{"id":1665,"date":"2025-03-30T16:14:24","date_gmt":"2025-03-30T05:14:24","guid":{"rendered":"https:\/\/www.hogepiyo.com\/wp\/?p=1665"},"modified":"2025-04-07T20:02:01","modified_gmt":"2025-04-07T10:02:01","slug":"openvpn-%e3%81%a7%e3%82%bb%e3%82%ad%e3%83%a5%e3%82%a2%e3%81%aa%e6%8e%a5%e7%b6%9a%e3%82%92%e7%a2%ba%e7%ab%8b","status":"publish","type":"post","link":"https:\/\/www.hogepiyo.com\/wp\/?p=1665","title":{"rendered":"OpenVPN \u3067\u30bb\u30ad\u30e5\u30a2\u306a\u63a5\u7d9a\u3092\u78ba\u7acb"},"content":{"rendered":"\n<p>OpenVPN \u3092\u5229\u7528\u3057\u3066\u5916\u51fa\u5148\u306e WiFi \u7b49\u306e\u5b89\u5168\u3067\u306f\u306a\u3044\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u304b\u3089\u5b89\u5168\u306a\u56de\u7dda\u306b\u63a5\u7d9a\u3067\u304d\u308b\u3088\u3046\u306b\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<dl class=\"definition-table\">\n<dt>\u30b5\u30fc\u30d0\u30fc<\/dt>\n<dd>LXD \u30b2\u30b9\u30c8<\/dd>\n<dt>CPU<\/dt>\n<dd>2\u30b3\u30a2<\/dd>\n<dt>\u30e1\u30e2\u30ea\u30fc<\/dt>\n<dd>4GB<\/dd>\n<dt>OS<\/dt>\n<dd>Ubuntu Server 24.04 LTS 64Bit<\/dd>\n<\/dl>\n\n\n\n<figure class=\"wp-block-table\">\n<table>\n<thead>\n<tr>\n<th>apt \u30d1\u30c3\u30b1\u30fc\u30b8<\/th>\n<th>\u30d0\u30fc\u30b8\u30e7\u30f3<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>openvpn<\/td>\n<td>2.6.12-0ubuntu0.24.04.1<\/td>\n<\/tr>\n<tr>\n<td>easy-rsa<\/td>\n<td>3.1.7-2<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_82_2 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">\u30b3\u30f3\u30c6\u30f3\u30c4<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-69f34a9dc5b0c\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-69f34a9dc5b0c\"  aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.hogepiyo.com\/wp\/?p=1665\/#%E3%83%91%E3%83%83%E3%82%B1%E3%83%BC%E3%82%B8%E3%82%92%E3%82%A4%E3%83%B3%E3%82%B9%E3%83%88%E3%83%BC%E3%83%AB\" >\u30d1\u30c3\u30b1\u30fc\u30b8\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.hogepiyo.com\/wp\/?p=1665\/#%E3%82%B5%E3%83%BC%E3%83%90%E3%83%BC%E3%81%A7%E4%BD%BF%E3%81%86%E8%A8%BC%E6%98%8E%E6%9B%B8%E7%94%A8%E3%81%AE_CA_%E3%82%92%E4%BD%9C%E6%88%90\" >\u30b5\u30fc\u30d0\u30fc\u3067\u4f7f\u3046\u8a3c\u660e\u66f8\u7528\u306e CA \u3092\u4f5c\u6210<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.hogepiyo.com\/wp\/?p=1665\/#%E3%82%B5%E3%83%BC%E3%83%90%E3%83%BC%E7%94%A8%E3%81%AE%E9%8D%B5%E3%81%A8%E8%A8%BC%E6%98%8E%E6%9B%B8%E3%82%92%E4%BD%9C%E6%88%90\" >\u30b5\u30fc\u30d0\u30fc\u7528\u306e\u9375\u3068\u8a3c\u660e\u66f8\u3092\u4f5c\u6210<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.hogepiyo.com\/wp\/?p=1665\/#%E3%82%AF%E3%83%A9%E3%82%A4%E3%82%A2%E3%83%B3%E3%83%88%E7%94%A8%E3%81%AE%E8%A8%BC%E6%98%8E%E6%9B%B8%E3%82%92%E4%BD%9C%E6%88%90\" >\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u7528\u306e\u8a3c\u660e\u66f8\u3092\u4f5c\u6210<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.hogepiyo.com\/wp\/?p=1665\/#%E3%82%B5%E3%83%BC%E3%83%90%E3%83%BC%E3%82%92%E8%A8%AD%E5%AE%9A\" >\u30b5\u30fc\u30d0\u30fc\u3092\u8a2d\u5b9a<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.hogepiyo.com\/wp\/?p=1665\/#%E3%83