{"id":413,"date":"2018-03-27T20:35:49","date_gmt":"2018-03-27T19:35:49","guid":{"rendered":"http:\/\/www.carinato.net\/?p=413"},"modified":"2018-03-27T20:35:49","modified_gmt":"2018-03-27T19:35:49","slug":"configurare-open-vpn-su-mikrotik-routeros","status":"publish","type":"post","link":"https:\/\/carinato.com\/?p=413","title":{"rendered":"Configurare Open VPN su Mikrotik RouterOS"},"content":{"rendered":"

La seguente guida (spudoratamente ispirata da qui<\/a> ) spiega come installare una Open VPN sul sistema RouterOS di Mikrotik (testato sulla versione 6.41.3)<\/p>\n

Partiamo da una configurazione Base del Mikrotik<\/p>\n

\/system reset-configuration<\/pre>\n
Assegnare l’identificativo al Mikrotik da<\/p>\n
\/system<\/span> identity<\/span> set<\/span> name<\/span>=\"<\/span>MioMikrotik<\/span><\/strong>\"<\/span><\/pre>\n
Impostare l’ora esatta con NTP:<\/p>\n
\/system ntp client set mode=unicast enabled=yes servers=([:resolve 0.it.pool.ntp.org],[:resolve 1.it.pool.ntp.org])\n<\/span><\/pre>\n
Impostare il fuso orario:<\/p>\n
\/system<\/span> clock<\/span> set<\/span> time-zone-name<\/span>=<\/span>Europe\/Rome<\/span><\/pre>\n
Copiare questo script personalizzando le variabili global<\/strong> alle prime linee<\/p>\n
# Setup OpenVPN Server and generate certs<\/span>\n#<\/span>\n# Change variables below and paste the script<\/span>\n# into MikroTik terminal window.<\/span>\n#<\/span>\n\n:global CN [\/system identity get name]\n:global COUNTRY \"<\/span>IT\"<\/span><\/span>\n:global STATE \"<\/span>MYSTATE\"<\/span><\/span>\n:global LOC \"<\/span>MYCITY\"<\/span><\/span>\n:global ORG \"<\/span>MyOrg\"<\/span><\/span>\n:global OU \"<\/span>\"<\/span><\/span>\n:global KEYSIZE \"<\/span>2048\"<\/span><\/span>\n\n## functions<\/span>\n:global waitSec do<\/span>={:return ($KEYSIZE * 10 \/ 1024)}\n\n## generate a CA certificate<\/span>\n\/certificate\n\nadd name<\/span>=ca-template country<\/span>=\"<\/span>$COUNTRY\"<\/span><\/span> state<\/span>=\"<\/span>$STATE\"<\/span><\/span> locality<\/span>=\"<\/span>$LOC\"<\/span><\/span> \\\n  organization<\/span>=\"<\/span>$ORG\"<\/span><\/span> unit<\/span>=\"<\/span>$OU\"<\/span><\/span> common-name<\/span>=\"<\/span>$CN\"<\/span><\/span> key-size<\/span>=\"<\/span>$KEYSIZE\"<\/span><\/span> \\\n  days-valid<\/span>=3650 key-usage<\/span>=crl-sign,key-cert-sign\nsign ca-template ca-crl-host<\/span>=127.0.0.1 name<\/span>=\"<\/span>$CN\"<\/span><\/span>\n:delay [$waitSec]\n\n## generate a server certificate<\/span>\n\/certificate\nadd name<\/span>=server-template country<\/span>=\"<\/span>$COUNTRY\"<\/span><\/span> state<\/span>=\"<\/span>$STATE\"<\/span><\/span> locality<\/span>=\"<\/span>$LOC\"<\/span><\/span> \\\n  organization<\/span>=\"<\/span>$ORG\"<\/span><\/span> unit<\/span>=\"<\/span>$OU\"<\/span><\/span> common-name<\/span>=\"<\/span>server@$CN\"<\/span><\/span> key-size<\/span>=\"<\/span>$KEYSIZE\"<\/span><\/span> \\\n  days-valid<\/span>=3650 key-usage<\/span>=digital-signature,key-encipherment,tls-server\nsign server-template ca<\/span>=\"<\/span>$CN\"<\/span><\/span> name<\/span>=\"<\/span>server@$CN\"<\/span><\/span>\n:delay [$waitSec]\n\n## create a client template<\/span>\n\/certificate\nadd name<\/span>=client-template country<\/span>=\"<\/span>$COUNTRY\"<\/span><\/span> state<\/span>=\"<\/span>$STATE\"<\/span><\/span> locality<\/span>=\"<\/span>$LOC\"<\/span><\/span> \\\n  organization<\/span>=\"<\/span>$ORG\"<\/span><\/span> unit<\/span>=\"<\/span>$OU\"<\/span><\/span> common-name<\/span>=\"<\/span>client\"<\/span><\/span> \\\n  