Yaz\u0131l\u0131m konusunda kendime a\u00e7\u0131k\u00e7as\u0131 g\u00fcveniyorum. Bir dili k\u0131sa s\u00fcrede kavrayabilirim ve projeler yazabilirim ancak network i\u00e7in ayn\u0131 g\u00fcvene sahip ne yaz\u0131kki de\u011filim. OSCP s\u0131nav\u0131na haz\u0131rland\u0131\u011f\u0131m bu s\u00fcre\u00e7 i\u00e7erisinde bir yanda da Network konusuna e\u011filim g\u00f6steriyorum ve kendimi geli\u015ftiriyorum. Uzaktan \u00e7al\u0131\u015fman\u0131n yayg\u0131nla\u015ft\u0131\u011f\u0131 bu g\u00fcnlerde VPN \u00e7ok \u00f6ne kazand\u0131 ve bende kendime bir VPN server kurayim dedim. Daha \u00f6ncesinde Linux \u00fczerinde OpenVPN ara\u0131l\u0131\u011f\u0131 ile kurulumlar yapm\u0131\u015ftm. Ancak kamunun windows \u0131srar\u0131 ve bu konudaki bilgi azl\u0131\u011f\u0131n\u0131 g\u00f6rd\u00fcm. Bunun \u00fczerine lamer seviyesinde nas\u0131l bir VPN server kurabiliriz anlatmaya karar verdim. Bu makaleyi bilgilerim tazelendik\u00e7e g\u00fcncelleyece\u011fim \u00e7\u00fcnk\u00fc dedi\u011fim gibi network konusunda yaz\u0131l\u0131mda oldu\u011fu gibi kendime g\u00fcvenmiyorum. \u00c7ok az say\u0131da network cihaz\u0131 kurulumu ger\u00e7ekle\u015ftirdim ve bunlar genelde bir tutorial'a bak\u0131p copy-paste \u015feklinde oldu. \u0130\u015fim daha \u00e7ok web ve mobil g\u00fcvenli\u011fi oldu\u011fundan dolay\u0131 bakmad\u0131\u011f\u0131n\u0131z s\u00fcre boyunca da ne yaz\u0131kki network bilgilerinizi kaybediyorsunuz. Neyse kendimi iyice yerdi\u011fime g\u00f6re art\u0131k windows server \u00fczerinde openvpn kurmayla ilgili bi kopya ka\u011f\u0131dana ba\u015flayabiliriz.<\/p>\n
PS C:\\> cd "C:\\Program Files\\OpenVPN\\easy-rsa"\nPS C:\\Program Files\\OpenVPN\\easy-rsa><\/code><\/pre>\n<\/li>\n- Daha sonras\u0131nda bir edit\u00f6r arac\u0131l\u0131\u011f\u0131 ile
vars.bat<\/code> dosyas\u0131n\u0131 a\u00e7\u0131n. Burada baz\u0131 d\u00fczenlemeler yapmak isteyebilirsiniz. Burada yapaca\u011f\u0131m\u0131z d\u00fczenlemelerin asl\u0131nda kuruluma bir etkisi olmayacakt\u0131r. Bunlar sadece bilgilendirme i\u00e7indir. De\u011fi\u015filik yapaca\u011f\u0131m\u0131z alan a\u015fa\u011f\u0131da belirtilmi\u015ftir.\nset KEY_COUNTRY=TR\nset KEY_PROVINCE=SIZEKALMIS\nset KEY_CITY=SIZEKALMIS\nset KEY_ORG=SIZEKALMIS\nset KEY_EMAIL=SIZEKALMIS@SIZEKALMIS\nset KEY_CN=SIZEKALMIS\nset KEY_NAME=SIZEKALMIS\nset KEY_OU=SIZEKALMIS\nset PKCS11_MODULE_PATH=SIZEKALMIS\nset PKCS11_PIN=1234<\/code><\/pre>\n<\/li>\n- Art\u0131k kurulama ba\u015flayabiliriz. A\u015fa\u011f\u0131daki ad\u0131mlar\u0131 uygulayal\u0131m.\n
\nPS C:\\Program Files\\OpenVPN\\easy-rsa> .\\init-config.bat<\/code><\/pre>\n<\/li>\n<\/ul>\nC:\\Program Files\\OpenVPN\\easy-rsa>copy vars.bat.sample vars.bat
\n1 file(s) copied.