%8D%E3%83%83%E3%83%88%E3%83%AF%E3%83%BC%E3%82%AF%E3%81%AE%E8%A8%AD%E5%AE%9A\" >\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u306e\u8a2d\u5b9a<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.hogepiyo.com\/wp\/?p=1665\/#%E3%82%B5%E3%83%BC%E3%83%90%E3%83%BC%E3%82%92%E8%B5%B7%E5%8B%95\" >\u30b5\u30fc\u30d0\u30fc\u3092\u8d77\u52d5<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.hogepiyo.com\/wp\/?p=1665\/#%E3%82%AF%E3%83%A9%E3%82%A4%E3%82%A2%E3%83%B3%E3%83%88%E8%A8%AD%E5%AE%9A%E3%83%95%E3%82%A1%E3%82%A4%E3%83%AB%E3%82%92%E4%BD%9C%E6%88%90\" >\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u3092\u4f5c\u6210<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.hogepiyo.com\/wp\/?p=1665\/#%E5%8F%82%E8%80%83\" >\u53c2\u8003<\/a><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"%E3%83%91%E3%83%83%E3%82%B1%E3%83%BC%E3%82%B8%E3%82%92%E3%82%A4%E3%83%B3%E3%82%B9%E3%83%88%E3%83%BC%E3%83%AB\"><\/span>\u30d1\u30c3\u30b1\u30fc\u30b8\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>\u4ee5\u4e0b\u306e\u30b3\u30de\u30f3\u30c9\u3067\u5fc5\u8981\u306a\u30d1\u30c3\u30b1\u30fc\u30b8\u3092\u30a4\u30b9\u30c8\u30fc\u30eb\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt install openvpn easy-rsa<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"%E3%82%B5%E3%83%BC%E3%83%90%E3%83%BC%E3%81%A7%E4%BD%BF%E3%81%86%E8%A8%BC%E6%98%8E%E6%9B%B8%E7%94%A8%E3%81%AE_CA_%E3%82%92%E4%BD%9C%E6%88%90\"><\/span>\u30b5\u30fc\u30d0\u30fc\u3067\u4f7f\u3046\u8a3c\u660e\u66f8\u7528\u306e CA \u3092\u4f5c\u6210<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>\u4ee5\u4e0b\u306e\u30b3\u30de\u30f3\u30c9\u3067 CA \u7528\u306e\u9375\u3068\u8a3c\u660e\u66f8\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo make-cadir \/etc\/openvpn\/easy-rsa<\/code><\/pre>\n\n\n\n<p>easy-rsa \u306e\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u3092\u7de8\u96c6\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo vim \/etc\/openvpn\/easy-rsa\/vars<\/code><\/pre>\n\n\n\n<p>EASYRSA_KEY_SIZE \u306e\u5024\u3092\u30c7\u30d5\u30a9\u30eb\u30c8\u306e 2048 \u304b\u3089 4096 \u306b\u5909\u66f4\u3057\u3066\u9375\u9577\u3092\u9577\u304f\u3057\u3066\u304a\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<p>EASYRSA_CERT_EXPIRE \u306e\u5024\u3092\u30c7\u30d5\u30a9\u30eb\u30c8\u306e 825 \u304b\u3089 3650 \u306b\u3057\u3066\u8a3c\u660e\u66f8\u306e\u6709\u52b9\u671f\u9650\u3092\u9577\u304f\u3057\u3066\u304a\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<p>\u30eb\u30fc\u30c8\u30e6\u30fc\u30b6\u30fc\u306b\u5909\u66f4\u3057\u3066\u4ee5\u4e0b\u306e\u30b3\u30de\u30f3\u30c9\u3067 PKI \u3092\u4f5c\u6210\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo su -\ncd \/etc\/openvpn\/easy-rsa\/\n.\/easyrsa init-pki\n.