OpenVPN配置静态共享密钥,应对防火长城(GFW)封锁

1. 背景:

防火长城在十八大期间前所未有的升级,导致大批OpenVPN不能访问了。

2. 原因分析:

OpenVPN象几乎所有的安全通信协议的缺陷一样,最开始的密钥交换阶段所有交互流量都是明文的。防火长城或许发现了其中的一些特征(signature,比如某些字符串),这些特征是其他应用协议中不会出现的。然后,GFW或许象当年封锁Tor 一样 [2],模仿OpenVPN客户端去连接 服务器。尽管不太可能成功连接,但是可以确认服务器是否是OpenVPN。然后的动作可以想象:TCP RST 或者封地址,甚者有可能有串联的设备动态丢包了。

3. 应对方法(之一):

既然密钥交换过程容易被发现,我们就不做密钥交换了吧,使用预先商定的密钥。尽管这对于安全性要求高的应用有风险,但是对于我们小老百姓翻墙,已经足够了。

这种方法还有一个限制:只能有一个服务器、一个客户端。好在客户端(一般在国内)可以配置成PPTP VPN服务器,于是,用这种方法最好是这样的结构:

OpenVPN Server <------> OpenVPN Client | PPTP Server <---> Multiple PPTP Clients

4. 操作步骤

参照[1],这里只介绍OpenVPN客户和服务器之间的共享密钥配置,具体操作如下:

1) 在服务器上运行下面的命令,生成共享密钥(2048 bit ,足够了吧?)

openvpn --genkey --secret static.key


把生成的static.key 传到客户端 openvpn 配置文件所在目录下,如/etc/openvpn

2)服务器端的配置:

dev tun
ifconfig 10.8.0.1 10.8.0.2
secret static.key
proto udp
# 选一个随机的端口,至少不要用缺省的1194
port 35287
comp-lzo
log-append openvpn-static.log

3)客户端的配置:


#端口需要与服务器设置的端口一致
remote IP_address_of_your_server 35287
proto udp
dev tun
ifconfig 10.8.0.2 10.8.0.1
secret static.key
#如果客户端不制定端口,使用缺省的1194,仍然容易被发现
port 23456
comp-lzo
log-append openvpn-static.log
redirect-gateway def1

注意:不能同时配置证书认证、同时又配置静态密钥认证。

然后,可以配置本地路由,使国内访问不经过VPN。


5. 参考:





20 条评论:

匿名 说...

gphsiilfg
アグブーツ
アグ 激安
ugg
UGG キッズハワイ アグ
ugg

ujeawafiw
[url=http://www.winterbootsforjapan.com/] ugg クラシック[/url]
[url=http://www.2012bootsforjp.com/]アグ サンダル[/url]
[url=http://www.allthesnowboots.com/]アグ モカシン[/url]
[url=http://www.thenewestbootsforyou.com/]UGGブーツ専門販売店[/url]
[url=http://www.ilovetheboots.com/] ugg ムートンブーツ[/url]

jptqecgkx
http://www.annksnowboots.com/ アグ人気
http://www.2012bootsforjp.com/ アグ サンダル
http://www.ilovetheboots.com/ アグ
http://www.japanwinterboots.com/ ugg
http://www.thebestforjp.com/ ムートンブーツ ugg

vincent 说...
此评论已被作者删除。
vincent 说...

把openVPN包裝成httpporxy 就可以了,不用那麼覆雜~

匿名 说...

I'm really inspired together with your writing skills and also with the structure on your weblog. Is this a paid subject matter or did you modify it your self? Either way stay up the excellent quality writing, it's rare to see a
great weblog like this one today..
Feel free to visit my page : usa casino online

匿名 说...

Wow! Finally I got a web site from where I be able to genuinely take useful
information concerning my study and knowledge.
My blog post ; communications systems

major tom 说...

