Archive for the ‘VPN’ Category

OpenVPN

172.16.16.0/22

Network
172.16.16.0

Mask
255.255.252.0

Range

172.16.16.2-172.16.19.254

1022 IP

**** เพียงพอสำหรับ 1000 Client ****

1. Install

root@np:/home/teee# apt install openvpn easy-rsa openssl ca-certificates -y

2. EasyRSA

root@np:/home/teee# make-cadir /etc/openvpn/easy-rsa
root@np:/home/teee# cd /etc/openvpn/easy-rsa

root@np:/etc/openvpn/easy-rsa# ./easyrsa init-pki
Using Easy-RSA ‘vars’ configuration:
* /etc/openvpn/easy-rsa/vars

Notice
——
‘init-pki’ complete; you may now create a CA or requests.

Your newly created PKI dir is:
* /etc/openvpn/easy-rsa/pki

Using Easy-RSA configuration:
* /etc/openvpn/easy-rsa/vars
root@np:/etc/openvpn/easy-rsa# ./easyrsa build-ca nopass
Using Easy-RSA ‘vars’ configuration:
* /etc/openvpn/easy-rsa/vars
…+++++++++++++++++++++++++++++++++++++++*…………+.+…..+…+…………………….+..+…….+..+…+.+..+…….+++++++++++++++++++++++++++++++++++++++*………..+……….+………..+………+.+…+……+…..+….+………+…..+…..+……….+..+……………+….+…+……..+…+……+.+………+…..+.++++++
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:(Your Server-Name)

Notice
——
CA creation complete. Your new CA certificate is at:
* /etc/openvpn/easy-rsa/pki/ca.crt

Create an OpenVPN TLS-AUTH|TLS-CRYPT-V1 key now: See ‘help gen-tls’

Build-ca completed successfully.
——
ตั้งชื่อ CA เช่น. Your Server-Name-CA

สร้าง Server Certificate
root@np:/etc/openvpn/easy-rsa# ./easyrsa build-server-full server nopass
Using Easy-RSA ‘vars’ configuration:
* /etc/openvpn/easy-rsa/vars
.+…+..+++++++++++++++++++++++++++++++++++++++*….+…….+…+…..+++++++++++++++++++++++++++++++++++++++*….+….+……+…+..+…+…………+….+…+..+……+………+.+..+…+….+…+………..+…….+……..+.++++++
—–

Notice
——
Private-Key and Public-Certificate-Request files created.
Your files are:
* req: /etc/openvpn/easy-rsa/pki/reqs/server.req
* key: /etc/openvpn/easy-rsa/pki/private/server.key

You are about to sign the following certificate:

Requested CN: ‘server’
Requested type: ‘server’
Valid for: ‘825’ days

subject=
commonName = server

Type the word ‘yes’ to continue, or any other input to abort.
Confirm requested details: yes (ตอบ yes)

Using configuration from /etc/openvpn/easy-rsa/pki/634563e8/temp.6.1
Check that the request matches the signature
Signature ok
The Subject’s Distinguished Name is as follows
commonName :ASN.1 12:’server’
Certificate is to be certified until Oct 9 09:52:01 2028 GMT (825 days)

Write out database with 1 new entries
Database updated

Notice
——
Inline file created:
* /etc/openvpn/easy-rsa/pki/inline/private/server.inline

Notice
——
Certificate created at:
* /etc/openvpn/easy-rsa/pki/issued/server.crt

DH
root@np:/etc/openvpn/easy-rsa# ./easyrsa gen-dh
Using Easy-RSA ‘vars’ configuration:
* /etc/openvpn/easy-rsa/vars
Generating DH parameters, 2048 bit long safe prime
……………………………………………………………………………………………………………………………………………………………………………….++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*++*
DH parameters appear to be ok.

Notice
——

DH parameters of size 2048 created at:
* /etc/openvpn/easy-rsa/pki/dh.pem

TLS Key

root@np:/etc/openvpn/easy-rsa# openvpn –genkey secret ta.key

Client

root@np:/etc/openvpn/easy-rsa# ./easyrsa build-client-full client01 nopass<—ทดลองสร้าง Client01
Using Easy-RSA ‘vars’ configuration:
* /etc/openvpn/easy-rsa/vars
.+……………+..+.+..+….+…..+++++++++++++++++++++++++++++++++++++++*…..+.+…+…..+…………….+…+..+…+…………+.+..+…+…….+…+…..+.+……+…+……………………+…+..+…………+……………+…+.+..+….+…++++++
—–

Notice
——
Private-Key and Public-Certificate-Request files created.
Your files are:
* req: /etc/openvpn/easy-rsa/pki/reqs/client01.req
* key: /etc/openvpn/easy-rsa/pki/private/client01.key