\/easyrsa build-ca<\/code><\/pre>\n\n\n\n<p>CA \u7528\u306e\u30ad\u30fc\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u5165\u529b\u3092\u6c42\u3081\u3089\u308c\u308b\u306e\u3067\u5165\u529b\u3057\u307e\u3059\u3002\u3053\u3053\u3067\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u5165\u529b\u306f\u79d8\u5bc6\u9375\u304c\u5e73\u6587\u3067\u8868\u793a\u3055\u308c\u308b\u306e\u3092\u9632\u304e\u307e\u3059\u3002<\/p>\n\n\n\n<p>CA \u306e\u540d\u524d\u306e\u5165\u529b\u3092\u6c42\u3081\u3089\u308c\u307e\u3059\u304c Enter \u30ad\u30fc\u306e\u5165\u529b\u3067\u30c7\u30d5\u30a9\u30eb\u30c8\u5024\u3092\u8a2d\u5b9a\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"%E3%82%B5%E3%83%BC%E3%83%90%E3%83%BC%E7%94%A8%E3%81%AE%E9%8D%B5%E3%81%A8%E8%A8%BC%E6%98%8E%E6%9B%B8%E3%82%92%E4%BD%9C%E6%88%90\"><\/span>\u30b5\u30fc\u30d0\u30fc\u7528\u306e\u9375\u3068\u8a3c\u660e\u66f8\u3092\u4f5c\u6210<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>\u5f15\u304d\u7d9a\u304d\u30eb\u30fc\u30c8\u30e6\u30fc\u30b6\u30fc\u3067\u4ee5\u4e0b\u306e\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3057\u3066\u30b5\u30fc\u30d0\u30fc\u7528\u306e\u9375\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<p>\u4f5c\u6210\u5f8c\u306b\u540d\u524d\u306e\u5165\u529b\u3092\u6c42\u3081\u3089\u308c\u307e\u3059\u304c Enter \u30ad\u30fc\u3067\u30c7\u30d5\u30a9\u30eb\u30c8\u5024\u3092\u8a2d\u5b9a\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>.\/easyrsa gen-req &lt;SERVER_NAME&gt; nopass<\/code><\/pre>\n\n\n\n<p>\u4ee5\u4e0b\u306e\u30b3\u30de\u30f3\u30c9\u3067 Diffie Hellman \u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002OpenVPN \u30b5\u30fc\u30d0\u30fc\u306b\u5fc5\u8981\u3067\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>.\/easyrsa gen-dh<\/code><\/pre>\n\n\n\n<p>\u4ee5\u4e0b\u306e\u30b3\u30de\u30f3\u30c9\u3067\u30b5\u30fc\u30d0\u30fc\u7528\u306e\u8a3c\u660e\u66f8\u3092 CA \u304b\u3089\u767a\u884c\u3057\u307e\u3059\u3002\u767a\u884c\u6642\u306b CA \u306e\u9375\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u5165\u529b\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>.\/easyrsa sign-req server &lt;SERVER_NAME&gt;<\/code><\/pre>\n\n\n\n<p>\u4f5c\u6210\u3057\u305f CA \u306e\u8a3c\u660e\u66f8\u3001\u30b5\u30fc\u30d0\u30fc\u7528\u306e\u9375\u3068\u8a3c\u660e\u66f8\u3001DH \u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u3092 \/etc\/openvpn\/ \u306b\u30b3\u30d4\u30fc\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cp pki\/dh.pem pki\/ca.crt pki\/issued\/&lt;SERVER_NAME&gt;.crt pki\/private\/&lt;SERVER_NAME&gt;.key \/etc\/openvpn\/<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"%E3%82%AF%E3%83%A9%E3%82%A4%E3%82%A2%E3%83%B3%E3%83%88%E7%94%A8%E3%81%AE%E8%A8%BC%E6%98%8E%E6%9B%B8%E3%82%92%E4%BD%9C%E6%88%90\"><\/span>\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u7528\u306e\u8a3c\u660e\u66f8\u3092\u4f5c\u6210<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>\u5f15\u304d\u7d9a\u304d\u30eb\u30fc\u30c8\u30e6\u30fc\u30b6\u30fc\u3067\u4ee5\u4e0b\u306e\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3057\u3066\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u7528\u306e\u8a3c\u660e\u66f8\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002&lt;CLIENT_NAME&gt; \u90e8\u5206\u3092\u5909\u66f4\u3057\u3066\u5fc5\u8981\u306a\u30e6\u30fc\u30b6\u30fc\u306e\u6570\u3060\u3051\u767a\u884c\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>.\/easyrsa gen-req &lt;CLIENT_NAME&gt; nopass\n.