|
|
|
+ scan time 10;
|
|
|
+ }
|
|
|
+
|
|
|
+
|
|
|
+ /* wg. BSD: */
|
|
|
+ protocol direct direct0 {
|
|
|
+ ipv4;
|
|
|
+ }
|
|
|
+
|
|
|
+ protocol kernel kernel0 {
|
|
|
+ learn on;
|
|
|
+ scan time 120;
|
|
|
+ ipv4 {
|
|
|
+ import all;
|
|
|
+ export where source != RTS_DEVICE;
|
|
|
+ };
|
|
|
+ }
|
|
|
+
|
|
|
+ # erstellt neue routing tabelle
|
|
|
+ ipv4 table fib1table;
|
|
|
+
|
|
|
+ #RTS route source
|
|
|
+ #import / export
|
|
|
+ protocol kernel kernel1 {
|
|
|
+ kernel table 1;
|
|
|
+ learn on;
|
|
|
+ scan time 120;
|
|
|
+ ipv4 {
|
|
|
+ table fib1table;
|
|
|
+ import all;
|
|
|
+ export where source != RTS_DEVICE;
|
|
|
+ };
|
|
|
+ }
|
|
|
+
|
|
|
+ protocol static static1 {
|
|
|
+ ipv4 {
|
|
|
+ table fib1table;
|
|
|
+ };
|
|
|
+ route 0.0.0.0/0 via 192.168.178.254; /* zur F!Box */
|
|
|
+ }
|
|
|
+
|
|
|
+ protocol ospf ospfwan {
|
|
|
+ ipv4 {
|
|
|
+ import all;
|
|
|
+ export where net ~ AS35675_any;
|
|
|
+ };
|
|
|
+ area 0.0.0.0 {
|
|
|
+ stubnet 193.43.220.130/32 { cost 1; };
|
|
|
+ interface "wan" { /* 4 Zeilen ab hier nur APU */
|
|
|
+ type broadcast;
|
|
|
+ cost 100;
|
|
|
+ };
|
|
|
+ interface "lan" {
|
|
|
+ type broadcast;
|
|
|
+ cost 10;
|
|
|
+ };
|
|
|
+ };
|
|
|
+ }
|
|
|
+
|
|
|
+
|
|
|
+Den bird starten.
|
|
|
+
|
|
|
+ systemctl start bird
|
|
|
+
|
|
|
+# Sonstiges
|
|
|
+
|
|
|
+/etc/sysctl.conf
|
|
|
+
|
|
|
+ # Uncomment the next line to enable packet forwarding for IPv4
|
|
|
+ net.ipv4.ip_forward=1
|
|
|
+
|