\nPS C:\\Program Files\\OpenVPN\\easy-rsa> .\\vars.bat
\nPS C:\\Program Files\\OpenVPN\\easy-rsa> .\\clean-all.bat
\nC:\\Program Files\\OpenVPN\\easy-rsa
\nThe syntax of the command is incorrect.
\nThe syntax of the command is incorrect.
\n1 file(s) copied.
\n1 file(s) copied.
\nPS C:\\Program Files\\OpenVPN\\easy-rsa> .\\build-dh.bat
\nC:\\Program Files\\OpenVPN\\easy-rsa
\n'openssl' is not recognized as an internal or external command,
\noperable program or batch file.<\/p>\n
E\u011fer benim gibi bir hata ald\u0131ysan\u0131z **C:\\Program Files\\OpenVPN\\bin** yolunu \u00e7evresel de\u011fi\u015fkenlere eklemeniz gerekecektir. Basit bir konu oldu\u011fu i\u00e7in atl\u0131yorum. Bu i\u015flemi yapt\u0131n\u0131z ancak hala hata almaya devam ediyorsan\u0131z. Powershell kulland\u0131\u011f\u0131n\u0131zdan dolay\u0131 olabilir. L\u00fctfen CMD \u00fczerinden devam ediniz.\n```batch\nPS C:\\Program Files\\OpenVPN\\easy-rsa> cmd\nMicrosoft Windows [Version 10.0.17763.1911]\n(c) 2018 Microsoft Corporation. All rights reserved.\n\nC:\\Program Files\\OpenVPN\\easy-rsa>init-config.bat\n\nC:\\Program Files\\OpenVPN\\easy-rsa>copy vars.bat.sample vars.bat\n 1 file(s) copied.\n\nC:\\Program Files\\OpenVPN\\easy-rsa>.\\vars.bat\n\nC:\\Program Files\\OpenVPN\\easy-rsa>.\\clean-all.bat\n 1 file(s) copied.\n 1 file(s) copied.\n\nC:\\Program Files\\OpenVPN\\easy-rsa>.\\build-dh.bat\nGenerating DH parameters, 2048 bit long safe prime, generator 2\nThis is going to take a long time\n...........................................................................................................................................................................................................+...............................................+.....................................................................................................................................................................................................................................................................................................................+................................................................................................+.......+.................................................................................................................................................................................................................................................................................................................................................+.......................+.................................+....................................+.................+...............................................................................................+............+....................................................................................................+............+.......++*++*++*++*\n\nC:\\Program Files\\OpenVPN\\easy-rsa>\nC:\\Program Files\\OpenVPN\\easy-rsa>build-ca.bat\nGenerating a RSA private key\n..........++++\n................................................++++\nwriting new private key to 'keys\\ca.key'\n-----\nYou are about to be asked to enter information that will be incorporated\ninto your certificate request.\nWhat you are about to enter is what is called a Distinguished Name or a DN.\nThere are quite a few fields but you can leave some blank\nFor some fields there will be a default value,\nIf you enter '.', the field will be left blank.