\/easyrsa sign-req client &lt;CLIENT_NAME&gt;<\/code><\/pre>\n\n\n\n<p>\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u7528\u306e\u8a3c\u660e\u66f8\u306e\u767a\u884c\u304c\u7d42\u308f\u3063\u305f\u3089\u30eb\u30fc\u30c8\u30e6\u30fc\u30b6\u30fc\u304b\u3089\u4e00\u822c\u30e6\u30fc\u30b6\u30fc\u306b\u623b\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"%E3%82%B5%E3%83%BC%E3%83%90%E3%83%BC%E3%82%92%E8%A8%AD%E5%AE%9A\"><\/span>\u30b5\u30fc\u30d0\u30fc\u3092\u8a2d\u5b9a<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>\u30b5\u30fc\u30d0\u30fc\u306e\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u3092\u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u304b\u3089\u30b3\u30d4\u30fc\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo cp \/usr\/share\/doc\/openvpn\/examples\/sample-config-files\/server.conf \/etc\/openvpn\/server.conf<\/code><\/pre>\n\n\n\n<p>\u8ffd\u52a0\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8a2d\u5b9a tls-auth \u3067\u4f7f\u7528\u3059\u308b\u30ad\u30fc\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd \/etc\/openvpn\nsudo openvpn --genkey tls-auth ta.key<\/code><\/pre>\n\n\n\n<p>\/etc\/openvpn\/server.conf \u3092\u7de8\u96c6\u3057\u3066\u30b5\u30fc\u30d0\u30fc\u306e\u8a2d\u5b9a\u3092\u5909\u66f4\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo vim \/etc\/openvpn\/server.conf<\/code><\/pre>\n\n\n\n<p>\u4ee5\u4e0b\u306e\u9375\u3068\u8a3c\u660e\u66f8\u306e\u30d5\u30a1\u30a4\u30eb\u540d\u304c\u5b9f\u969b\u306b\u5b58\u5728\u3057\u3066\u3044\u308b\u30d5\u30a1\u30a4\u30eb\u3068\u4e00\u81f4\u3059\u308b\u3053\u3068\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ca ca.crt\ncert &lt;SERVER_NAME&gt;.crt\nkey &lt;SERVER_NAME&gt;.key\ndh dh.pem<\/code><\/pre>\n\n\n\n<p>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5411\u4e0a\u306e\u305f\u3081\u30dd\u30fc\u30c8\u3092\u5909\u66f4\u3057\u3066\u304a\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>port 11940<\/code><\/pre>\n\n\n\n<p>\u4ee5\u4e0b\u306e\u884c\u306e\u30b3\u30e1\u30f3\u30c8\u30a2\u30a6\u30c8\u3092\u89e3\u9664\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>;tls-auth ta.key 0<\/code><\/pre>\n\n\n\n<p>VPN \u7528\u306e\u30b5\u30d6\u30cd\u30c3\u30c8\u3092\u5909\u66f4\u3057\u305f\u3044\u5834\u5408\u306f\u4ee5\u4e0b\u3092\u5909\u66f4\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>server 10.8.0.0 255.255.255.0<\/code><\/pre>\n\n\n\n<p>\u4ee5\u4e0b\u306e\u884c\u306e\u30b3\u30e1\u30f3\u30c8\u30a2\u30a6\u30c8\u3092\u89e3\u9664\u3057\u3066\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u304c VPN \u7d4c\u7531\u3067\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u3078\u30a2\u30af\u30bb\u30b9\u3059\u308b\u3088\u3046\u306b\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>;push \"redirect-gateway def1 bypass-dhcp\"<\/code><\/pre>\n\n\n\n<p>VPN \u63a5\u7d9a\u3067\u4f7f\u7528\u3059\u308b DNS \u30b5\u30fc\u30d0\u30fc\u306e IP \u3092\u6307\u5b9a\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>push \"dhcp-option DNS 8.8.8.8\"\npush \"dhcp-option DNS 