Automatically including '/usr/share/nftables.d/table-post/20-miniupnpd.nft'
Automatically including '/usr/share/nftables.d/chain-post/dstnat/20-miniupnpd.nft'
Automatically including '/usr/share/nftables.d/chain-post/forward/20-miniupnpd.nft'
Automatically including '/usr/share/nftables.d/chain-post/srcnat/20-miniupnpd.nft'
動作しているか確認
Windows マシンで PowerShell と UPnPCJ を使って動作確認をします。一時的にファイアウォールをオフにしておきます。
IP パケットがフラグメント化されると途中のネットワーク機器でパケットが破棄されて接続できないサーバーが出てきます。以下の設定を追加してパケットサイズを小さくします。
# To avoid IP packet fragment error. Client config must have the same setting
tun-mtu 1500
# Client config should have the below related to packet fragmentation issue
# mssfix 1400
#!/bin/bash
# This script generates inline OpenVPN client configuration files
# for the given client names. It assumes that the client certificate
# and key are stored in separate directories.
#
# Usage:
# ./generate-client-configs.sh client1 client2
# Common files (adjust paths as needed)
CA_FILE="/etc/openvpn/easy-rsa/pki/ca.crt"
TA_FILE="/etc/openvpn/ta.key"
# Directories where client certificates and keys are stored
CERT_DIR="/etc/openvpn/easy-rsa/pki/issued"
KEY_DIR="/etc/openvpn/easy-rsa/pki/private"
# Directory where the output configuration files will be stored
OUTPUT_DIR="./openvpn-client-configs"
# Prefix of client config file name
OUTPUT_FILE_PREFIX="my-openvpn-"
# Server information
SERVER_ADDRESS="example.com"
PORT=11940
# Base configuration template
BASE_CONFIG=$(cat <<EOF
client
dev tun
proto udp
remote ${SERVER_ADDRESS} ${PORT}
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
tun-mtu 1500 # To avoid packet fragmentation. Server config must have the same setting
mssfix 1400 # To avoid packet fragmentation
data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305
auth SHA256
tls-ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
verb 3
EOF
)
# Function to embed file content in inline tags
embed_file() {
local tag="$1"
local file="$2"
echo "<${tag}>"
cat "${file}"
echo "</${tag}>"
echo ""
}
# Check if at least one client name is provided
if [ "$#" -eq 0 ]; then
echo "Usage: $0 client_name1 [client_name2 ...]"
exit 1
fi
# Create the output directory if it doesn't exist
mkdir -p "${OUTPUT_DIR}"
# Generate configuration file for each client provided as argument
for client in "$@"; do
CLIENT_CERT="${CERT_DIR}/${client}.crt"
CLIENT_KEY="${KEY_DIR}/${client}.key"
# Check if all required files exist
for file in "$CA_FILE" "$CLIENT_CERT" "$CLIENT_KEY" "$TA_FILE"; do
if [ ! -f "$file" ]; then
echo "Error: Required file '$file' not found for client '${client}'." >&2
continue 2
fi
done
OUTPUT_FILE="${OUTPUT_DIR}/${OUTPUT_FILE_PREFIX}${client}.ovpn"
# Write the base configuration to the output file
echo "${BASE_CONFIG}" > "${OUTPUT_FILE}"
echo "" >> "${OUTPUT_FILE}"
# Embed certificate and key files inline
{
embed_file "ca" "${CA_FILE}"
embed_file "cert" "${CLIENT_CERT}"
embed_file "key" "${CLIENT_KEY}"
embed_file "tls-auth" "${TA_FILE}"
echo "key-direction 1"
} >> "${OUTPUT_FILE}"
echo "Client config file '${OUTPUT_FILE}' created successfully."
done
Port 2222
LogLevel VERBOSE
PermitRootLogin no
PasswordAuthentication no
MaxAuthTries 3
MaxSessions 1
PubkeyAuthentication yes
PermitEmptyPasswords no
X11Forwarding no
AllowUsers <NEW_USERNAME>