\n-----\nCountry Name (2 letter code) [US]:TR\nState or Province Name (full name) [CA]:SIZEKALMIS\nLocality Name (eg, city) [SanFrancisco]:SIZEKALMIS\nOrganization Name (eg, company) [OpenVPN]:SIZEKALMIS\nOrganizational Unit Name (eg, section) [changeme]:SIZEKALMIS\nCommon Name (eg, your name or your server's hostname) [changeme]:SIZEKALMIS\nName [changeme]:SIZEKALMIS\nEmail Address [mail@host.domain]:SIZEKALMIS\n\nC:\\Program Files\\OpenVPN\\easy-rsa>\nC:\\Program Files\\OpenVPN\\easy-rsa>\nC:\\Program Files\\OpenVPN\\easy-rsa>build-key-server.bat ServerVPN\nGenerating a RSA private key\n....................++++\n.........................++++\nwriting new private key to 'keys\\ServerVPN.key'\n-----\nYou are about to be asked to enter information that will be incorporated\ninto your certificate request.\nWhat you are about to enter is what is called a Distinguished Name or a DN.\nThere are quite a few fields but you can leave some blank\nFor some fields there will be a default value,\nIf you enter '.', the field will be left blank.\n-----\nCountry Name (2 letter code) [US]:TR\nState or Province Name (full name) [CA]:SIZEKALMIS\nLocality Name (eg, city) [SanFrancisco]:SIZEKALMIS\nOrganization Name (eg, company) [OpenVPN]:SIZEKALMIS\nOrganizational Unit Name (eg, section) [changeme]:SIZEKALMIS\nCommon Name (eg, your name or your server's hostname) [changeme]:SIZEKALMIS\nName [changeme]:SIZEKALMIS\nEmail Address [mail@host.domain]:SIZEKALMIS\n\nPlease enter the following 'extra' attributes\nto be sent with your certificate request\nA challenge password []:\nAn optional company name []:\nUsing configuration from openssl-1.0.0.cnf\nCan't open keys\/index.txt.attr for reading, No such file or directory\n5364:error:02001002:system library:fopen:No such file or directory:crypto\/bio\/bss_file.c:74:fopen('keys\/index.txt.attr','r')\n5364:error:2006D080:BIO routines:BIO_new_file:no such file:crypto\/bio\/bss_file.c:81:\nCheck that the request matches the signature\nSignature ok\nThe Subject's Distinguished Name is as follows\ncountryName :PRINTABLE:'TR'\nstateOrProvinceName :PRINTABLE:'SIZEKALMIS'\nlocalityName :PRINTABLE:'SIZEKALMIS'\norganizationName :PRINTABLE:'SIZEKALMIS'\norganizationalUnitName:PRINTABLE:'SIZEKALMIS'\ncommonName :PRINTABLE:'SIZEKALMIS'\nname :PRINTABLE:'SIZEKALMIS'\nemailAddress :IA5STRING:'SIZEKALMIS'\nCertificate is to be certified until Jun 11 02:28:43 2031 GMT (3650 days)\nSign the certificate? [y\/n]:Y\n\n1 out of 1 certificate requests certified, commit? [y\/n]Y\nWrite out database with 1 new entries\nData Base Updated<\/code><\/pre>\n\n- Bu esnada C:\\Program Files\\OpenVPN\\easy-rsa\\keys<\/strong> klas\u00f6r\u00fc alt\u0131nda dosyalar\u0131m\u0131z\u0131n olu\u015ftu\u011funu g\u00f6rebilirsiniz. Devam edelim. \u015eimdi Client i\u00e7in crt ve key'imizi olu\u015ftural\u0131m. Yukar\u0131da yapt\u0131\u011f\u0131m\u0131z ayn\u0131 i\u015flemleri ger\u00e7ekle\u015ftiriyoruz.<\/li>\n<\/ul>\n
