OPNsense OpenVPN: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
| Zeile 99: | Zeile 99: | ||
***Certificates | ***Certificates | ||
****+ | ****+ | ||
| − | + | {| class="wikitable" | |
| + | ! Feld !! Wert | ||
| + | |- | ||
| + | | Method || Create an internal Certificate | ||
| + | |- | ||
| + | | Description || openserver-cert | ||
| + | |- | ||
| + | | Type || Server Certificate | ||
| + | |- | ||
| + | | Private key location || Save on this firewall | ||
| + | |- | ||
| + | | Key type || RSA-2048 | ||
| + | |- | ||
| + | | Digest Algorithm || SHA256 | ||
| + | |- | ||
| + | | Issuer || opnsense-xin-ca | ||
| + | |- | ||
| + | | Lifetime (days) || 1825 | ||
| + | |- | ||
| + | | Country Code || Germany | ||
| + | |- | ||
| + | | State or Province || | ||
| + | |- | ||
| + | | City || | ||
| + | |- | ||
| + | | Organization || | ||
| + | |- | ||
| + | | Organizational Unit || | ||
| + | |- | ||
| + | | Email Address || | ||
| + | |- | ||
| + | | Common Name || opnsense-zw.tuxmen.de | ||
| + | |- | ||
| + | | OCSP uri || | ||
| + | |} | ||
=Konfiguration= | =Konfiguration= | ||
Version vom 22. August 2025, 15:00 Uhr
Vorab
- Wir sollten immer nur SSL/TLS nutzen
- Dazu müssen wir den DC per Namen auflösen können.
- Und wir brauchen sein Stammzertifikat
Die User kommen von der ADS
- User haben entwder das Attribut
- SamAccountName
oder
- uid
- In der Domain muss ein Binduser und eine Gruppe angelegt sein
- Gruppe: vpnuser
- Binduser: ldapuser
Server anlegen
- System
- Access
- Servers
- Access
| Feld | Wert |
|---|---|
| Descriptive name | openvpn-user |
| Type | LDAP |
| Hostname or IP address | win2022.lab.int |
| Port value | 636 |
| Transport | SSL - Encrypted |
| Protocol version | 3 |
| Bind credentials | cn=ldapuser,ou=Service,dc=lab,dc=int |
| Password | 123Start$ |
| Search scope | Entire Subtree |
| Base DN | dc=lab,dc=int |
| Authentication containers | cn=users,dc=lab,dc=int |
| Extended Query | memberOf=cn=vpnusers,cn=groups,dc=lab,dc=int |
| User naming attribute | uid |
| Read properties | ☑ |
| Synchronize groups | ☑ |
| Constraint groups | ☐ |
| Limit groups | Nothing selected |
| Automatic user creation | ☐ |
| Match case insensitive | ☐ |
CA erstellen
- System
- Trust
- Authorities
- +
- Authorities
- Trust
| Feld | Wert |
|---|---|
| Description | opnsense-xin-ca |
| Key type | RSA-2048 |
| Digest Algorithm | SHA256 |
| Issuer | self-signed |
| Lifetime (days) | 825 |
| Country Code | Germany |
| State or Province | |
| City | |
| Organization | |
| Organizational Unit | |
| Email Address | |
| Common Name | opnsense-xin-ca |
| OCSP uri |
Cert für den Openvpn Server erstellen
- System
- Trust
- Certificates
- +
- Certificates
- Trust
| Feld | Wert |
|---|---|
| Method | Create an internal Certificate |
| Description | openserver-cert |
| Type | Server Certificate |
| Private key location | Save on this firewall |
| Key type | RSA-2048 |
| Digest Algorithm | SHA256 |
| Issuer | opnsense-xin-ca |
| Lifetime (days) | 1825 |
| Country Code | Germany |
| State or Province | |
| City | |
| Organization | |
| Organizational Unit | |
| Email Address | |
| Common Name | opnsense-zw.tuxmen.de |
| OCSP uri |
Konfiguration
- Static Key generieren
- VPN
- OpenVPN
- Instances
- Static Keys
- +
- Static Keys
- Instances
- OpenVPN
Wir wählen Auth als Crypt
- Auf das Zahnrad klicken
- Dern Server konfigurieren
- VPN
- OpenVPN
- Instances
- Instances
- +
- Instances
- Instances
- OpenVPN
Firewall Regeln
- WAN
- Firewall
- Rules
- WAN
- +
- WAN
- Rules
- OpenVPN
- Firewall
- Rules
- OpenVPN
- +
- OpenVPN
- Rules
Die Client Konfiguration exportieren
- VPN
- OpenVPN
- Client Export
- OpenVPN
