\u901a\u5e38\u306fWireGuard\u3092\u4f7f\u7528\u3057\u3066\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3068\u901f\u5ea6\u3092\u4e21\u7acb\u3057\u305f\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u3067\u5feb\u9069\u306b\u904e\u3054\u3057\u3066\u3044\u308b\u304c\u3001WireGuard\u304c\u901a\u308c\u306a\u3044\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u304c\u305f\u307e\u306b\u5b58\u5728\u3059\u308b\u3002<\/p>\n
\u5177\u4f53\u7684\u306b\u306f\u3001\u6b21\u306e\u3088\u3046\u306a\u3082\u306e\u304c\u8a72\u5f53\u3059\u308b\u3002<\/p>\n
\u524d\u8005\u306f\u98db\u884c\u6a5f\u306e\u6a5f\u5185Wi-Fi\u30b5\u30fc\u30d3\u30b9(2024\u5e742\u6708\u9803\u4ee5\u964d)\u3001\u5f8c\u8005\u306f\u65b0\u5e79\u7dda\u8eca\u5185Wi-Fi\u3002<\/p>\n
\u98db\u884c\u6a5f\u306e\u6a5f\u5185Wi-Fi\u30b5\u30fc\u30d3\u30b92023\u5e7410\u6708\u9803\u306fWireGuard\u304c\u901a\u308c\u305f\u306e\u3060\u304c\u3001\u3053\u306e4\u30f6\u6708\u304f\u3089\u3044\u306e\u9593\u3067\u4ed5\u69d8\u5909\u66f4\u304c\u3042\u3063\u305f\u6a21\u69d8\u3002<\/p>\n
\u65b0\u5e79\u7ddaWi-Fi\u306fMTU\u304c\u5c0f\u3055\u304f\u30011294\u30d0\u30a4\u30c8\u3002WireGuard\u306f\u8a2d\u5b9a\u53ef\u80fd\u306a\u5185\u5074MTU\u306e\u6700\u4f4e\u5024\u304c1280\u3067\u3001\u305d\u3053\u306b\u5fc5\u8981\u306a\u30d8\u30c3\u30c0\u30fc\u304c\u30fc\u3064\u3044\u3066\u3001\u5916\u5074\u306eMTU\u3068\u3057\u3066\u306f1360\u30d0\u30a4\u30c8\u304f\u3089\u3044\u5fc5\u8981\u3002UDP\u306a\u306e\u3067\u3001MTU\u304c\u5927\u304d\u3059\u304e\u308b\u5834\u5408\u306f\u30d1\u30b1\u30c3\u30c8\u304c\u7834\u68c4\u3055\u308c\u3066\u3057\u307e\u3046\u3002<\/p>\n
\u3053\u3046\u3057\u305f\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u3092\u901a\u904e\u3059\u308b\u305f\u3081\u306b\u3001\u6700\u521d\u306fSoftehterVPN\u3092\u9078\u5b9a\u3057\u305f\u3002\u3057\u304b\u3057\u3001\u5185\u5074\u304cIPv6\u30b7\u30f3\u30b0\u30eb\u30b9\u30bf\u30c3\u30af\u3068\u3044\u3046\u74b0\u5883\u6545\u3001\u30d0\u30fc\u30b8\u30e7\u30f34\u7cfb\u306f\u901a\u4fe1\u304c\u6210\u7acb\u305b\u305a\u3001\u30d0\u30fc\u30b8\u30e7\u30f35\u7cfb\u306fSoftehterVPN\u30d7\u30ed\u30c8\u30b3\u30eb\u306a\u3089\u3064\u306a\u304c\u308b\u3082\u306e\u306e\u3001OpenVPN\u4e92\u63db\u6a5f\u80fd\u3067\u306fDHCP\u30b5\u30fc\u30d0\u30fc\u304c\u5fc5\u9808\u306a\u3088\u3046\u3067\u3001\u3053\u308c\u304c\u306a\u3044\u5834\u5408\u306b\u30e6\u30fc\u30b6\u30fc\u8a8d\u8a3c\u5931\u6557\u6271\u3044\u3067\u63a5\u7d9a\u3067\u304d\u306a\u3044\u3002DHCP\u30b5\u30fc\u30d0\u30fc\u304c\u306a\u3044\u3053\u3068\u306b\u3088\u308b\u30e6\u30fc\u30b6\u30fc\u8a8d\u8a3c\u5931\u6557\u3068\u3001\u672c\u5f53\u306e\u30e6\u30fc\u30b6\u30fc\u8a8d\u8a3c\u5931\u6557\u6642\u306f\u3001\u8a8d\u8a3c\u51e6\u7406\u306b\u304b\u304b\u308b\u6642\u9593\u304c\u7570\u306a\u308b\u306e\u3067\u5206\u304b\u3063\u3066\u3044\u308c\u3070\u5224\u5225\u53ef\u80fd\u3060\u304c\u3001\u5f53\u521d\u306f\u30e6\u30fc\u30b6\u30fc\u8a8d\u8a3c\u5931\u6557\u3068\u3044\u3046\u4e8b\u3067\u3001\u7d50\u69cb\u30cf\u30de\u3063\u305f\u3002<\/p>\n