C:\\Program Files\\OpenVPN\\easy-rsa>build-key.bat ClientVPN\nGenerating a RSA private key\n.......................................................................................................................................++++\n..........................................................++++\nwriting new private key to 'keys\\ClientVPN.key'\n-----\nYou are about to be asked to enter information that will be incorporated\ninto your certificate request.\nWhat you are about to enter is what is called a Distinguished Name or a DN.\nThere are quite a few fields but you can leave some blank\nFor some fields there will be a default value,\nIf you enter '.', the field will be left blank.\n-----\nCountry Name (2 letter code) [US]:TR\nState or Province Name (full name) [CA]:SIZEKALMIS\nLocality Name (eg, city) [SanFrancisco]:SIZEKALMIS\nOrganization Name (eg, company) [OpenVPN]:SIZEKALMIS\nOrganizational Unit Name (eg, section) [changeme]:SIZEKALMIS\nCommon Name (eg, your name or your server's hostname) [changeme]:ClientVPN\nName [changeme]:SIZEKALMIS\nEmail Address [mail@host.domain]:SIZEKALMIS\n\nPlease enter the following 'extra' attributes\nto be sent with your certificate request\nA challenge password []:\nAn optional company name []:\nUsing configuration from openssl-1.0.0.cnf\nCheck that the request matches the signature\nSignature ok\nThe Subject's Distinguished Name is as follows\ncountryName :PRINTABLE:'TR'\nstateOrProvinceName :PRINTABLE:'SIZEKALMIS'\nlocalityName :PRINTABLE:'SIZEKALMIS'\norganizationName :PRINTABLE:'SIZEKALMIS'\norganizationalUnitName:PRINTABLE:'SIZEKALMIS'\ncommonName :PRINTABLE:'ClientVPN'\nname :PRINTABLE:'SIZEKALMIS'\nemailAddress :IA5STRING:'SIZEKALMIS'\nCertificate is to be certified until Jun 11 03:12:28 2031 GMT (3650 days)\nSign the certificate? [y\/n]:Y\n\n1 out of 1 certificate requests certified, commit? [y\/n]Y\nWrite out database with 1 new entries\nData Base Updated\n<\/code><\/pre>\n\n- \u015eimdi authentication i\u00e7in ta.key dosyam\u0131z\u0131 olu\u015ftural\u0131m.<\/li>\n<\/ul>\n
C:\\Program Files\\OpenVPN\\easy-rsa>openvpn --genkey --secret keys\/ta.key<\/code><\/pre>\n\n- \u015eimdi Server i\u00e7in config dosyam\u0131z\u0131 olu\u015fturmam\u0131z gerekmektedir. Bu dosyam\u0131z\u0131 C:\\Program Files\\OpenVPN\\config<\/strong> alt\u0131nda olu\u015fturaca\u011f\u0131z. A\u015fa\u011f\u0131da \u00f6rnek bir config dosyas\u0131 bulunmaktad\u0131r.<\/li>\n<\/ul>\n
dev-node "ServerVPN" #Network adapter ismimiz\nmode server #Modumuz\nport 12345 #Port numaran\u0131z\u0131 isterseniz de\u011fi\u015ftirebilirsiniz.\nproto tcp4-server #tcp\ndev tun #tunnel mode\n\ntls-server #\u015eifreleme protokol\u00fcm\u00fcz\ntls-auth "C:\\\\Program Files\\\\OpenVPN\\\\easy-rsa\\\\keys\\\\ta.key" 0 #authentication i\u00e7in dosyam\u0131z ve 0 de\u011feri. 0 de\u011feri sunucu, 1 de\u011feri client i\u00e7in ge\u00e7erlidir.\n\n#Paket boyutlar\u0131 ile ilgili configler\ntun-mtu 1500 \ntun-mtu-extra 32\nmssfix 1450\n\n#Kurulum a\u015famas\u0131nda olu\u015fturdu\u011fumuz dosyalar. E\u011fer bunlar\u0131 path arac\u0131l\u0131\u011f\u0131 ile \u00e7a\u011f\u0131rmak istemezseniz tagler aracl\u0131\u011f\u0131 ile \u00e7a\u011f\u0131rabilirsiniz. \u00d6rne\u011fin\n#<ca>asdkljasdkjasjdas<\/ca> gibi\nca "C:\\\\Program Files\\\\OpenVPN\\\\easy-rsa\\\\keys\\\\ca.crt"\ncert "C:\\\\Program Files\\\\OpenVPN\\\\easy-rsa\\\\keys\\\\ServerVPN.crt"\nkey "C:\\\\Program Files\\\\OpenVPN\\\\easy-rsa\\\\keys\\\\ServerVPN.key"\ndh "C:\\\\Program Files\\\\OpenVPN\\\\easy-rsa\\\\keys\\\\dh2048.pem"\n\nserver 18.22.1.0 255.255.255.0 #Clientlerin alaca\u011f\u0131 ipler ve aral\u0131\u011f\u0131\n\nclient-to-client\nkeepalive 10 120 #oturumun kal\u0131c\u0131l\u0131\u011f\u0131 ile ilgili\ncipher AES-128-CBC #\u015eifreleme\ncomp-lzo #t\u00fcnelde veri s\u0131k\u0131\u015ft\u0131rma ayar\u0131n\u0131 