8.8.4.4\"<\/code><\/pre>\n\n\n\n<p>\u4ee5\u4e0b\u306e\u884c\u3092\u7de8\u96c6\u3057\u3066\u5f31\u3044\u6697\u53f7\u65b9\u5f0f\u304c\u4f7f\u7528\u3055\u308c\u306a\u3044\u3088\u3046\u306b\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305<\/code><\/pre>\n\n\n\n<p>\u4ee5\u4e0b\u306e\u884c\u3092\u8ffd\u52a0\u3057\u3066\u5f31\u3044\u6697\u53f7\u65b9\u5f0f\u304c\u4f7f\u7528\u3055\u308c\u306a\u3044\u3088\u3046\u306b\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>auth SHA256\ntls-ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256<\/code><\/pre>\n\n\n\n<p>IP \u30d1\u30b1\u30c3\u30c8\u304c\u30d5\u30e9\u30b0\u30e1\u30f3\u30c8\u5316\u3055\u308c\u308b\u3068\u9014\u4e2d\u306e\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u6a5f\u5668\u3067\u30d1\u30b1\u30c3\u30c8\u304c\u7834\u68c4\u3055\u308c\u3066\u63a5\u7d9a\u3067\u304d\u306a\u3044\u30b5\u30fc\u30d0\u30fc\u304c\u51fa\u3066\u304d\u307e\u3059\u3002\u4ee5\u4e0b\u306e\u8a2d\u5b9a\u3092\u8ffd\u52a0\u3057\u3066\u30d1\u30b1\u30c3\u30c8\u30b5\u30a4\u30ba\u3092\u5c0f\u3055\u304f\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># To avoid IP packet fragment error. Client config must have the same setting\ntun-mtu 1500\n# Client config should have the below related to packet fragmentation issue\n# mssfix 1400<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"%E3%83%8D%E3%83%83%E3%83%88%E3%83%AF%E3%83%BC%E3%82%AF%E3%81%AE%E8%A8%AD%E5%AE%9A\"><\/span>\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u306e\u8a2d\u5b9a<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>\/etc\/sysctl.conf \u3092\u7de8\u96c6\u3057\u3066\u4ee5\u4e0b\u306e\u884c\u306e\u30b3\u30e1\u30f3\u30c8\u30a2\u30a6\u30c8\u3092\u89e3\u9664\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo vim \/etc\/sysctl.conf<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>#net.ipv4.ip_forward=1<\/code><\/pre>\n\n\n\n<p>sysctl \u3092\u518d\u8aad\u307f\u8fbc\u307f\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo sysctl -p \/etc\/sysctl.conf<\/code><\/pre>\n\n\n\n<p>sudo sysctl -p \/etc\/sysctl.conf\u4ee5\u4e0b\u306e\u30b3\u30de\u30f3\u30c9\u3067\u30d5\u30a1\u30a4\u30a2\u30a6\u30a9\u30fc\u30eb\u306e\u8a2d\u5b9a\u3092\u5909\u66f4\u3057\u3066 OpenVPN \u7528\u306e\u30dd\u30fc\u30c8\u3092\u958b\u653e\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ufw allow 11940\/udp<\/code><\/pre>\n\n\n\n<p>OpenVPN \u306e\u30b5\u30d6\u30cd\u30c3\u30c8\u304b\u3089\u5916\u90e8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u3078\u306e\u30eb\u30fc\u30c6\u30a3\u30f3\u30b0\u3092\u3059\u308b\u305f\u3081\u306b NAT \u3092\u8a2d\u5b9a\u3057\u307e\u3059\u3002\/etc\/ufw\/before.rules \u3092\u7de8\u96c6\u3057\u3066\u4ee5\u4e0b &#8220;*filter&#8221; \u306e\u76f4\u524d\u3001\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u306e\u4e0a\u90e8\u306b\u8ffd\u52a0\u3057\u307e\u3059\u3002\u30b5\u30d6\u30cd\u30c3\u30c8\u3068\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30a4\u30f3\u30bf\u30fc\u30d5\u30a7\u30fc\u30b9\u306f\u74b0\u5883\u306b\u5408\u308f\u305b\u3066\u5909\u66f4\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># START OPENVPN RULES\n*nat\n:POSTROUTING ACCEPT &#91;0:0]\n# Allow traffic from OpenVPN client network to be NAT'd\n-A POSTROUTING -s 