Linux Virtual Private Network (VPN) 架構課程
課程簡稱：Linux VPN Training Course

以往虛擬私人網絡 (Virtual Private Network 或縮寫 VPN) 是主要用於連接中、大型企業或團體與團體間的私人網絡的通訊方法。VPN 的訊息透過公用的網絡架構來傳送內聯網的網絡訊息。它利用已加密的通道協議來達到保密、傳送端認證、訊息準確性等私人訊息安全效果。這種技術可以用不安全的網路如互聯網來傳送可靠、安全的訊息。

隨著使用個人裝置 (如手提電腦、電話) 上網的方便，加上不同公共地方、商店均提供免費無線 WIFI 接駁，使用他們提供的無線 WIFI 時而帶來的網絡通訊安全問題也越來越受關注。VPN 可把途經公共地方、商店網絡器材的通訊資料加密，避免資料因那些網絡器材上的保安不足而導致不同形式的資料洩漏。

本課程除會包括在企業或團體間架設 site-to-site VPN 外，也會包括架設 remote access VPN 給個人裝置使用。

課程中主要會用 Linux 上比較流行的 OpenVPN 來架設 VPN Server。OpenVPN 是使用 SSL/TSL 協定去建立 VPN 的開源軟件。

OpenVPN 除了在 Linux 應用外，它也提供不同作業系統的客戶端軟件，因此不同個人裝置也可接駁在 Linux 上架設了的 VPN Server。

基於不同網絡環境 (如流量、VPN Server 及 Internet router 是否同一器材等等)，架設 OpenVPN Server 時也會因此有不同的設定去配合。本課程會包括以其中比較常見的網絡環境去教授不同架設設定及其中的分別。

課程提供多個附有詳細設定步驟的實習。所用軟件均為免費，另外實習會利用免費的 VMWare Player 軟件去模擬多部虛擬電腦及其網絡上的連接，因此學員可在家中的電腦上去進行不同網絡環境的實習。

IPSec VPN 是另一種 VPN 的協定，而且因它是網絡上沿用以久的標準協定，很多網絡器材也支援建立 IPSec VPN。另外一些公司可能因政策上的限制而規定 VPN 需要使用 IPsec。本課程也會教授 Linux 架設 IPSec VPN 的方法。

1. VPN Backgound and Linux Overview

1.1 About VPN
1.2 About Hypervisor - VMware
1.2.1 VMware Overview
1.2.2 VMware Workstation Player Installation
1.3 About Linux
1.3.1 Linux OS Overview
1.3.2 CentOS Installation
1.3.3 Ubuntu Installation
1.3.4 Linux Init system
1.3.5 Linux Routing
1.3.6 Linux Firewall
1.3.7 Linux NAT
1.3.8 Linux Access Control (File Permission and SELinux)

2. Network Setup for VPN Exercises

2.1 Setup Overview
2.2 Servers (CentOS and Ubuntu) Networking Setup
2.3 Hosts (ttylinux) Networking Setup

3. OpenVPN

3.1 OpenVPN Overiew
3.2 Site-to-Site (One to One) VPN
3.3 Managing OpenVPN Connection
3.3.1 Checking Port Numbers that can be used by OpenVPN in SELinux:
3.3.2 Configure Status File and Management Feature
3.3.3 About MTU and MSS Settings
3.4 Internet Access with Dynamic IP
3.4.1 Branch / Home VPN Server with Dynamic IP address.
3.4.2 Office VPN Server with Dynamic IP address.
3.5 Custom Firewall Setup for Forwarding VPN Traffic
3.5.1 Allow All Forwarding Traffic
3.5.2 Use Specific Tunnel Interface assigned to FirewallD’s Trusted zone
3.5.3 Use Specific Tunnel Interface and Direct Rules
3.5.4 Overview about Adding Firewall Rules Dynamically
3.6 OpenVPN Server behind Firewall and NAT
3.6.1 Home site OpenVPN Server behind Firewall / NAT device
3.6.2 Office site OpenVPN Server behind Firewall / NAT
3.7 OpenVPN not being Default Gateway for Internal Hosts
3.7.1 Basic Setup through Static Route
3.7.2 About ICMP Redirect
3.8 OpenVPN Server as Default Gateway with NAT Feature
3.8.1 Enabling of NAT
3.8.2 Configuration needed after Changing FirewallD Zone.
3.9 Site-to-Site (One to Many) VPN
3.9.1 Basic Server/Client Setup
3.9.2 Allowing Client-to-Client Access
3.9.3 Preventing VPN Connection using a Specific Certficate
3.9.4 About Topology Subnet
3.9.5 About Using “learn-address” for Dynamic Firewall Rules
3.10 Remote Acess VPN - Using Tunnel interface and Certificate
3.10.1 Preparing ovpn file for Windows or Mobile Devices
3.10.2 Installing and Setup OpenVPN in Windows
3.10.3 Installing and Setup OpenVPN in Mobile Device
3.10.4 Accessing Internet through OpenVPN Server
3.11 Remote Acess VPN - Using Tunnel interface and Password
3.12 Remote Acess VPN - Using Bridge interface
3.12.1 Basic Setup (OpenVPN Server as Internal Network Gateway and Assign IP to Client)
3.12.2 OpenVPN Server is not Internal Network Gateway
3.12.3 Use External DHCP server to assign IP address to Clients
3.13 Some Notes About Remote Access

4. IPsec VPN

4.1 Brief Overview
4.2 Linux IPSec Software Overview
4.2.1 Installing Libreswan
4.2.2 Installing StrongSwan
4.3 Setting Up Site-to-Site IPsec VPN tunnels (Using PSK)
4.3.1 Setting up Libreswan
4.3.2 Setting up StrongSwan
4.3.3 Modification for IPsec Tunnel between Libreswan and StrongSwan
4.3.4 Checking the IPsec Tunnel Created
4.3.5 About Firewall Rules
4.3.6 Using DNS hostname and ID
4.4 Site-to-Site IPsec VPN tunnels Between Libreswan Using RSA Key
4.5 Setup IPsec Tunnel with Hardware Router (using Cisco as example)
4.5.1 Sample Libreswan and Cisco configuration.
4.5.2 Sample StrongSwan and Cisco configuration.
4.6 Server/Client Setup
4.6.1 Configuring IPsec Server using Libreswan
4.6.2 About StrongSwan “charon” daemon and IKEv2
4.6.3 Sample Configuration for Connecting StrongSwan from Windows and Android with IKEv2