本帖最後由 gfx86674 於 2015-1-9 11:26 編輯
相信各位都知道RouterOS很早就支援OpenVPN(OVPN),
但設定iOS/Android可能不是清楚...
所以小弟整理一篇大家都看得懂的,讓各位不用懂腦筋去猜想該怎麼動手.
使用OVPN最基礎的是要建立憑證 ,
不過小弟不再提憑證是如何製做,而是直接開放給有緣人下載使用.
ca.crt /ca.key /client.crt /client.key
先把下載的ca.crt 與ca.key 拉放至winbox的files檔案夾 ,
再至/system certificates 用Import進行匯入.
先匯入ca.crt ,再匯入ca.key ,
匯入完成Certificate會標示KT
要使用OVPN Server ,當然得先開啟它
iOS/Android要指定使用OVPN的ip-mode ,
而Port可以自訂,小弟將原本預設Port:1194 變成現在的1195
修改/PPP Profile的default-encryption設定檔 ,將DNS-Server變更成您的Gateway
確保路由是經您的RouterOS主機查尋遞出的.
建立用戶的OVPN帳號
因ip-mode遮罩被固定為255.255.255.252不能變更 ,設DHCP-Pool意義不大.
所以直接在帳號指定Local/Remote Address .
也因遮罩限定255.255.255.252 ,所以不同帳號請用不同網段區分.
如範例的10.0.1.0/30 ,10.0.2.0/30 ,10.0.3.0/30 如此類推 ,
更禁用戶同帳號重覆登入Server.
若您是使用小弟所提供的憑證,接下只要打開電腦的記事本,
將下面的文字存為client.ovpn即可.- client
- dev tun
- remote 1.23.123.123 1195
- proto tcp
- auth-user-pass pw.txt
- redirect-gateway
- mute-replay-warnings
- ;ca.crt
- ;client.crt
- ;client.key
- <ca>
- -----BEGIN CERTIFICATE-----
- MIIDBDCCAm2gAwIBAgIJAM8oNFlxL3rSMA0GCSqGSIb3DQEBBAUAMGAxCzAJBgNV
- BAYTAlRXMQswCQYDVQQIEwJUVzEPMA0GA1UEBxMGVGFpcGVpMQ0wCwYDVQQKEwRo
- b21lMSQwIgYJKoZIhvcNAQkBFhV4eHh4eHh4eEB5YWhvby5jb20udHcwHhcNMTIx
- MjExMTYyNDIzWhcNMjIxMjA5MTYyNDIzWjBgMQswCQYDVQQGEwJUVzELMAkGA1UE
- CBMCVFcxDzANBgNVBAcTBlRhaXBlaTENMAsGA1UEChMEaG9tZTEkMCIGCSqGSIb3
- DQEJARYVeHh4eHh4eHhAeWFob28uY29tLnR3MIGfMA0GCSqGSIb3DQEBAQUAA4GN
- ADCBiQKBgQDTIffwLYBebqwQBSGb8K9wIF4b5HRVoTqfS8ZTc07TB07DZkGcTOX4
- HhEnW093KggwVfzRLXk+xzw2uK6iQjJo+9DJqsVviw8sQivs+ZtxAgiZSEeMfsY+
- 03YRXgYm6N684qt25ge/EyhuO6peWNRIcS3nW1FXPJ736e1+l/yVQQIDAQABo4HF
- MIHCMB0GA1UdDgQWBBQAirU2p0HRWb6DBzGl+UpFzghiAzCBkgYDVR0jBIGKMIGH
- gBQAirU2p0HRWb6DBzGl+UpFzghiA6FkpGIwYDELMAkGA1UEBhMCVFcxCzAJBgNV
- BAgTAlRXMQ8wDQYDVQQHEwZUYWlwZWkxDTALBgNVBAoTBGhvbWUxJDAiBgkqhkiG
- 9w0BCQEWFXh4eHh4eHh4QHlhaG9vLmNvbS50d4IJAM8oNFlxL3rSMAwGA1UdEwQF
- MAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAP/rusq6/L1Ju0F8yJPUtvqq7i2WevRUW
- b0s0uy076XX/njvY16QnGeqZSw7mi59TSa2kEkO/nDPcCE88y6Q2yCl+CHx3hZLe
- 2zBuxZ4kCaVlAVks8XI2PbqYxASAH8INzDrqfY0ISsGiIVACGnIS9O3DmUtV93De
- NLzt4kDBET0=
- -----END CERTIFICATE-----
- </ca>
- <cert>
- -----BEGIN CERTIFICATE-----
- MIIDJzCCApCgAwIBAgIBAjANBgkqhkiG9w0BAQQFADBgMQswCQYDVQQGEwJUVzEL