\u4eca\u56de\u3001OpenVPN\u3092\u4f7f\u3063\u3066\u5916\u5074TCP443\u30c7\u30e5\u30a2\u30eb\u30b9\u30bf\u30c3\u30af\u3001\u5185\u5074IPv6\u30b7\u30f3\u30b0\u30eb\u30b9\u30bf\u30c3\u30af\u3068\u3044\u3046VPN\u3092\u5b9f\u73fe\u3067\u304d\u305f\u306e\u3067\u3001\u8a2d\u5b9a\u3092\u3053\u3053\u306b\u8a18\u3059\u3002<\/p>\n
\u5185\u5074\u3067\u4f7f\u3046IPv6\u30a2\u30c9\u30ec\u30b9\u306fISP\u304b\u3089\u914d\u5e03\u3055\u308c\u3066\u3044\u308b\u30b0\u30ed\u30fc\u30d0\u30ebIPv6\u30a2\u30c9\u30ec\u30b9\u306e\u5185\u3001\/64\u3092\u4f7f\u3046\u3002\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u306b\u30cf\u30fc\u30c9\u30b3\u30fc\u30c8\u3059\u308b\u3002\u52d5\u7684\u306b\u5909\u308f\u308b\u5834\u5408\u306f\u53c2\u8003\u8cc7\u6599\u306e\u3068\u3053\u306b\u4e57\u305b\u305f\u30b5\u30a4\u30c8\u3092\u53c2\u8003\u306b\u3057\u3066\u307b\u3057\u3044\u3002\u306a\u304a\u5f53\u65b9\u3067\u306f\u672a\u78ba\u8a8d\u3002<\/p>\n
\u3053\u306eOpenVPN\u30b5\u30fc\u30d0\u30fc\u306b\u63a5\u7d9a\u3059\u308b\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306f\u3001Android\u7aef\u672b\u3068Windows\u7aef\u672b\u3002\u305d\u308c\u305e\u308c\u516c\u5f0f\u306e\u5c02\u7528\u30a2\u30d7\u30ea\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u3059\u308b\u3002<\/p>\n
[OpenWrt Wiki] OpenVPN server<\/a> \u57fa\u672c\u7684\u306b\u306f\u516c\u5f0f\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u306b\u5f93\u3048\u3070\u30b5\u30fc\u30d0\u30fc\u304c\u52d5\u304f\u3002\u305f\u3060\u3001\u5185\u5074\u304cIPv6\u30b7\u30f3\u30b0\u30eb\u30b9\u30bf\u30c3\u30af\u3068\u3044\u3046\u7279\u6b8a\u8981\u4ef6\u6545\u306b\u8abf\u6574\u304c\u5fc5\u8981\u3060\u3063\u305f\u3002\u5c0e\u5165\u65b9\u6cd5\u4e00\u5f0f\u3092\u542b\u3081\u3066\u66f8\u3044\u3066\u3044\u304f\u3002<\/p>\n IPv4\u3060\u3051\u306a\u3089\u5916\u5074\u304b\u3089\u5185\u5074\u306b\u5165\u308c\u308b\u3068\u304d\u306bPort Forward\u3057\u305f\u3089\u3044\u3044\u306e\u3060\u304c\u3001IPv6\u3067\u5f85\u3061\u53d7\u3051\u3057\u305f\u3044\u5834\u5408\u3001IPv6\u306b\u5bfe\u3057\u3066Port Forward\u304c\u6709\u52b9\u306b\u306a\u3089\u306a\u304b\u3063\u305f\u3002\u306e\u3067\u3001OpenVPN\u30b5\u30fc\u30d0\u30fc\u306b443\u3092\u4f7f\u308f\u305b\u308b\u3002\u3082\u3068\u3082\u3068\u8a2d\u5b9a\u753b\u9762\u304c\u3053\u306e\u30dd\u30fc\u30c8\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u306e\u3067\u3001\u307e\u305a\u306f\u3053\u306e\u30dd\u30fc\u30c8\u304b\u30898443\u3078\u5f15\u3063\u8d8a\u3057\u3057\u3066\u3082\u3089\u3046\u3002<\/p>\n \u3053\u308c\u306f\u516c\u5f0f\u306b\u6848\u5185\u3055\u308c\u3066\u3044\u308b\u3082\u306e\u3068\u540c\u69d8<\/p>\n \u30d1\u30e9\u30e1\u30fc\u30bf\u30fc\u3092\u5165\u308c\u308b\u3002\u3053\u308c\u3089\u306f\u30b3\u30f3\u30bd\u30fc\u30eb\u306b\u76f4\u63a5\u5165\u308c\u308b\u3002<\/p>\n VPN_POOL6\u3068VPN_DNS6\u306f\u5404\u81ea\u306e\u74b0\u5883\u306b\u5408\u308f\u305b\u3066\u8aad\u307f\u66ff\u3048\u3066\u307b\u3057\u3044\u3002<\/p>\n CLIENT1\u3092\u4efb\u610f\u306e\u540d\u524d\u306b\u5909\u66f4\u3057\u3066\u307b\u3057\u3044\u3002\u540d\u524d\u3092\u5909\u3048\u3066\u8907\u6570\u56de\u5b9f\u884c\u3059\u308b\u3068\u3001\u305d\u306e\u5206\u306e\u8a3c\u660e\u66f8\u3092\u4f5c\u6210\u3067\u304d\u308b\u3002\u63a5\u7d9a\u3059\u308b\u7aef\u672b\u6bce\u306b\u4f5c\u6210\u3059\u308b\u3002<\/p>\n ls\u30b3\u30de\u30f3\u30c9\u306b\u3088\u308a\u3001\u751f\u6210\u3055\u308c\u305fovpn\u30d5\u30a1\u30a4\u30eb\u304c\u8868\u793a\u3055\u308c\u308b\u3002\u5404\u63a5\u7d9a\u7aef\u672b\u306b\u914d\u7f6e\u3057\u3066\u30a2\u30d7\u30ea\u3067\u8aad\u307f\u8fbc\u3080\u3068\u8a2d\u5b9a\u304c\u5b8c\u4e86\u3002<\/p>\n \u8a3c\u660e\u66f8\u3092\u5931\u52b9\u3055\u305b\u308b\u3053\u3068\u304c\u3067\u304d\u308b\u3002\u305f\u3060\u3057\u3001\u5f53\u65b9\u672a\u78ba\u8a8d\u3002<\/p>\n RevokeCLIENT\u306e\u3068\u3053\u308d\u3092\u5931\u52b9\u3055\u305b\u305f\u3044\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306e\u540d\u524d\u306b\u7f6e\u304d\u63db\u3048\u3066\u307b\u3057\u3044\u3002<\/p>\n \u524d\u66f8\u304d \u901a\u5e38\u306fWireGuard\u3092\u4f7f\u7528\u3057\u3066\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3068\u901f\u5ea6\u3092\u4e21\u7acb\u3057\u305f\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u3067\u5feb\u9069\u306b\u904e\u3054\u3057\u3066\u3044\u308b\u304c\u3001WireGuard\u304c\u901a\u308c\u306a\u3044\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u304c\u305f\u307e\u306b\u5b58\u5728\u3059\u308b\u3002 \u5177\u4f53\u7684\u306b\u306f\u3001\u6b21\u306e\u3088\u3046\u306a\u3082\u306e\u304c\u8a72\u5f53\u3059\u308b\u3002 DNS\u3068TCP […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[],"class_list":["post-1050","post","type-post","status-publish","format-standard","hentry","category-network"],"_links":{"self":[{"href":"https:\/\/intinfinity.com\/index.php\/wp-json\/wp\/v2\/posts\/1050","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/intinfinity.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/intinfinity.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/intinfinity.