key-size<\/span>=\"<\/span>$KEYSIZE\"<\/span><\/span> days-valid<\/span>=3650 key-usage<\/span>=tls-client\n\n## create IP pool<\/span>\n\/ip pool\nadd name<\/span>=VPN-POOL ranges<\/span>=192.168.252.128-192.168.252.224\n\n## add VPN profile<\/span>\n\/ppp profile\nadd dns-server<\/span>=192.168.252.1 local-address<\/span>=192.168.252.1 name<\/span>=VPN-PROFILE \\\n  remote-address<\/span>=VPN-POOL use-encryption<\/span>=yes\n\n## setup OpenVPN server<\/span>\n\/interface ovpn-server server\nset auth<\/span>=sha1 certificate<\/span>=\"<\/span>server@$CN\"<\/span><\/span> cipher<\/span>=aes128,aes192,aes256 \\\n  default-profile<\/span>=VPN-PROFILE enabled<\/span>=yes require-client-certificate<\/span>=yes\n\n## add a firewall rule<\/span>\n\/ip firewall filter\nadd chain<\/span>=input dst-port<\/span>=1194 protocol<\/span>=tcp comment<\/span>=\"<\/span>Allow OpenVPN\"\n\n## Sposto la regola del firewall prima della generica deny\n\/ip firewall filter move [find \\\ncomment=\"Allow OpenVPN\"] \\\n[find where chain=input in-interface-list=\"!LAN\"]\n<\/span><\/span><\/pre>\n
ed incollarlo nel terminale del Mikrotik (io trovo comodo copiarlo dal terminale dopo essermi collegato via ssh al Mikrotik)<\/p>\n
Stessa cosa col seguente script per la configurazione dell’utente client (questo andr\u00e0 ripetuto per ogni nuovo utente da abilitare):<\/p>\n
# Add a new user and generate\/export certs<\/span>\n#<\/span>\n# Change variables below and paste the script<\/span>\n# into MikroTik terminal window.<\/span>\n#<\/span>\n\n:global CN [\/system identity get name]\n:global USERNAME \"<\/span>user\"<\/span><\/span>\n:global PASSWORD \"<\/span>password\"<\/span><\/span>\n\n## add a user<\/span>\n\/ppp secret\nadd name<\/span>=$USERNAME password<\/span>=$PASSWORD profile<\/span>=VPN-PROFILE service<\/span>=ovpn\n\n## generate a client certificate<\/span>\n\/certificate\nadd name<\/span>=client-template-to-issue copy-from<\/span>=\"<\/span>client-template\"<\/span><\/span> \\\n  common-name<\/span>=\"<\/span>$USERNAME@$CN\"<\/span><\/span>\nsign client-template-to-issue ca<\/span>=\"<\/span>$CN\"<\/span><\/span> name<\/span>=\"<\/span>$USERNAME@$CN\"<\/span><\/span>\n:delay 20\n\n## export the CA, client certificate, and private key<\/span>\n\/certificate\nexport-certificate \"<\/span>$CN\"<\/span><\/span> export-passphrase<\/span>=\"<\/span>\"<\/span><\/span>\nexport-certificate \"<\/span>$USERNAME@$CN\"<\/span><\/span> export-passphrase<\/span>=\"<\/span>$PASSWORD\"<\/span><\/span><\/pre>\n
A questo punto dal pc possiamo scaricare i certificati, tramite interfaccia web (impostare correttamente l’indirizzo ip del vostro Mikrotik es: 192.168.88.1):<\/p>\n
http:\/\/MikroTik_IP<\/strong>\/webfig\/#Files<\/pre>\n
o da terminale con sftp:<\/p>\n
sftp admin@MikroTik_IP<\/strong>:cert_export_\\*<\/span><\/pre>\n
Creare nella stessa cartella dei certificati un file\u00a0user.auth<\/strong> con indicati nome utente e password:<\/p>\n
user\npassword<\/pre>\n
Sempre nella stessa cartella creare il file di configurazione lato client modificando i parametri in grassetto:<\/p>\n
