Amazon AWS VPC With OpenVpn 筆記整理

1. Create VPC                                                                                                                                                                            首先選擇  VPC with a Single Public Subnet Only，逐步按continue即可
2. 
   這裡我們只使用一個subnet 10.0.0.0/24                                           
3. Launch  EC2 instance with  OpenVpn                                                                                          首這裡比較需要注意是要溝選掛在EC2-VPC

        輸入keypair記得按download下來之後ssh登錄需要使用

因為我是要裝openvpn所以相關port要打開

安裝完之後會自動啟動, 根據文件disable Change Source/Dest. Check.

http://aws.amazon.com/articles/0639686206802544

Disable Source/Dest checking on both instances by right-clicking the instances and selecting Change Source/Dest. Check.

1. Configure the Linux instances to route traffic by editing /etc/sysctl.conf and change the net.ipv4.ip_forward variable from 0 to 1
2. Prompt> sudo vi /etc/sysctl.conf
3. net.ipv4.ip_forward = 1
4. Restart your network settings for the network forwarding settings to take effect.
5. Prompt> sudo service network restart

接下來Elastic IPs allocate一個ip給 instance,然後使用putty ssh登錄

參考阿正老師的登錄方式

http://blog.soft.idv.tw/?p=824&page=2

因為EC2的金鑰是以.pem檔來儲存，Putty無法直接使用，因此我們必須先下載Puttygen來做金鑰的轉檔

若不想每次進去都要使用金鑰

Ubuntu版  第一次登錄時請使用帳號ubuntu

※免憑證登入EC2

如果覺得每次登入都給用金鑰很麻煩, 可以將金鑰登入方式改成帳號密碼..

1. 以root身份修改 sudo vim /etc/ssh/sshd_config, 把

PasswordAuthentication no 改成

PasswordAuthentication yes

2. 重新啟動sshd

sudo service ssh restart 跟centos 版不一樣

接著設定使用帳號的密碼即可.

Centos版 第一次登錄時請使用帳號ec2-user

因為ec2的vps預設不讓你用su指令切換成root，因此可以輸入下面這行指令換掉root的密碼：

sudo passwd root

1.以root的身份修改 /etc/ssh/sshd_config，找到第60行 PasswordAuthentication no，把no改成yes，如下圖

2.然後重新啟動sshd

sudo /sbin/service sshd restart

然後以root身份輸入

passwd ec2-user

改掉預設使用者「ec2-user」的密碼，以後再用putty登入ssh時就可以不用選擇金鑰檔，只要直接輸入密碼就可以登入EC2的虛擬機器了。

centos版openvpn安裝

yum  update

yum -y install openvpn

cd /usr/share/openvpn/easy-rsa/2.0 

可以先vim vars文件修改國家省份等資訊建憑證時要用

source vars

./clean-all  

./build-ca  

./build-key-server server  

./build-dh   

在此可順便建client的憑證 要使用幾個client就要建幾個,之後安裝client openvpn可以使用

./build-key client1  

./build-key client2 

./build-key client3  

這樣server端憑證就建完了會產生在一個keys的資料夾

cp  -r keys   /etc/openvpn

找到server.conf的sample來修改

cp /usr/share/doc/openvpn-2.2.2/sample-config-files/server.conf    /etc/openvpn

vim /server.conf 如下:

# Which local IP address should OpenVPN

# listen on? (optional)

;local a.b.c.d

# Which TCP/UDP port should OpenVPN listen on?

# If you want to run multiple OpenVPN instances

# on the same machine, use a different port

# number for each one.  You will need to

# open up this port on your firewall.

port 1194

# TCP or UDP server?

;proto tcp

proto udp

# "dev tun" will create a routed IP tunnel,

# "dev tap" will create an ethernet tunnel.

# Use "dev tap0" if you are ethernet bridging

# and have precreated a tap0 virtual interface

# and bridged it with your ethernet interface.

# If you want to control access policies

# over the VPN, you must create firewall

# rules for the the TUN/TAP interface.

# On non-Windows systems, you can give

# an explicit unit number, such as tun0.

# On Windows, use "dev-node" for this.

# On most systems, the VPN will not function

# unless you partially or fully disable

# the firewall for the TUN/TAP interface.

;dev tap

dev tun

# Windows needs the TAP-Win32 adapter name

# from the Network Connections panel if you

# have more than one.  On XP SP2 or higher,

# you may need to selectively disable the

# Windows firewall for the TAP adapter.

# Non-Windows systems usually don't need this.

;dev-node MyTap

# SSL/TLS root certificate (ca), certificate

# (cert), and private key (key).  Each client

# and the server must have their own cert and

# key file.  The server and all clients will

# use the same ca file.

#

# See the "easy-rsa" directory for a series

# of scripts for generating RSA certificates

# and private keys.  Remember to use

# a unique Common Name for the server

# and each of the client certificates.

#

# Any X509 key management system can be used.

# OpenVPN can also use a PKCS #12 formatted key file

# (see "pkcs12" directive in man page).

ca /etc/openvpn/keys/ca.crt

cert /etc/openvpn/keys/server.crt

key /etc/openvpn/keys/server.key  # This file should be kept secret

# Diffie hellman parameters.

# Generate your own with:

#   openssl dhparam -out dh1024.pem 1024

# Substitute 2048 for 1024 if you are using

# 2048 bit keys.

dh /etc/openvpn/keys/dh1024.pem

# Configure server mode and supply a VPN subnet

# for OpenVPN to draw client addresses from.

# The server will take 10.8.0.1 for itself,

# the rest will be made available to clients.

# Each client will be able to reach the server

# on 10.8.0.1. Comment this line out if you are

# ethernet bridging. See the man page for more info.

server 10.8.0.0 255.255.255.0 #openvpn 啟動時subnet會是10.8.0.1/24, ip:10.8.0.1

# Maintain a record of client <-> virtual IP address

# associations in this file.  If OpenVPN goes down or

# is restarted, reconnecting clients can be assigned

# the same virtual IP address from the pool that was

# previously assigned.

ifconfig-pool-persist ipp.txt

# Configure server mode for ethernet bridging.

# You must first use your OS's bridging capability

# to bridge the TAP interface with the ethernet

# NIC interface.  Then you must manually set the

# IP/netmask on the bridge interface, here we

# assume 10.8.0.4/255.255.255.0.  Finally we

# must set aside an IP range in this subnet

# (start=10.8.0.50 end=10.8.0.100) to allocate

# to connecting clients.  Leave this line commented

# out unless you are ethernet bridging.

;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100

# Configure server mode for ethernet bridging

# using a DHCP-proxy, where clients talk

# to the OpenVPN server-side DHCP server

# to receive their IP address allocation

# and DNS server addresses.  You must first use

# your OS's bridging capability to bridge the TAP

# interface with the ethernet NIC interface.

# Note: this mode only works on clients (such as

# Windows), where the client-side TAP adapter is

# bound to a DHCP client.

;server-bridge

# Push routes to the client to allow it

# to reach other private subnets behind

# the server.  Remember that these

# private subnets will also need

# to know to route the OpenVPN client

# address pool (10.8.0.0/255.255.255.0)

# back to the OpenVPN server.

;push "route 192.168.10.0 255.255.255.0"

;push "route 192.168.20.0 255.255.255.0"

push "route 10.0.0.0 255.255.255.0"  

#push route vpc的subnet 10.0.0.0/24 這樣 10.8.0.0網段才可以連到10.0.0.0網段

 只設定上面筆電連上vpn後只能ping到vpn主機1.0.0.99(有設elastic ip)

另一台private ip卻ping不到,後來在vpc route tables add 10.8.0.0/24即可成功(要選擇 association with 10.0.0.0/24 subnet)

