tun (IP 層面的通道) 和 tap (Ethernet 層面的通道) 介面。實務上，常用的是 tun 介面，除非 VPN 客戶端難以經由 Ethernet 橋接器整合入伺服器的區域網路。
pki/ca.crt) will be stored on all machines (both server and clients) as /etc/ssl/certs/Falcot_CA.crt. The server's certificate is installed only on the server (pki/issued/vpn.falcot.com.crt goes to /etc/ssl/certs/vpn.falcot.com.crt, and pki/private/vpn.falcot.com.key goes to /etc/ssl/private/vpn.falcot.com.key with restricted permissions so that only the administrator can read it), with the corresponding Diffie-Hellman parameters (pki/dh.pem) installed to /etc/openvpn/dh.pem. Client certificates are installed on the corresponding VPN client in a similar fashion.
/etc/openvpn/*.conf. Setting up a VPN server is therefore a matter of storing a corresponding configuration file in this directory. A good starting point is /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz, which leads to a rather standard server. Of course, some parameters need to be adapted: ca, cert, key and dh need to describe the selected locations (respectively, /etc/ssl/certs/Falcot_CA.crt, /etc/ssl/vpn.falcot.com.crt, /etc/ssl/private/vpn.falcot.com.key and /etc/openvpn/dh.pem). The server 10.8.0.0 255.255.255.0 directive defines the subnet to be used by the VPN; the server uses the first IP address in that range (10.8.0.1) and the rest of the addresses are allocated to clients.
tun0 name. However, firewalls are often configured at the same time as the real network interfaces, which happens before OpenVPN starts. Good practice therefore recommends creating a persistent virtual network interface, and configuring OpenVPN to use this pre-existing interface. This further allows choosing the name for this interface. To this end, openvpn --mktun --dev vpn --dev-type tun creates a virtual network interface named vpn with type tun; this command can easily be integrated in the firewall configuration script, or in an up directive of the /etc/network/interfaces file, or a udev rule can be added to that end. The OpenVPN configuration file must also be updated accordingly, with the dev vpn and dev-type tun directives.
10.8.0.1 位址近用 VPN 伺服器。為了授權客戶近用在地網路 (192.168.0.0/24)，需在 OpenVPN 組態中加入 推送路徑 192.168.0.0 255.255.255.0，讓 VPN 客戶端自動取得網路路由，使其明瞭經由 VPN 可以進入該網路。此外，在地網路的機器也需被告知，經由 VPN 伺服器 (在閘道安裝 VPN 伺服器即自動啟用) 進入VPN。另外，VPN 伺服器可以組態後執行偽裝 IP 的工作，讓來自 VPN 客戶端的訊息顯示成來自 VPN 伺服器 (見 節 10.1, “閘道器”)。
/etc/openvpn/ 內的檔案才能設定 OpenVPN 客戶端。標準的組態方法可從使用 /usr/share/doc/openvpn/examples/sample-config-files/client.conf 這個檔案開始。remote vpn.falcot.com 1194 介紹 OpenVPN 伺服器的位址及埠號；描述密鑰文件位址時，需參考 ca、cert 和 key。
AUTOSTART directive to none in the /etc/default/openvpn file. Starting or stopping a given VPN connection is always possible with the commands systemctl start openvpn@name and systemctl stop openvpn@name (where the connection name matches the one defined in /etc/openvpn/name.conf).
tun*) 於 SSH 連結的兩端，且可以精準地組態這些虛擬介面，就像在實體介面環境下。必須先設定 PermitTunnel 為 “yes” 於 SSH 伺服器組態檔 (/etc/ssh/sshd_config)，才能啟用此隧道系統。啟用 SSH 連結後，新增的隧道必須以 -w any:any 選項 (any 可以用期望的 tun 設備名稱取代) 請求連結。兩端的使用者需有管理者權限，才能新增網路設備 (換句話說，必須以超級使用者的身份才能建立連結)。
/etc/ipsec.conf contains the parameters for IPsec tunnels (or Security Associations, in the IPsec terminology) that the host is concerned with. There are many configuration examples in /usr/share/doc/libreswan/, but Libreswan's online documentation has more examples with explanations:
systemctl; for example, systemctl start ipsec will start the IPsec service.