You are about to sign the following certificate:

Requested CN: ‘client01’
Requested type: ‘client’
Valid for: ‘825’ days

subject=
commonName = client01

Type the word ‘yes’ to continue, or any other input to abort.
Confirm requested details: yes

Using configuration from /etc/openvpn/easy-rsa/pki/3020d3d9/temp.6.1
Check that the request matches the signature
Signature ok
The Subject’s Distinguished Name is as follows
commonName :ASN.1 12:’client01′
Certificate is to be certified until Oct 9 09:55:58 2028 GMT (825 days)

Write out database with 1 new entries
Database updated

Notice
——
Inline file created:
* /etc/openvpn/easy-rsa/pki/inline/private/client01.inline

Notice
——
Certificate created at:
* /etc/openvpn/easy-rsa/pki/issued/client01.crt

3.Copy Files

root@np:/etc/openvpn/easy-rsa# mkdir /etc/openvpn/server
mkdir: cannot create directory ‘/etc/openvpn/server’: File exists
root@np:/etc/openvpn/easy-rsa# ls -l /etc/openvpn/server/
total 0

root@np:/etc/openvpn/easy-rsa# cp pki/ca.crt pki/dh.pem ta.key pki/issued/server.crt pki/private/server.key /etc/openvpn/server/
root@np:/etc/openvpn/easy-rsa# ls -l /etc/openvpn/server/
total 24
-rw——- 1 root root 1196 Jul 7 16:58 ca.crt
-rw——- 1 root root 428 Jul 7 16:58 dh.pem
-rw——- 1 root root 4499 Jul 7 16:58 server.crt
-rw——- 1 root root 1704 Jul 7 16:58 server.key
-rw——- 1 root root 636 Jul 7 16:58 ta.key

4. Server Config
root@np:/etc/openvpn/easy-rsa# nano /etc/openvpn/server/server.conf

port 1194
proto udp

dev tun

user nobody
group nogroup

persist-key
persist-tun

topology subnet

server 172.16.16.0 255.255.252.0

ifconfig-pool-persist ipp.txt

push “route 172.16.19.0 255.255.255.0”

#push “redirect-gateway def1” <— ปิดไว้

push “dhcp-option DNS 1.1.1.1”
push “dhcp-option DNS 8.8.8.8”

keepalive 10 120

cipher AES-256-GCM
data-ciphers AES-256-GCM:AES-128-GCM

auth SHA256

tls-version-min 1.2

tls-crypt ta.key

ca ca.crt
cert server.crt
key server.key
dh dh.pem

verb 3

explicit-exit-notify 1

=== SAVE ===
#push “redirect-gateway def1” <— ปิดไว้
ผู้ใช้ OpenVPN จะเข้าเฉพาะเครือข่ายภายใน แต่ Internet ยังออกผ่าน Wi-Fi/4G ของเครื่องเอง ซึ่งจะไม่เปลืองแบนด์วิดท์ของ VPS

Push Route เฉพาะ Network ภายใน ให้เหลือประมาณนี้

push “route 172.16.16.0 255.255.252.0”
push “route 172.16.19.0 255.255.255.0”

push “dhcp-option DNS 1.1.1.1”
push “dhcp-option DNS 8.8.8.8”

5. Enable Routing
nano /etc/sysctl.conf
net.ipv4.ip_forward=1 <- เพิ่ม

sysctl -p <–Apply

6. IP Tables

root@np:/home/teee# iptables -A INPUT -p udp –dport 1194 -j ACCEPT

iptables -I INPUT 1 -i tun0 -j ACCEPT
iptables -A INPUT -p udp –dport 1194 -j ACCEPT

iptables -A FORWARD -i tun0 -o wg0 -j ACCEPT
iptables -A FORWARD -i wg0 -o tun0 -m conntrack –ctstate RELATED,ESTABLISHED -j ACCEPT

iptables-save > /etc/iptables/rules.v4

ถ้าจะออก Internet ผ่าน OpenVPN ต้องเพิ่ม
iptables -t nat -A POSTROUTING -s 172.16.16.0/22 -o eth0 -j MASQUERADE
แต่ถ้าจะใช้เฉพาะเข้าหา FreeSwitch ไม่จำเป็น

7. Start OPENVPN

root@np:/home/teee# systemctl enable openvpn-server@server
Created symlink ‘/etc/systemd/system/multi-user.target.wants/openvpn-server@server.service’ → ‘/usr/lib/systemd/system/openvpn-server@.service’.
root@np:/home/teee# systemctl start openvpn-server@server