# To assign specific IP addresses to specific

# clients or if a connecting client has a private

# subnet behind it that should also have VPN access,

# use the subdirectory "ccd" for client-specific

# configuration files (see man page for more info).

# EXAMPLE: Suppose the client

# having the certificate common name "Thelonious"

# also has a small subnet behind his connecting

# machine, such as 192.168.40.128/255.255.255.248.

# First, uncomment out these lines:

;client-config-dir ccd

;route 192.168.40.128 255.255.255.248

#client-config-dir /etc/openvpn/ccd

#route 124.0.0.0 255.255.255.0

# Then create a file ccd/Thelonious with this line:

#   iroute 192.168.40.128 255.255.255.248

# This will allow Thelonious' private subnet to

# access the VPN.  This example will only work

# if you are routing, not bridging, i.e. you are

# using "dev tun" and "server" directives.

# EXAMPLE: Suppose you want to give

# Thelonious a fixed VPN IP address of 10.9.0.1.

# First uncomment out these lines:

;client-config-dir ccd

;route 10.9.0.0 255.255.255.252

# Then add this line to ccd/Thelonious:

#   ifconfig-push 10.9.0.1 10.9.0.2

# Suppose that you want to enable different

# firewall access policies for different groups

# of clients.  There are two methods:

# (1) Run multiple OpenVPN daemons, one for each

#     group, and firewall the TUN/TAP interface

#     for each group/daemon appropriately.

# (2) (Advanced) Create a script to dynamically

#     modify the firewall in response to access

#     from different clients.  See man

#     page for more info on learn-address script.

;learn-address ./script

# If enabled, this directive will configure

# all clients to redirect their default

# network gateway through the VPN, causing

# all IP traffic such as web browsing and

# and DNS lookups to go through the VPN

# (The OpenVPN server machine may need to NAT

# or bridge the TUN/TAP interface to the internet

# in order for this to work properly).

;push "redirect-gateway def1 bypass-dhcp"

# Certain Windows-specific network settings

# can be pushed to clients, such as DNS

# or WINS server addresses.  CAVEAT:

# http://openvpn.net/faq.html#dhcpcaveats

# The addresses below refer to the public

# DNS servers provided by opendns.com.

;push "dhcp-option DNS 208.67.222.222"

;push "dhcp-option DNS 208.67.220.220"

# Uncomment this directive to allow different

# clients to be able to "see" each other.

# By default, clients will only see the server.

# To force clients to only see the server, you

# will also need to appropriately firewall the

# server's TUN/TAP interface.

;client-to-client

# Uncomment this directive if multiple clients

# might connect with the same certificate/key

# files or common names.  This is recommended

# only for testing purposes.  For production use,

# each client should have its own certificate/key

# pair.

#

# IF YOU HAVE NOT GENERATED INDIVIDUAL

# CERTIFICATE/KEY PAIRS FOR EACH CLIENT,

# EACH HAVING ITS OWN UNIQUE "COMMON NAME",

# UNCOMMENT THIS LINE OUT.

;duplicate-cn

# The keepalive directive causes ping-like

# messages to be sent back and forth over

# the link so that each side knows when

# the other side has gone down.

# Ping every 10 seconds, assume that remote

# peer is down if no ping received during

# a 120 second time period.

keepalive 10 120

# For extra security beyond that provided

# by SSL/TLS, create an "HMAC firewall"

# to help block DoS attacks and UDP port flooding.

#

# Generate with:

#   openvpn --genkey --secret ta.key

#

# The server and each client must have

# a copy of this key.

# The second parameter should be '0'

# on the server and '1' on the clients.

;tls-auth ta.key 0 # This file is secret

# Select a cryptographic cipher.

# This config item must be copied to

# the client config file as well.

;cipher BF-CBC        # Blowfish (default)

;cipher AES-128-CBC   # AES

;cipher DES-EDE3-CBC  # Triple-DES

# Enable compression on the VPN link.

# If you enable it here, you must also

# enable it in the client config file.

comp-lzo

# The maximum number of concurrently connected

# clients we want to allow.

;max-clients 100

# It's a good idea to reduce the OpenVPN

# daemon's privileges after initialization.

#

:

#

# You can uncomment this out on

# non-Windows systems.

;user nobody

;group nobody

# The persist options will try to avoid

# accessing certain resources on restart

# that may no longer be accessible because

# of the privilege downgrade.

persist-key

persist-tun

# Output a short status file showing

# current connections, truncated

# and rewritten every minute.

status openvpn-status.log

# By default, log messages will go to the syslog (or

# on Windows, if running as a service, they will go to

# the "\Program Files\OpenVPN\log" directory).

# Use log or log-append to override this default.

# "log" will truncate the log file on OpenVPN startup,

# while "log-append" will append to it.  Use one

# or the other (but not both).

;log         openvpn.log

;log-append  openvpn.log

# Set the appropriate level of log

# file verbosity.

#

# 0 is silent, except for fatal errors

# 4 is reasonable for general usage

# 5 and 6 can help to debug connection problems

# 9 is extremely verbose

verb 3

# Silence repeating messages.  At most 20

# sequential messages of the same message

# category will be output to the log.

;mute 20

儲存後可開啟server

sudo service openvpn restart

sudo service openvpn stop

sudo /etc/init.d/openvpn restart

sudo /etc/init.d/openvpn stop

安裝window7 openvpn client

開啟瀏覽器搜尋”openvpn gui”，搜尋後點選 “OpenVPN GUI for Windows” 。

Download 裡，點選一個stable選項。

請選擇如下安裝：Installation Package(Both 32-bit and 64-bit TAP driver included):openvpn-2.0.9-gui-1.0.3-install.exe