/etc/ppp/options.pptp、/etc/ppp/peers/falcot、/etc/ppp/ip-up.d/falcot、與 /etc/ppp/ip-down.d/falcot。
範例 10.2. /etc/ppp/options.pptp 檔案
# PPP options used for a PPTP connection lock noauth nobsdcomp nodeflate
範例 10.3. /etc/ppp/peers/falcot 檔案
# vpn.falcot.com is the PPTP server pty "pptp vpn.falcot.com --nolaunchpppd" # the connection will identify as the "vpn" user user vpn remotename pptp # encryption is needed require-mppe-128 file /etc/ppp/options.pptp ipparam falcot
pptpd 是 Linux 的 PPTP 伺服器。它的主要組態檔是，/etc/pptpd.conf，應做若干改變：localip (內網 IP 位址) 與 remoteip (外網 IP 位址)。在下例中，PPTP 伺服器總是使用 192.168.0.199 位址，以及從 192.168.0.200 至 192.168.0.250 之間接收 PPTP 客戶端的 IP 位址。
範例 10.6. /etc/pptpd.conf 檔案
[..] # TAG: localip # TAG: remoteip # Specifies the local and remote IP address ranges. # # These options are ignored if delegate option is set. # # Any addresses work as long as the local machine takes care of the # routing. But if you want to use MS-Windows networking, you should # use IP addresses out of the LAN address space and use the proxyarp # option in the pppd options file, or run bcrelay. # # You can specify single IP addresses seperated by commas or you can # specify ranges, or both. For example: # # 192.168.0.234,192.168.0.245-249,192.168.0.254 # # IMPORTANT RESTRICTIONS: # # 1. No spaces are permitted between commas or within addresses. # # 2. If you give more IP addresses than the value of connections, # it will start at the beginning of the list and go until it # gets connections IPs. Others will be ignored. # # 3. No shortcuts in ranges! ie. 234-8 does not mean 234 to 238, # you must type 234-238 if you mean this. # # 4. If you give a single localIP, that's ok - all local IPs will # be set to the given one. You MUST still give at least one remote # IP for each simultaneous client. # # (Recommended) #localip 192.168.0.1 #remoteip 192.168.0.234-238,192.168.0.245 # or #localip 192.168.0.234-238,192.168.0.245 #remoteip 192.168.1.234-238,192.168.1.245 localip 192.168.0.199 remoteip 192.168.0.200-250
/etc/ppp/pptpd-options 做若干改變。 重要的參數有伺服器名稱 (pptp)、網域名稱 (falcot.com)、以及 DNS 與 WINS 伺服器的 IP 位址。
範例 10.7. /etc/ppp/pptpd-options 檔案
# Enable connection debugging facilities. # (see your syslog configuration for where pppd sends to) #debug # Name of the local system for authentication purposes # (must match the second field in /etc/ppp/chap-secrets entries) name pptpd # Optional: domain name to use for authentication ## change the domainname to your local domain domain falcot.com # Authentication ## these are reasonable defaults for WinXXXX clients ## for the security related settings auth refuse-pap refuse-chap refuse-mschap # Require the peer to authenticate itself using MS-CHAPv2 [Microsoft # Challenge Handshake Authentication Protocol, Version 2] authentication. require-mschap-v2 # Require MPPE 128-bit encryption # (note that MPPE requires the use of MSCHAP-V2 during authentication) require-mppe-128 # Network and Routing ## Fill in your addresses ms-dns 192.168.0.1 ms-wins 192.168.0.1 ## Fill in your netmask netmask 255.255.255.0 ## some defaults nodefaultroute proxyarp lock
vpn 使用者 (及其密碼) 於 /etc/ppp/chap-secrets 檔案的最後一個步驟。其他的作為裡，星號 (*) 是有作用的，在此的伺服器名稱必須明示出來。而且，Windows PPTP 客戶端以 DOMAIN\\USER 形式辨識，不是以使用者名稱區別。這就說明了在 FALCOT\\vpn 使用者必須提及的檔案。也可以指定使用者使用特定的 IP 位址；此欄位內的星號用於指定動態的位址。