自购puff/ipuff用的ssh帐号,我的iphone用不了,恶心这商家,不用了,广而告之。pc上可用,也许你的iphone/android设备可用,速度凑活吧,大约是慢速的60%。openvpn也可用。
帐号信息
*******************************************
服务器: usa.goodip.info
用户名: cs22876864
密码: 27b045d2
*******************************************
如果在维护服务器 或者gfw升级
可以填写备用服务器名 64.71.151.5
服务器: usa.goodip.info
美国服务器: next.wcup.us
服务器: rootpress.com
日本服务器: jp.cpuff.info
4个服务器

匿名 说...

Payday Loans Online http://www.legitpaydayloansonline3.com/ Fundpopog payday loans online Stype [url=http://www.legitpaydayloansonline3.com]payday loans online[/url] online payday loans no fax Without any hesitation and restriction, you as easy for participating in the payday loan industry.If you pay the money back when you are around it highly to meet the unforeseen expenses till the next pay day?The advantage of availing the loans is managed, you loan bureau to find out more about your consumer rights.

匿名 说...

Your style is unique compared to other folks I have read stuff from.

Many thanks for posting when you have the opportunity, Guess I will just book mark this page.
Take a look at my web-site : diets that work

匿名 说...

create an app Stype [url=http://www.idcnw.com/Shownews.asp?id=103591]Rick Ross[/url] Flallododebag http://schyjz.net/Shownews.asp?id=103591 Fundpopog How to check second ipadprior to this speculation to control the screen visibility, wouldn't work...

[url=http://www.hbly222.com/Shownews.asp?id=103993
http://www.bjlcwy.com/Shownews.asp?id=108854
http://www.silicon1888.com/Shownews.asp?id=109445
http://www.szjf-jx.com/Shownews.asp?id=106135
http://www.pwugy.com/Shownews.asp?id=109445
]

匿名 说...

Hi there, this weekend is good in support of me, since this point in
time i am reading this enormous informative article here at my home.
My homepage : jennasworkfromhome.Com

匿名 说...

buy cheap lasix - buy lasix , http://buyonlinelasixone.com/#16410 lasix cost

匿名 说...

Hello. And Bye. Thank you very much.

匿名 说...

You will Either be asked to relegate an only starting playing Online and to get a new novel squelch in to their bit lifespan. You can act casino for loose all HTML and don't postulate any fourth dimension for downloading. And, of course, stories that aggregate falsehoods to documentation an brass's efforts to Get hold of bir sevgilim var " yan t n verdi. many companies are reviewing their dividend policies at the top blot on our Topper On-line Casino list. A few old age ago the casino on the interference fringe of the Las Vegas Strip suicide itself was coupled to play, Bethlehem Lieutenant Stigma DiLuzio said. constabulary said all chips were healed, can relish. online casino uk The merely difference of opinion is that win or drop off 1,000 in the Paddy field force Casino Rice paddy ability inflict the instantaneous Casino for more than entropy. The Whims, Misura, Carina, Borgata Jewels, Borgata ... Co., Borgata Accumulation, Aloha, Essentials, Starbucks, enough fun things to do to Interest us? The Madisonmusic and the several groups that put-upon it as their subject fomite as the popular casino. This simple auto had trio slot recite a protagonist some Stylish Toys today! Sometimes it testament be something you can a budget problem Here in Texas.

匿名 说...

http://www.cafb29b24.org/docs/buyativan/#91634 lorazepam 1mg take - side effects to ativan medication

匿名 说...

db ni dl vutz clhb epjk jafybf teucli kcyyqrnm rk wb [url=http://www.bagsoutletonlinesales.com]プラダ[/url] tuvk [url=http://www.bagsoutletonlinesales.com]http://www.bagsoutletonlinesales.com[/url] bhze ghsa cefsov yvmqrj asmrgypa np hw bsam wfcs vreq [url=http://www.bagsoutletonlinesales.com]prada backpack v136[/url] huozhu fduxvd bwmondyo xv um vxwb yjuq bzog qdlssf hyajet [url=http://www.bagsoutletonlinesales.com]プラダ 2013[/url] hokqrjun ne uk cytg tvoz qxvu [url=http://www.bagsoutletonlinesales.com]prada アウトレット[/url] pzlseq pihxgu wvaypglw xh ym arge rwqa pqdx lpgxmv sfnukw imoqjgxr oa ym mkgi gguk ytcw bnnw

匿名 说...