於下載好的位置，會看到openvpn-2.0.9-gui-1.0.3-install.exe軟體，請安裝好(安裝過程，都預設安裝即可) 。

win7安裝很多問題,記得去網路找

openvpn-2.1_rc15-install這版本安裝,安裝前要先勾選如下圖,安裝時請按右鍵使用系統管理員身份安裝即可

將keys產生的相關憑證copy至以下,要設定client.ovpn

 C:\Program Files (x86)\OpenVPN\config

之後connect即可連上vpn

也可以安裝商業版的有webadmin可以設定,但只有兩個free client

http://openvpn.net/index.php/access-server/docs/quick-start-guide.html

其它references可參考

http://www.whiteboardcoder.com/2012/12/amazon-aws-vpc-setting-up-openvpn-server.html

 http://mackung.blogspot.tw/2012/11/amazon-web-service-openvpn.html

Latest News Clips 2013.04.29

1.      WHO: H7N9 virus 'one of the most lethal so far' CNN    April 26, 2013

Hong Kong (CNN) -- On the same day yet another death was reported in China's bird flu outbreak, the World Health Organization warned the H7N9 virus was one of the most lethal that doctors and medical investigators had faced in recent years.

"This is an unusually dangerous virus for humans," Keiji Fukuda, WHO's assistant director-general for health, security and the environment told a news conference in Beijing Wednesday.

"We think this virus is more easily transmitted from poultry to humans than H5N1," he added, referring to the bird flu outbreak between 2004 and 2007 that claimed 332 lives.

"This is definitely one of the most lethal influenza viruses that we have seen so far."

As investigations continue into the possible sources of infection, Fukuda warned that authorities were still struggling to understand the virus. The WHO said China must brace for continued infections.

Fukuda's warning came as Taiwanese health authorities said they've confirmed the first human case of H7N9 in Taiwan -- one they said was imported from China.

A 53-year-old Taiwanese man who worked in eastern China was confirmed to have H7N9 on Wednesday, the Taiwanese Centers for Disease Control said. His condition was described to be severe.

He had been traveling back and forth regularly between China's Jingsu province and Taiwan, health officials said.

"According to the case, he had not been exposed to birds and poultry during his stay in Suzhou (in Jingsu province) and had not consumed undercooked poultry or eggs," the Taiwanese CDC said.

2.      Zao Wou-ki: Painting beyond words (1920-2013) CNN   April 12, 2013

Editor's note: Julia Grimes is a Ph.D. candidate in Chinese modern and contemporary art history at the University of California, Los Angeles (UCLA). Her dissertation examines the early artistic career of Zao Wou-ki.

(CNN) -- The Chinese-French painter Zao Wou-ki once told me that painting expresses the thoughts we struggle to put into words. Faced with this challenge, "It's easier to learn English!" he joked, his wit shining through, even though Alzheimer's disease had already begun its slow, relentless onslaught on his mind.

Zao, widely regarded as one of the foremost Chinese contemporary painters of the 20th century, passed away at his home in Switzerland on Tuesday at the age of 93.

Born in Beijing in 1920, he formed part of the second generation of Chinese artists to turn westward in their search for inspiration. Encouraged by the French-educated Chinese artist Lin Fengmian, his teacher at the prestigious Hangzhou National College of Art (today the China Academy of Art), he relocated to Paris in 1948. Although he did not know it at the time, the move would be permanent, due in part to the rapidly changing political situation in China.

Apart from brief trips abroad, Zao would remain in France until the year before his death, one of the few Chinese artists from his generation to emigrate to Europe. Embraced by France, he was elected to the prestigious Academie des Beaux Arts society in 2002 and received the Legion of Honor in 2006 from then-president Jacques Chirac.

For Zao and his contemporaries, Paris represented the source of modern art. Living there meant direct access to the paintings that he had until then only encountered as black-and-white reproductions in art magazines. An oil painter by vocation, he immersed himself in the riches that surrounded him -- heading directly to the Louvre on the very day he arrived in the city.

Meanwhile, with the assistance of his friend and mentor, noted poet and painter Henri Michaux, and blessed with the warm charm and wit that would impress me decades later, Zao cultivated an extensive circle of fellow artists and cultural figures. In just a few years, he established himself as an integral member of the postwar French art world.