8. Check Status
root@np:/home/teee# netstat -lntup
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name

udp 0 0 0.0.0.0:1194 0.0.0.0:* 423784/openvpn

root@np:/home/teee# ifconfig

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1500
inet 172.16.16.1 netmask 255.255.252.0 destination 172.16.16.1
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 500 (UNSPEC)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

==== ทดสอบ ควรได้ผลดังนี้. ======
# เข้า OpenVPN Server
ping 172.16.16.1

# เข้า WireGuard / FreeSWITCH
ping 172.16.19.1

# เข้า FreeSWITCH ถ้ามี IP อื่น
ping 172.16.19.x

# Internet
ping 8.8.8.8

# DNS
ping google.com

=== แก้ไขเพิ่มเติม ===

root@np:/etc/systemd/system# nano /usr/lib/systemd/system/openvpn-server@.service

GNU nano 8.4 /usr/lib/systemd/system/openvpn-server@.service *
[Unit]
Description=OpenVPN service for %I
After=network-online.target
Wants=network-online.target
Documentation=man:openvpn(8)
Documentation=https://openvpn.net/community-resources/reference-manual-for-openvpn-2-6/
Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO

[Service]
Type=notify
PrivateTmp=true
WorkingDirectory=/etc/openvpn/server
ExecStart=/usr/sbin/openvpn –status %t/openvpn-server/status-%i.log –status-version 2 –suppress-timestamps –config %i.conf
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SETPCAP CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_AU>
LimitNOFILE=65535  <—- เพิ่มบรรทัดนี้
TasksMax=infinity       <—- เพิ่มบรรทัดนี้
OOMScoreAdjust=-900 <—- เพิ่มบรรทัดนี้
LimitNPROC=10 <– เปลี่ยนเป็น 4096
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw
ProtectSystem=true
ProtectHome=true
KillMode=process
RestartSec=5s
Restart=on-failure

[Install]
WantedBy=multi-user.target

===SAVE===

nano /etc/sysctl.conf

net.ipv4.ip_forward = 1
# Connection Queue

net.core.somaxconn=4096

# Socket Buffer

net.core.rmem_max=16777216

net.core.wmem_max=16777216

# Local Port Range

net.ipv4.ip_local_port_range=10240 65535

===SAVE===

มีอีกชุดที่แนะนำเพิ่ม

เนื่องจากคุณตั้งเป้า OpenVPN + WireGuard + FreeSWITCH รองรับประมาณ 1000 Users แนะนำใช้ชุดนี้แทน เพราะครบกว่า
#######################################################
# OpenVPN / WireGuard / FreeSWITCH Performance
#######################################################

# Enable Routing
net.ipv4.ip_forward=1

# TCP Queue
net.core.somaxconn=4096

# Socket Buffers
net.core.rmem_default=1048576
net.core.wmem_default=1048576
net.core.rmem_max=16777216
net.core.wmem_max=16777216

# UDP Memory
net.ipv4.udp_mem=3145728 4194304 6291456

# Port Range
net.ipv4.ip_local_port_range=10240 65535

# Reverse Path Filter
net.ipv4.conf.all.rp_filter=0
net.ipv4.conf.default.rp_filter=0

# SYN Queue
net.ipv4.tcp_max_syn_backlog=4096

# TIME_WAIT
net.ipv4.tcp_fin_timeout=15
===SAVE===

root@np:/etc/systemd/system# systemctl daemon-reload
root@np:/etc/systemd/system# systemctl restart openvpn-server@server

9. สคริต์สร้าง Client เชื่อมต่อ OpenVPN.

#nano make-ovpn.sh
===============================

#!/bin/bash

set -e

EASYRSA=”/etc/openvpn/easy-rsa”

if [ $# -ne 1 ]; then
echo “Usage: $0 ”
exit 1
fi

CLIENT=”$1″

CA=”$EASYRSA/pki/ca.crt”
CERT=”$EASYRSA/pki/issued/${CLIENT}.crt”
KEY=”$EASYRSA/pki/private/${CLIENT}.key”
TLSKEY=”$EASYRSA/ta.key”

OUT=”/root/${CLIENT}.ovpn”