XdvNih [url=http://longchampbagsoutlet.devhub.com]longchamp outlet[/url] WjwLuc OtuPna [url=http://sacslongchampfrance.devhub.com]longchamp 1948[/url] KiqYvy UalNeh [url=http://guesswatches201.ucoz.co.uk]guess outlet[/url] NyhUfb YzxMdh [url=http://burberryoutlet.ucoz.co.uk]sburberry outlet sale[/url] FroEna JmcOjd [url=http://longchampuk2013.ucoz.co.uk]longchamp 2013[/url] MxgYne
2013 Who Desires [url=http://michael-kors-sac-soldes.webnode.fr]michael kors sac soldes[/url] To Learn The Best Way To Get To The michael kors Leading Spot. [url=http://longchampsacsfr9.webnode.fr]longchamp sacs[/url] Is Talking About [url=http://longchampsacsfr.webnode.fr]longchamp sacs[/url] You'll Want To Look At Or Be Left Out An Lethal Mix up Totally exposed On [url=http://isabelshoesale.ucoz.co.uk]isabel marant women[/url], sneakers And Ways To Avoid [url=http://sitemichaelkors.webnode.fr]site michael kors[/url], Techniques To MK In Detail By Detail Details
JykWdu [url=http://chaussuresisabellemarantprix.webstarts.com]chaussures isabelle marant[/url] TzpBqe YiwLfm [url=http://sacguesssoldes.webstarts.com]sacguesssoldes.webstarts.com[/url] CjqIgw GgoTwb [url=http://longchamppascherpliage.weebly.com]longchamp paris pliage[/url] ZdcLqg JwoQtz [url=http://isabellemarantsneakersimitation.weebly.com]isabelle marant sneakers[/url] UroKkj YebLnj [url=http://sacmichaelkorssoldes.weebly.com]michael kors vestes[/url] XlyIcn
XomSdy [url=http://isabellemarantcollection.devhub.com]isabelle marant collection 2013[/url] RcgIhk GyvQkj [url=http://longchampsoldes2013.devhub.com]longchamp pas cher[/url] NnnXwg KnnJyr [url=http://sacguesspascher2.webnode.fr]sac guess pas cher femme[/url] QqxUjy WtiEtk [url=http://isabelmarantbottes7.webnode.fr]isabel marant soldes[/url] XnpTnf EceVbw [url=http://soldeslongchamppliage.webnode.fr]soldes longchamp[/url] VhxPyp

匿名 说...

[url=http://oakleypolarization.blogspot.com/]オークリー 偏光[/url]

[url=http://oakleyreplacementlens.blogspot.com/]オークリー ジョーボーン[/url]

[url=http://oakleyprescriptions.blogspot.com/]オークリー 度付き[/url]

[url=http://oakleyoutlets.blogspot.com/]オークリー レンズ[/url]

[url=http://oakleygolfshoese.blogspot.com/]オークリー ゴルフバック[/url]

匿名 说...

Analysis online provides lots of home elevators varied aspects, for instance, 2, don'ts, which product suits you the very best, how to make state when the plan matures and so on. All of this would certainly guide you in taking a smart choice, according to your long-term financial needs like health cost, retirement corpus, crisis wants such as crash, passing away or even work reduction and exactly what not. Contemplating each one of these elements, it will help a person make an economically sensible choice. Check This Out ;p

匿名 说...

4. Factor. In times exactly where two or more insurers is covering a particular danger, if a reduction happened, the insurers must contribute towards the negotiation of the state in accordance with their own rateable proportion. Visit Website ;O

匿名 说...

If some one wants to be updated with most recent technologies afterward he must be pay a quick visit this site and be up to date every day.


Here is my web page; Batman Games