- MAkGA1UECBMCVFcxDzANBgNVBAcTBlRhaXBlaTENMAsGA1UEChMEaG9tZTEkMCIG
- CSqGSIb3DQEJARYVeHh4eHh4eHhAeWFob28uY29tLnR3MB4XDTEyMTIxMjAxMzA1
- OFoXDTIyMTIxMDAxMzA1OFowYDELMAkGA1UEBhMCVFcxCzAJBgNVBAgTAlRXMQ0w
- CwYDVQQKEwRob21lMQ8wDQYDVQQDEwZjbGllbnQxJDAiBgkqhkiG9w0BCQEWFXh4
- eHh4eHh4QHlhaG9vLmNvbS50dzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
- wUOdzSIu/vGFAoYo8nTzjVzwSftSwxRF9qlMsfFZfE/aVWhUpxFdWFio7qV+oo6j
- lSvYsEFGC49rmjs0gpc8eoZo65doMzDwwkN4lxu30Jjqah9HtY5EcZX9R1Gl6t3Q
- lhD9nUDEjSDH8SWY81uG60/yvV2V/7WW0eWI2iw4/D0CAwEAAaOB8DCB7TAJBgNV
- HRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZp
- Y2F0ZTAdBgNVHQ4EFgQUk6pp88OQjLIFQ+v9UAm6UHC3od4wgZIGA1UdIwSBijCB
- h4AUAIq1NqdB0Vm+gwcxpflKRc4IYgOhZKRiMGAxCzAJBgNVBAYTAlRXMQswCQYD
- VQQIEwJUVzEPMA0GA1UEBxMGVGFpcGVpMQ0wCwYDVQQKEwRob21lMSQwIgYJKoZI
- hvcNAQkBFhV4eHh4eHh4eEB5YWhvby5jb20udHeCCQDPKDRZcS960jANBgkqhkiG
- 9w0BAQQFAAOBgQBE2ATIoN2IBunjlIeSz+eXDd4D8du3Si807i/9knICweBY4Wsv
- P/9lpozqcklyRdEFG9UjAfYoz54ULEspiPS7oHKd4bIZsabMLBSAxKq4MvEiIto4
- EjKCMSt8WTaSAvES63Hva1kqHhWK50eRAg5llS1awdegu2P5nNxxhB9Knw==
- -----END CERTIFICATE-----
- </cert>
- <key>
- -----BEGIN RSA PRIVATE KEY-----
- MIICXAIBAAKBgQDBQ53NIi7+8YUChijydPONXPBJ+1LDFEX2qUyx8Vl8T9pVaFSn
- EV1YWKjupX6ijqOVK9iwQUYLj2uaOzSClzx6hmjrl2gzMPDCQ3iXG7fQmOpqH0e1
- jkRxlf1HUaXq3dCWEP2dQMSNIMfxJZjzW4brT/K9XZX/tZbR5YjaLDj8PQIDAQAB
- AoGAYhEUdq3c2QLm8mPvTTBpEZdSWsgLs++KnOJFh5mnRbwjVulM40WdbyH1/rq9
- anEksqIAH1fP2jfZavaV65ogVk1q8sSZ1JfY6m0SDlvlMryPmEHnuWbUIJsvmKRB
- nN/BwAkbbOB1s2uRHntgs+ktxVTATnre0iI+P5PVfmluKkECQQDx71mcrEvDSL6t
- MYPgmm99OoaCC0JuqNMbh1Qw2hMSzreCJFDeghPOwfYDcj235egXjuLdWJCNdsLk
- oTx72P+tAkEAzH/perm9Rq1M7UUhw+nKIJqFRyf+VtR1Wk3j4xQmbRfvBns2YjGR
- 4BB7FlVNyP94z/H1X6TZrrNHPMmjQVlA0QJAU2V9T2t5Bk0KJWt/GSpDKjjFawh0
- ku6xLrkchWZ20rHdQghAtCLEry3fHtr/eWfP9Gb1vvUrhwgcMHGABvULVQJAD67X
- lwPbkioENkYQ+tdZGvr+saBNjxcoEM7cZTPMZp1pRVP5rbojd82LwwCzwHBnMXta
- 2ATqdM1m7zB/hqlzoQJBAOM89P0LVPQrcKlp/fN+lIJQQli3jOsUwLNFYbWlqTr8
- sa3O2zc8OFj/aPlcSgvmm64H3z5Aa4Pld6lz58ic8bU=
- -----END RSA PRIVATE KEY-----
- </key>
另外還得存pw.txt ,是存放用戶帳號/密碼用的.
第一行為用戶帳號 ,第二行則為密碼.iOS/Android裝置安裝OpenVPN Connect ,並將client.ovpn/pw.txt上傳並進行匯入
先關閉OpenVPN Connect的Force AES-CBC ciphersuites
若沒意外 ,iOS/Android接下來即順利與OVPN-Server連線.
 
  |
發表於 2015-1-8 12:48
| 