10.8.0.0\/24 -o eth0 -j MASQUERADE\nCOMMIT\n# END OPENVPN RULES<\/code><\/pre>\n\n\n\n<p>\/etc\/default\/ufw \u5185\u306e DEFAULT_FORWARD_POLICY \u3092 \u201cACCEPT\u201d \u306b\u8a2d\u5b9a\u3057\u3066\u30d1\u30b1\u30c3\u30c8\u306e\u8ee2\u9001\u3092\u8a31\u53ef\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>DEFAULT_FORWARD_POLICY=\"ACCEPT\"<\/code><\/pre>\n\n\n\n<p>UFW \u3092\u518d\u8d77\u52d5\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ufw disable\nsudo ufw enable<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"%E3%82%B5%E3%83%BC%E3%83%90%E3%83%BC%E3%82%92%E8%B5%B7%E5%8B%95\"><\/span>\u30b5\u30fc\u30d0\u30fc\u3092\u8d77\u52d5<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>OpenVPN \u30b5\u30fc\u30d0\u30fc\u3092\u8d77\u52d5\u3057\u307e\u3059\u3002\u8a2d\u5b9a\u3092\u5909\u66f4\u3057\u305f\u5f8c\u306f restart \u3092\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl start openvpn@server<\/code><\/pre>\n\n\n\n<p>\u4ee5\u4e0b\u306e\u30b3\u30de\u30f3\u30c9\u3067\u30ed\u30b0\u3092\u78ba\u8a8d\u3067\u304d\u307e\u3059\u3002&#8221;Initialization Sequence Completed&#8221; \u304c\u8868\u793a\u3055\u308c\u3066\u3044\u308c\u3070\u6b63\u5e38\u306b\u8d77\u52d5\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo journalctl -u openvpn@server -xe<\/code><\/pre>\n\n\n\n<p>\/etc\/default\/openvpn \u3092\u5909\u66f4\u3057\u3066 OpenVPN \u30b5\u30fc\u30d0\u30fc\u3092\u81ea\u52d5\u3067\u8d77\u52d5\u3059\u308b\u3088\u3046\u306b\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo vim \/etc\/default\/openvpn<\/code><\/pre>\n\n\n\n<p>\u4ee5\u4e0b\u306e\u884c\u306e\u30b3\u30e1\u30f3\u30c8\u30a2\u30a6\u30c8\u3092\u89e3\u9664\u3057\u3066\u3059\u3079\u3066\u306e\u30b5\u30fc\u30d0\u30fc\u8a2d\u5b9a\u3092\u81ea\u52d5\u8d77\u52d5\u3059\u308b\u3088\u3046\u306b\u3057\u307e\u3059\u3002\u500b\u5225\u306b\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u540d\u3092\u6307\u5b9a\u3059\u308b\u3053\u3068\u3082\u3067\u304d\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>AUTOSTART=\"all\"<\/code><\/pre>\n\n\n\n<p>\u8a2d\u5b9a\u3092\u53cd\u6620\u3055\u305b\u308b\u305f\u3081\u306b systemd \u3092\u518d\u8aad\u307f\u8fbc\u307f\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl daemon-reload<\/code><\/pre>\n\n\n\n<p>\u4ee5\u4e0b\u306e\u30b3\u30de\u30f3\u30c9\u3067 OpenVPN \u304c\u4f5c\u6210\u3057\u305f tun0 \u30a4\u30f3\u30bf\u30fc\u30d5\u30a7\u30fc\u30b9\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ip addr show dev tun0<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"%E3%82%AF%E3%83%A9%E3%82%A4%E3%82%A2%E3%83%B3%E3%83%88%E8%A8%AD%E5%AE%9A%E3%83%95%E3%82%A1%E3%82%A4%E3%83%AB%E3%82%92%E4%BD%9C%E6%88%90\"><\/span>\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u3092\u4f5c\u6210<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>\u4ee5\u4e0b\u306e\u5185\u5bb9\u306e\u30b7\u30a7\u30eb\u30b9\u30af\u30ea\u30d7\u30c8\u3092 generate-client-configs.sh \u3068\u3057\u3066\u4f5c\u6210\u3057\u5b9f\u884c\u6a29\u9650\u3092\u4e0e\u3048\u307e\u3059\u3002OUTPUT_DIR \u7b49\u5fc5\u8981\u304c\u3042\u308c\u3070\u5909\u66f4\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#!