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/intinfinity.com\/index.php\/wp-json\/wp\/v2\/comments?post=1050"}],"version-history":[{"count":12,"href":"https:\/\/intinfinity.com\/index.php\/wp-json\/wp\/v2\/posts\/1050\/revisions"}],"predecessor-version":[{"id":1092,"href":"https:\/\/intinfinity.com\/index.php\/wp-json\/wp\/v2\/posts\/1050\/revisions\/1092"}],"wp:attachment":[{"href":"https:\/\/intinfinity.com\/index.php\/wp-json\/wp\/v2\/media?parent=1050"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/intinfinity.com\/index.php\/wp-json\/wp\/v2\/categories?post=1050"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/intinfinity.com\/index.php\/wp-json\/wp\/v2\/tags?post=1050"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n[OpenWrt Wiki] OpenVPN extras<\/a>
\n[OpenWrt Wiki] OpenVPN server with dynamic IPv6 GUA prefix<\/a><\/p>\n\u30bb\u30c3\u30c8\u30a2\u30c3\u30d7<\/h1>\n
uhttpd \u30dd\u30fc\u30c8\u756a\u53f7\u5909\u66f4<\/h2>\n
vi \/etc\/config\/uhttpd<\/code><\/pre>\n list listen_http '0.0.0.0:80'\n list listen_http '[::]:80'\n list listen_https '0.0.0.0:8443'\n list listen_https '[::]:8443'<\/code><\/pre>\nservice uhttpd restart<\/code><\/pre>\n\u30d1\u30c3\u30b1\u30fc\u30b8\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb<\/h2>\n
opkg update\nopkg install openvpn-openssl openvpn-easy-rsa<\/code><\/pre>\n\u74b0\u5883\u5909\u6570\u306e\u5b9a\u7fa9<\/h2>\n
# Configuration parameters\nVPN_DIR="\/etc\/openvpn"\nVPN_PKI="\/etc\/easy-rsa\/pki"\nVPN_PORT="443"\nVPN_PROTO="tcp"\nVPN_POOL6="2001:0DB8::\/64"\nVPN_DNS6="${VPN_POOL6%:*}:1"\nVPN_DN="$(uci -q get dhcp.@dnsmasq[0].domain)"\n\n# Fetch server address\nNET_FQDN="$(uci -q get ddns.@service[0].lookup_host)"\n. \/lib\/functions\/network.sh\nnetwork_flush_cache\nnetwork_find_wan NET_IF\nnetwork_get_ipaddr NET_ADDR "${NET_IF}"\nif [ -n "${NET_FQDN}" ]\nthen VPN_SERV="${NET_FQDN}"\nelse VPN_SERV="${NET_ADDR}"\nfi<\/code><\/pre>\n\u9375\u7ba1\u7406<\/h2>\n
# Work around EasyRSA issues\nwget -U "" -O \/tmp\/easyrsa.tar.gz https:\/\/github.com\/OpenVPN\/easy-rsa\/releases\/download\/v3.1.7\/EasyRSA-3.1.7.tgz\ntar -z -x -f \/tmp\/easyrsa.tar.gz\n\n# Configuration parameters\ncat << EOF > \/etc\/profile.d\/easy-rsa.sh\nexport EASYRSA_PKI="${VPN_PKI}"\nexport EASYRSA_TEMP_DIR="\/tmp"\nexport EASYRSA_CERT_EXPIRE="3650"\nexport EASYRSA_BATCH="1"\nalias easyrsa="\/root\/EasyRSA-3.1.7\/easyrsa"\nEOF\n. \/etc\/profile.d\/easy-rsa.sh\n\n# Remove and re-initialize PKI directory\neasyrsa init-pki\n\n# Generate DH parameters\neasyrsa gen-dh\n\n# Create a new CA\neasyrsa build-ca nopass\n\n# Generate server keys and certificate\neasyrsa build-server-full server nopass\nopenvpn --genkey tls-crypt-v2-server ${EASYRSA_PKI}\/private\/server.pem\n\n# Generate a CRL\neasyrsa gen-crl<\/code><\/pre>\n\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306e\u8a3c\u660e\u66f8\u3092\u4f5c\u6210<\/h2>\n
# Generate client keys and certificate and Add more client\neasyrsa build-client-full CLIENT1 nopass\nopenvpn --tls-crypt-v2 ${EASYRSA_PKI}\/private\/server.pem --genkey tls-crypt-v2-client ${EASYRSA_PKI}\/private\/CLIENT1.pem<\/code><\/pre>\n\u30d5\u30a1\u30a4\u30a2\u30fc\u30a6\u30a9\u30fc\u30eb<\/h2>\n
# Configure firewall\nuci rename firewall.