SERVER_IP=”xxx.xxx.xxx.xxx” <—(Your Public IP) SERVER_PORT=”1194″ # ตรวจสอบไฟล์ for FILE in “$CA” “$CERT” “$KEY” “$TLSKEY” do if [ ! -f “$FILE” ]; then echo “Missing file:” echo “$FILE” exit 1 fi done echo “Creating $OUT” cat > “$OUT” <<EOF
client
dev tun
proto udp

remote ${SERVER_IP} ${SERVER_PORT}

resolv-retry infinite
nobind

persist-key
persist-tun

remote-cert-tls server

cipher AES-256-GCM
data-ciphers AES-256-GCM:AES-128-GCM

auth SHA256

auth-nocache

tls-version-min 1.2

verb 3

EOF

cat “$CA” >> “$OUT”

cat >> “$OUT” <<EOF

EOF

awk ‘
/BEGIN CERTIFICATE/ {p=1}
p
/END CERTIFICATE/ {exit}
‘ “$CERT” >> “$OUT”

cat >> “$OUT” <<EOF

EOF

cat “$KEY” >> “$OUT”

cat >> “$OUT” <<EOF

EOF

cat “$TLSKEY” >> “$OUT”

cat >> “$OUT” <<EOF

EOF

chmod 600 “$OUT”

echo
echo “=======================================”
echo “Created:”
echo “$OUT”
echo “=======================================”

 

ใช้ได้กับ OpenVPN 2.6+, macOS, Windows, Linux, Android, iPhone โดยฝัง Certificate และ Key ทั้งหมดไว้ในไฟล์ .ovpn เพียงไฟล์เดียว

chmod +x /root/make-ovpn.sh

สร้าง Client
เช่น

root@np:# /root/make-ovpn.sh macbook

จะได้ไฟล์

/root/macbook.ovpn

ตรวจสอบ รัน

root@np:#grep tls /root/macbook.ovpn

remote-cert-tls server
tls-version-min 1.2
<tls-crypt>
</tls-crypt>

ต้องไม่มี
tls-crypt ta.key

เสร็จแล้ว Copy ไฟล์นี้ไปที่เครื่อง Clinet MAC

ที่เครื่อง MAC ติดตั้งโปรแกรม. OpenVPN Connect for macOS
https://openvpn.net/client/

เสร็จแล้วลอง Import. macbook.ovpn > openvpn Client และลองเชื่อมต่อดู

10. เปิด Status File

root@np:/etc/openvpn/server# nano server.conf

status /var/log/openvpn/openvpn-status.log <—-เพิ่มบรรทัดนี้
status-version 3 <—-เพิ่มบรรทัดนี้

===SAVE===

สร้างโฟลเดอร์

root@np:/etc/openvpn/server# mkdir -p /var/log/openvpn
root@np:/etc/openvpn/server# chown nobody:nogroup /var/log/openvpn

root@np:/etc/systemd/system# systemctl daemon-reload
root@np:/etc/systemd/system# systemctl restart openvpn-server@server

ดู status การเชื่อมต่อแบบ Realtime

root@np:/var/log/openvpn# ls -l
total 4
-rw——- 1 root root 507 Jul 13 12:36 openvpn-status.log
root@np:/var/log/openvpn# tail -f openvpn-status.log
TITLE OpenVPN 2.6.14 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
TIME 2026-07-13 12:36:13 1783920973
HEADER CLIENT_LIST Common Name Real Address Virtual Address Virtual IPv6 Address Bytes Received Bytes Sent Connected Since Connected Since (time_t) Username Client ID Peer ID Data Channel Cipher
HEADER ROUTING_TABLE Virtual Address Common Name Real Address Last Ref Last Ref (time_t)
GLOBAL_STATS Max bcast/mcast queue length 0
GLOBAL_STATS dco_enabled 0
END
e Real Address Last Ref Last Ref (time_t)
ROUTING_TABLE 172.16.16.2 macbook 171.100.89.168:63863 2026-07-13 12:36:41 1783921001
GLOBAL_STATS Max bcast/mcast queue length 0
GLOBAL_STATS dco_enabled 0
END

11. Logrotate

สร้างไฟล์
root@np:~# nano /etc/logrotate.d/openvpn
root@np:~# cat /etc/logrotate.d/openvpn
/var/log/openvpn/*.log {
daily
rotate 30
compress
missingok
notifempty
create 640 nobody nogroup
copytruncate
}

12. เปิด CRL (สำคัญมาก)

เวลาพนักงานลาออก ไม่ต้องเปลี่ยน CA
เพียง

./easyrsa revoke username
./easyrsa gen-crl

แล้ว

crl-verify crl.pem

13. Backup PKI

สิ่งที่ต้อง Backup

/etc/openvpn/easy-rsa/pki

โดยเฉพาะ

private/ca.key <— เก็บไว้ Offline

root@np:/etc/openvpn/easy-rsa/pki/private# ls -l
total 16
-rw——- 1 root root 1704 Jul 7 16:49 ca.key
-rw——- 1 root root 1704 Jul 7 16:55 client01.key
-rw——- 1 root root 1704 Jul 13 11:09 macbook.key
-rw——- 1 root root 1704 Jul 7 16:51 server.key
root@np:/etc/openvpn/easy-rsa/pki/private# cp ca.key /root
root@np:/etc/openvpn/easy-rsa/pki/private#