\/bin\/bash\n# This script generates inline OpenVPN client configuration files\n# for the given client names. It assumes that the client certificate\n# and key are stored in separate directories.\n#\n# Usage:\n#   .\/generate-client-configs.sh client1 client2\n\n# Common files (adjust paths as needed)\nCA_FILE=\"\/etc\/openvpn\/easy-rsa\/pki\/ca.crt\"\nTA_FILE=\"\/etc\/openvpn\/ta.key\"\n\n# Directories where client certificates and keys are stored\nCERT_DIR=\"\/etc\/openvpn\/easy-rsa\/pki\/issued\"\nKEY_DIR=\"\/etc\/openvpn\/easy-rsa\/pki\/private\"\n\n# Directory where the output configuration files will be stored\nOUTPUT_DIR=\".\/openvpn-client-configs\"\n\n# Prefix of client config file name\nOUTPUT_FILE_PREFIX=\"my-openvpn-\"\n\n# Server information\nSERVER_ADDRESS=\"example.com\"\nPORT=11940\n\n# Base configuration template\nBASE_CONFIG=$(cat &lt;&lt;EOF\nclient\ndev tun\nproto udp\nremote ${SERVER_ADDRESS} ${PORT}\nresolv-retry infinite\nnobind\npersist-key\npersist-tun\nremote-cert-tls server\ntun-mtu 1500  # To avoid packet fragmentation. Server config must have the same setting\nmssfix 1400  # To avoid packet fragmentation\ndata-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305\nauth SHA256\ntls-ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256\nverb 3\nEOF\n)\n\n# Function to embed file content in inline tags\nembed_file() {\n    local tag=\"$1\"\n    local file=\"$2\"\n    echo \"&lt;${tag}>\"\n    cat \"${file}\"\n    echo \"&lt;\/${tag}>\"\n    echo \"\"\n}\n\n# Check if at least one client name is provided\nif &#91; \"$#\" -eq 0 ]; then\n    echo \"Usage: $0 client_name1 &#91;client_name2 ...]\"\n    exit 1\nfi\n\n# Create the output directory if it doesn't exist\nmkdir -p \"${OUTPUT_DIR}\"\n\n# Generate configuration file for each client provided as argument\nfor client in \"$@\"; do\n    CLIENT_CERT=\"${CERT_DIR}\/${client}.crt\"\n    CLIENT_KEY=\"${KEY_DIR}\/${client}.key\"\n\n    # Check if all required files exist\n    for file in \"$CA_FILE\" \"$CLIENT_CERT\" \"$CLIENT_KEY\" \"$TA_FILE\"; do\n        if &#91; ! -f \"$file\" ]; then\n            echo \"Error: Required file '$file' not found for client '${client}'.\" >&amp;2\n            continue 2\n        fi\n    done\n\n    OUTPUT_FILE=\"${OUTPUT_DIR}\/${OUTPUT_FILE_PREFIX}${client}.ovpn\"\n\n    # Write the base configuration to the output file\n    echo \"${BASE_CONFIG}\" > \"${OUTPUT_FILE}\"\n    echo \"\" >> \"${OUTPUT_FILE}\"\n\n    # Embed certificate and key files inline\n    {\n        embed_file \"ca\" \"${CA_FILE}\"\n        embed_file \"cert\" \"${CLIENT_CERT}\"\n        embed_file \"key\" \"${CLIENT_KEY}\"\n        embed_file \"tls-auth\" \"${TA_FILE}\"\n        echo \"key-direction 1\"\n    } >> \"${OUTPUT_FILE}\"\n\n    echo \"Client config file '${OUTPUT_FILE}' created successfully.\"\ndone<\/code><\/pre>\n\n\n\n<p>\u3053\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u306b\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u7528\u306e\u9375\u3068\u8a3c\u660e\u66f8\u3092\u4f5c\u6210\u3057\u305f\u6642\u306e &lt;CLIENT_NAME&gt; \u3092\u5f15\u6570\u306b\u3057\u3066\u5b9f\u884c\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo .\/generate-openvpn-client-configs.sh &lt;CLIENT_NAME_1&gt; &lt;CLIENT_NAME_2&gt; ...\n<\/code><\/pre>\n\n\n\n<p>OUTPUT_DIR \u306b\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u7528\u306e\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u304c\u51fa\u529b\u3055\u308c\u308b\u306e\u3067\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30c7\u30d0\u30a4\u30b9\u3078\u30b3\u30d4\u30fc\u3057\u63a5\u7d9a\u78ba\u8a8d\u3092\u3057\u307e\u3059\u3002\u3053\u306e\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u306b\u306f\u9375\u60c5\u5831\u304c\u57cb\u3081\u8fbc\u307e\u308c\u3066\u3044\u308b\u306e\u306b\u53d6\u308a\u6271\u3044\u306b\u306f\u6ce8\u610f\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"%E5%8F%82%E8%80%83\"><\/span>\u53c2\u8003<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/documentation.ubuntu.com\/server\/how-to\/security\/install-openvpn\/\" title=\"\">How to install and use OpenVPN<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>OpenVPN \u3092\u5229\u7528\u3057\u3066\u5916\u51fa\u5148\u306e WiFi \u7b49\u306e\u5b89\u5168\u3067\u306f\u306a\u3044\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u304b\u3089\u5b89\u5168\u306a\u56de\u7dda\u306b\u63a5\u7d9a\u3067\u304d\u308b\u3088\u3046\u306b\u3057\u307e\u3059\u3002 \u30b5\u30fc\u30d0\u30fc LXD \u30b2\u30b9\u30c8 CPU 2\u30b3\u30a2 \u30e1\u30e2\u30ea\u30fc 4GB OS Ubuntu Server 24.04 &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/www.hogepiyo.com\/wp\/?p=1665\" class=\"more-link\"><span class=\"screen-reader-text\">&#8220;OpenVPN \u3067\u30bb\u30ad\u30e5\u30a2\u306a\u63a5\u7d9a\u3092\u78ba\u7acb&#8221; \u306e<\/span>\u7d9a\u304d\u3092\u8aad\u3080<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[260],"tags":[234,264,266],"class_list":["post-1665","post","type-post","status-publish","format-standard","hentry","category-ubuntu-24-04-lts-server","tag-openvpn","tag-ubuntu-24-04","tag--ja"],"aioseo_notices":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.hogepiyo.com\/wp\/index.php?rest_route=\/wp\/v2\/posts\/1665","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hogepiyo.com\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hogepiyo.com\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hogepiyo.com\/wp\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hogepiyo.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1665"}],"version-history":[{"count":40,"href":"https:\/\/www.hogepiyo.com\/wp\/index.php?rest_route=\/wp\/v2\/posts\/1665\/revisions"}],"predecessor-version":[{"id":1708,"href":"https:\/\/www.hogepiyo.com\/wp\/index.php?rest_route=\/wp\/v2\/posts\/1665\/revisions\/1708"}],"wp:attachment":[{"href":"https:\/\/www.hogepiyo.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1665"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hogepiyo.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1665"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hogepiyo.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1665"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}