3.      If Syria Is Using Sarin, Obama Must Act

The Bloomberg   2013.04.25

Well, Bashar, now you’ve done it. We’ve seen that killing tens of thousands of your fellow Syrians with conventional weapons is more or less acceptable to the civilized world, as evidenced by the fact that the civilized world hasn’t stopped you from killing tens of thousands of your fellow Syrians with conventional weapons.

But now, if U.S. Secretary of Defense Chuck Hagel is to be believed -- and Hagel isn’t a man looking for excuses to get entangled in theMiddle East -- you have apparently used chemical weapons (the nerve agent sarin, to be specific) on civilians.

If you recall, President Barack Obama drew a “red line” for you: no use of chemical weapons in your brutal attempt to put down the uprising against your regime. Any use of such weapons (even any “moving around” of such weapons) would “change my calculus,” Obama said, “change my equation.” In other words, welcome to the day in which the calculus might just be changing.

Hagel, speaking to reporters in Abu Dhabi, said that U.S. intelligence has come to believe -- like the Israelis, the French and the Britishbefore them -- that President Bashar al- Assad’s regime seems to have used sarin “on a small scale.”

I spoke with Representative Mike Rogers, the Republican chairman of the House Intelligence Committee, who said that he thinks the Obama administration is hesitant to face the truth that the Assad regime has already used these sorts of weapons. “Clearly the administration doesn’t want to see this,” he said. “We have lost the confidence of the Arab League and the Syrian opposition because of our inaction.” Rogers said he was convinced at least a month ago that Syria had used a small quantity of chemical weapons against civilians.

Before we get to the meaning and potential consequences of this horrifying news, a brief primer on sarin, which was invented in Nazi-eraGermany for use as a pesticide, and which was most famously used in the Tokyo subway attack by the Aum Shinrikyo cult in 1995 and against Kurdish Iraqis during Saddam Hussein’s genocide campaign.

Convulsions, Death

Exposure to sarin gas, even in small doses, will cause victims to experience vomiting, diarrhea, an increased heart rate, eye pain and drooling. In larger amounts, the exposure can cause convulsions, paralysis, breathing difficulty and, within a short time, death. Sarin stops the body from controlling muscle and gland functions, according to the Centers for Disease Control and Prevention, and this causes muscles to twitch and breathing to become faster and irregular. Eventually, the body is overwhelmed, and breathing stops. On a single day in 1988, in a single town, Saddam’s forces killed some 5,000 Iraqi Kurds using a combination of mustard gas, sarin, VX and tabun.

Assad has committed many terrible crimes against his people, but if these latest reports are confirmed, he will have entered into the pantheon of the modern era’s worst war criminals, just as Saddam did in 1988. Back then, Saddam was considered an ally by the U.S. (he was in the midst of a war with Iran). So, to the everlasting shame of President Ronald Reagan, the U.S. did nothing to stop his genocide.

4.      The Beauty Market Resists Recession

The New York Times    2013.04.26

LONDON — If you’re of a sensitive disposition, turn away now. Today we’re looking at the phenomenon of fish pedicures.

For the benefit of the uninitiated, these are treatments increasingly available at beauty salons in which clients voluntarily plunge their feet into tanks of tiny fish to have them nibble off the dead skin.

The procedure may be at the yucky end of the eternal quest for youth and beauty, but it has caught on in Europe in recent years, thanks to celebrity endorsements and media coverage.

Now, France’s environmental safety agency, Anses, has issued a warning that, while being chewed by fish might be good for your feet, it could also be bad for your health.

There was a potential risk of contamination from the transmission of human or fish pathogens, according to a report this week, although the agency acknowledged it had no documented cases of infection.

Noting that the treatment, banned in a number of U.S. states but offered by several hundred spas in France, was largely unregulated, it called for more studies to determine the health risks.

The French report focused on the toothless garra rufa, the fish of choice in a procedure imported from Asia. The use of other toothed varieties potentially posed an even greater threat, the agency warned.

The boom in the fishy foot fad appears to provide further evidence that, in a period of much-publicized belt-tightening, European consumers are not prepared to scrimp on their beauty treatments.

In an article this week on the growing popularity of Botox and dermal filler treatments, Fergus Walsh, the BBC’s medical correspondent, said, “The cosmetic procedures industry is booming,”
which, he continued, “in the teeth of a recession it is all the more astonishing.”