@zone[0]="lan"\nuci rename firewall.@zone[1]="wan"\nuci del_list firewall.lan.device="tun+"\nuci add_list firewall.lan.device="tun+"\nuci -q delete firewall.ovpn\nuci set firewall.ovpn="rule"\nuci set firewall.ovpn.name="Allow-OpenVPN"\nuci set firewall.ovpn.src="wan"\nuci set firewall.ovpn.dest_port="${VPN_PORT}"\nuci set firewall.ovpn.proto="${VPN_PROTO}"\nuci set firewall.ovpn.target="ACCEPT"\nuci commit firewall\nservice firewall restart<\/code><\/pre>\nVPN \u30b5\u30fc\u30d3\u30b9\u306e\u69cb\u6210\u30d5\u30a1\u30a4\u30eb\u751f\u6210<\/h2>\n
# Configure VPN service and generate client profiles\numask go=\nVPN_DH="$(cat ${VPN_PKI}\/dh.pem)"\nVPN_CA="$(openssl x509 -in ${VPN_PKI}\/ca.crt)"\nls ${VPN_PKI}\/issued \\\n| sed -e "s\/\\.\\w*$\/\/" \\\n| while read -r VPN_ID\ndo\nVPN_TC="$(cat ${VPN_PKI}\/private\/${VPN_ID}.pem)"\nVPN_KEY="$(cat ${VPN_PKI}\/private\/${VPN_ID}.key)"\nVPN_CERT="$(openssl x509 -in ${VPN_PKI}\/issued\/${VPN_ID}.crt)"\nVPN_EKU="$(echo "${VPN_CERT}" | openssl x509 -noout -purpose)"\ncase ${VPN_EKU} in\n(*"SSL server : Yes"*)\nVPN_CONF="${VPN_DIR}\/${VPN_ID}.conf"\ncat << EOF > ${VPN_CONF} ;;\nuser nobody\ngroup nogroup\ndev tun\nport ${VPN_PORT}\nproto ${VPN_PROTO}-server\nproto ${VPN_PROTO}6-server\nserver-ipv6 ${VPN_POOL6}\ntopology subnet\nclient-to-client\nkeepalive 10 60\npersist-tun\npersist-key\npush "dhcp-option DNS ${VPN_DNS6}"\npush "dhcp-option DOMAIN ${VPN_DN}"\npush "redirect-gateway ipv6"\npush "persist-tun"\npush "persist-key"\n<dh>\n${VPN_DH}\n<\/dh>\nEOF\n(*"SSL client : Yes"*)\nVPN_CONF="${VPN_DIR}\/${VPN_ID}.ovpn"\ncat << EOF > ${VPN_CONF} ;;\nuser nobody\ngroup nogroup\ndev tun\nnobind\nclient\nremote ${VPN_SERV} ${VPN_PORT} ${VPN_PROTO}\nauth-nocache\nblock-outside-dns\nremote-cert-tls server\nEOF\nesac\ncat << EOF >> ${VPN_CONF}\n<tls-crypt-v2>\n${VPN_TC}\n<\/tls-crypt-v2>\n<key>\n${VPN_KEY}\n<\/key>\n<cert>\n${VPN_CERT}\n<\/cert>\n<ca>\n${VPN_CA}\n<\/ca>\nEOF\ndone\nservice openvpn restart\nls ${VPN_DIR}\/*.ovpn<\/code><\/pre>\n# Enable CRL verification\nVPN_PKI="\/etc\/easy-rsa\/pki"\nVPN_CRL="$(cat ${VPN_PKI}\/crl.pem)"\ncat << EOF >> \/etc\/openvpn\/server.conf\n<crl-verify>\n${VPN_CRL}\n<\/crl-verify>\nEOF<\/code><\/pre>\n\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u8a3c\u660e\u66f8\u306e\u7121\u52b9\u5316<\/h1>\n
# Revoke client certificate\neasyrsa revoke RevokeCLIENT<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"