yap\n\n#Ba\u011flant\u0131da sorun varsa herhangibi bir veri okumas\u0131 tekrarlanmaycak\npersist-key\npersist-tun\n\nclient-config-dir "C:\\\\Program Files\\\\OpenVPN\\\\config"\n\nverb 3 #debug level\n\n#Route ayarlamalar\u0131\nroute-delay 5\nroute-method exe\npush "redirect-gateway def1"\npush "dhcp-option DNS 8.8.8.8"\nkeepalive 10 60<\/code><\/pre>\n\n- Harika! Art\u0131k bu config'lerle VPN'i ba\u015flatabiliriz. E\u011fer bir hata al\u0131rsan\u0131z bunu C:\\Users\\Administrator\\OpenVPN\\log<\/strong> path'inden kontrol edebilirsiniz.<\/li>\n
- Sunucu taraf\u0131nda i\u015flerimiz neredeyse bitti. \u015eimdi NAT'lama i\u015flemimizi yapmam\u0131z gereiyor. Bu haliyle b\u0131rak\u0131rsa bir VPN ba\u011flant\u0131s\u0131 ede edebiliriz ancak 18.22.1.0 a\u011f\u0131ndaki client'ler internete \u00e7\u0131kamazlar. Bunun i\u00e7in Remote Access<\/strong> rol\u00fcn\u00fc sunucumuza kurmam\u0131z gerekecektir. Kurulum a\u015famas\u0131nda Role Services alan\u0131nda Routing<\/strong> k\u0131sm\u0131n\u0131n se\u00e7ili oldu\u011fundan emin olun. Daha sonras\u0131nda Server Manager<\/strong> alan\u0131ndan Routing and Remote Access<\/strong> alan\u0131na gelin. Routing and Remote Access Server Setup Wizard<\/strong> k\u0131sm\u0131ndan NAT<\/strong> se\u00e7ene\u011fi ile devam edin ve internete \u00e7\u0131kan aray\u00fcz\u00fcn\u00fcz\u00fc natlay\u0131n. Bununla ilgili bir video \u00f6rne\u011fini kaynaklar k\u0131sm\u0131nda payla\u015f\u0131yor olaca\u011f\u0131m.<\/li>\n
- Windows Defender Firewall'dan ilgli porta gerekli ayarlamalar\u0131 yap\u0131n.<\/li>\n
- Son olarak kay\u0131t defterinden Computer\\HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters<\/strong> k\u0131sm\u0131ndaki IPEnableRouter<\/strong> alan\u0131n\u0131 1<\/strong> yap\u0131n. <\/li>\n<\/ul>\n
Client Taraf\u0131<\/h2>\n\n- A\u015f\u011fa\u0131da \u00f6rne\u011fi verilen config dosyas\u0131n\u0131 olu\u015fturun. A\u015fa\u011f\u0131da
<\/ca> gibi tagler aras\u0131na ise sunucu taraf\u0131nda olu\u015ftudu\u011fumuz dosyalar\u0131n i\u00e7eri\u011fini direkt olarak kopyalay\u0131n.<\/li>\n<\/ul>\nremote <SUNUCUNUZUN IP ADRES\u0130>\nclient\nport 12345\nresolv-retry infinite\nproto tcp4-client\ndev tun\ntls-client\nremote-cert-tls server\ntun-mtu 1500\ntun-mtu-extra 32\nmssfix 1450\ncipher AES-128-CBC\ncomp-lzo\npersist-key\npersist-tun\nverb 3\nmute 20\nredirect-gateway def1\n<ca>\n<\/ca>\n\n<cert>\n<\/cert>\n\n<key>\n<\/key>\n\nkey-direction 1\n\n<tls-auth>\n<\/tls-auth><\/code><\/pre>\nBu i\u015flem sonucunda olu\u015fturdu\u011funuz config dosyas\u0131n\u0131 android, windows, ios farketmez herhangi bir client \u00fczerinde \u00e7al\u0131\u015ft\u0131rabilirsiniz.<\/p>\n
Kaynaklar<\/h2>\n
https:\/\/www.youtube.com\/watch?v=hKfHwQgAsUo&list=PLQOfaLjbioaMVTIwU53OFggMc1uz6g-DG&index=5<\/a>
\nhttps:\/\/www.youtube.com\/watch?v=bgpEOc6WHFo<\/a>
\nhttps:\/\/ulakbim.tubitak.gov.tr\/sites\/images\/Ulakbim\/openvpn-sunum.pdf<\/a>
\nhttps:\/\/www.youtube.com\/watch?v=C2MI_3yOF30&list=PLQOfaLjbioaMVTIwU53OFggMc1uz6g-DG&index=6<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"Yaz\u0131l\u0131m konusunda kendime a\u00e7\u0131k\u00e7as\u0131 g\u00fcveniyorum. Bir dili k\u0131sa s\u00fcrede kavrayabilirim ve projeler yazabilirim ancak network i\u00e7in ayn\u0131 g\u00fcvene sahip ne yaz\u0131kki de\u011filim. OSCP s\u0131nav\u0131na haz\u0131rland\u0131\u011f\u0131m…<\/p>\n