client\ndev tun\nproto tcp-client\nremote MikroTik_IP<\/strong> 1194\nnobind\npersist-key\npersist-tun\ncipher AES-256-CBC\nauth SHA1\npull\nverb 2\nmute 3\n\n# Create a file 'user.auth' with a username and a password<\/span>\n#<\/span>\n# cat << EOF > user.auth<\/span>\n# user<\/span>\n# password<\/span>\n# EOF<\/span>\nauth-user-pass user.auth\n\n# Copy the certificates from MikroTik and change<\/span>\n# the filenames below if needed<\/span>\nca cert_export_MioMikroTik.crt<\/strong>\ncert cert_export_user@MioMikroTik.crt<\/strong>\nkey cert_export_user@MioMikroTik.key<\/strong>\n\n# Add routes to networks behind MikroTik<\/span>\n#route 192.168.10.0 255.255.255.0<\/span><\/pre>\n
A questo punto la configurazione \u00e8 pronta per essere data in pasto al vostro client OVPN<\/p>\n
Se preferite che non venga chiesta la password all’avvio della VPN \u00e8 necessario trasformare la chiave privata in questo modo:<\/p>\n
openssl rsa -passin pass:password -in cert_export_user@MioMikroTik.key -out cert_export_user_np@MioMikroTik.key<\/code><\/pre>\n
ed utilizzare questa nuova chiave privata.<\/p>\n
Per rimuovere un utente e revocare il relativo certificato:<\/p>\n
# Delete a user and revoke his certificate<\/span>\n#<\/span>\n# Change variables below and paste the script<\/span>\n# into MikroTik terminal window.<\/span>\n#<\/span>\n\n:global CN [\/system identity get name]\n:global USERNAME \"<\/span>user\"<\/span><\/span>\n\n## delete a user<\/span>\n\/ppp secret\nremove [find name<\/span>=$USERNAME profile<\/span>=VPN-PROFILE]\n\n## revoke a client certificate<\/span>\n\/certificate\nissued-revoke [find name<\/span>=\"<\/span>$USERNAME@$CN\"<\/span><\/span>]<\/pre>\n
Per rimuovere la configurazione OpenVPN dal Mikrotik:<\/p>\n
# Revert OpenVPN configuration<\/span>\n#<\/span>\n\n\/ip pool\nremove [find name<\/span>=VPN-POOL]\n\n\/ppp profile\nremove [find name<\/span>=VPN-PROFILE]\n\n\/ip firewall filter\nremove [find comment<\/span>=\"<\/span>Allow OpenVPN\"<\/span><\/span>]\n\n\/ppp secrets\nremove [find profile<\/span>=VPN-PROFILE]\n\n\/certificate\n## delete the certificates manually<\/span><\/pre>\n
I certificati vanno rimossi manualmente.<\/p>\n
Buon Lavoro \ud83d\ude09<\/p>\n","protected":false},"excerpt":{"rendered":"
La seguente guida (spudoratamente ispirata da qui ) spiega come installare una Open VPN sul sistema RouterOS di Mikrotik (testato sulla versione 6.41.3) Partiamo da una configurazione Base del Mikrotik \/system reset-configuration Assegnare l’identificativo al Mikrotik da \/system identity set name=”MioMikrotik” Impostare l’ora esatta con NTP: \/system ntp client set mode=unicast enabled=yes servers=([:resolve 0.it.pool.ntp.org],[:resolve 1.it.pool.ntp.org]) […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[],"class_list":["post-413","post","type-post","status-publish","format-standard","hentry","category-networking"],"_links":{"self":[{"href":"https:\/\/carinato.com\/index.php?rest_route=\/wp\/v2\/posts\/413","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/carinato.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/carinato.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/carinato.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/carinato.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=413"}],"version-history":[{"count":0,"href":"https:\/\/carinato.com\/index.php?rest_route=\/wp\/v2\/posts\/413\/revisions"}],"wp:attachment":[{"href":"https:\/\/carinato.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=413"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/carinato.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=413"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/carinato.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=413"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}