openvpn tap

.###############################################################################Next, change the settings fileFor httpd.conf and ssl.conf, if your server does not have a domain name, then servername will fill in the IP. For example: ServerName 10.10.10.10:80 (httpd.conf) ServerName 10.10.10.10:443 (ssl.conf)Open httpd.conf: Find #loadmodule ssl_module modules/mod_ssl.so, remove the front ' # ' so that the SSL module is loaded at startup.Open ssl.conf: Find #I put them all in Apache's conf direct

, required for client authentication)Sslverifydepth 1 (Remove the previous ' # ' number, change 10 to 1, required for client authentication) 　　 ##############################################################################Now, we're going to make a certificate.Go to openvpn.net to download and install OpenVPN.Http://openvpn.net/release/openvpn-2.0.9-install.exeThis is a virtual personal network production tool, he can perfect in win (LINUX,BSD) under

not have to modify the source code can solve the problem, but I still like to modify the codes, why? Very simple, the source code is easy to obtain, and the source code is easy to modify, I have been obsessed with writing a lot of netfilter extension and do a lot of nf_conntrack changes, and even added some damn socket filter ... Although these behaviors are self-entertaining, and are not used in the work, but these behavior shows that I am not a network administrator, but a programmer, haha, s

not have to modify the source code can solve the problem, but I still like to modify the codes, why? Very simple, the source code is easy to obtain, and the source code is easy to modify, I have been obsessed with writing a lot of netfilter extension and do a lot of nf_conntrack changes, and even added some damn socket filter ... Although these behaviors are self-entertaining, and are not used in the work, but these behavior shows that I am not a network administrator, but a programmer, haha, s

and P2:Ip netns exec netns1 P1P2Okay, it's all over.I always think that in Linux, the problem can be solved without modifying the source code, but I still like to modify the code. Why? Very simple, the source code is easy to obtain, and the source code is easy to modify. I write a lot of Netfilter extensions and made a lot of nf_conntrack modifications, even some damn socket filters... although these behaviors are self-entertaining and not applied at work, they indicate that I am not a network

side):Nic 1:10.20.0.128 (eth0, no internet access)Nic 2:192.168.1.52 (eth1,internet access)Host B (client):Nic 1:10.20.0.129 (eth0, no internet access)Host a operation:Turn on the iptables forwarding function:Sysctl-w net.ipv4.conf.default.accept_source_route=1 sysctl-w net.ipv4.conf.default.rp_filter=0 SYSCT L-w net.ipv4.ip_forward=1To configure iptables NAT rules:Modprobe iptable_nat iptables-t nat-a postrouting-s 10.20.0.0/24-o eth1-j MasqueradeDelete iptables deny forwarding rule:iptables-d

! again.OpenVPN by me into a multi-threaded, occasionally will segment fault. However, the entire Multi_instance table is still global. We know that the OpenVPN all rely on the Multi_instance table to route the packet, this table is a routing table! Each MI holds a client's virtual IP address, real IP address, virtual MAC address (tap mode) ... Come over. A tun character device's packet, need to use the tar

Create a wireless route for Raspberry Pi OpenVPN is a private protocol and requires proprietary clients. Therefore, it is difficult to use OpenVPN on Android (CM9 supports OpenVPN), iOS, and WP8. Combining Raspberry Pi and OpenVPN to build a soft AP can easily solve these problems. Why is this combination selected? Ra

1, the VPS (server) on the operation as follows The code is as follows Copy Code Mkdir-p/root/software/vpnCd/root/software/vpn # Download Packageswget http://www.oberhumer.com/opensource/lzo/download/lzo-2.05.tar.gzwget http://swupdate.openvpn.net/community/releases/openvpn-2.2.1.tar.gz # Decompression and InstallationTar zxvf lzo-2.05.tar.gzcd/root/software/vpn/lzo-2.05./configureMakeMake install Tar zxvf

broadcast network, it needs to resolve the layer-3 address to the link layer, so ARP is inevitable, all the tap-mode NICs that are connected by user-assisted processes such as openvpn belong to an Ethernet LAN, regardless of the physical distance between them. ARP is used for address resolution, in addition, the tap-mode virtual network card can encapsulate laye

technology is related to the media, such as SDH on the optical fiber, SONET, and SDH on the copper line. However, we can see that SDH can directly transmit IP packets, because it has its own frame encapsulation mechanism, isn't it messy?To really understand the network hierarchy, I think we can use the tun/TAP model of openvpn to compare openvpn as a physical la

policy configured that allows only one mac per port. (B) No of virtual devices created on a master exceed the mac capacity and puts the NIC in promiscous mode and degraded performance is a concern. (c) If the slave device is to be put into the hostile/untrusted network namespace where L2 on the slave cocould be changed/misused. MACVTAP virtual network card technology is the last virtual network card mentioned in this article. Why is there such a virtual network card? Let's start with the proble

allows only one mac per port. (B) No of virtual devices created on a master exceed the mac capacity and puts the NIC in promiscous mode and degraded performance is a concern. (c) If the slave device is to be put into the hostile/untrusted network namespace where L2 on the slave cocould be changed/misused. MACVTAP virtual network card technology is the last virtual network card mentioned in this article. Why is there such a virtual network card? Let's start with the problem. If a virtual machine

, when it runs the OS, how to emulate the network card? Or we implement a user-state protocol stack, and the kernel stack is completely independent, you can think of them as two net namespace, at this time how to route the physical network card traffic to the user state? Or, conversely, how do you route data from the user-state stack to outside of box? According to the conventional idea, we know that the endpoint of the TAP network card is a user-acce