Ч. 1 — Дальнобойный Wi-Fi. Выбор аппаратного обеспечения.
Статья ещё не дописана!!!
В моём сценарии WPA2 отключен, для ��утентификации пользователей и выдачи доступа к интернету используется openvpn, но при этом пользователи имеют доступ к локальным ресурсам и могут взаимодействовать внутри локальной сети.
На точке необходимо отключить встроенные функции dhcp и dns.
Настройка сетевых интерфейсов
При нескольких сетевых картах возникает ситуация когда система не понимает к какому интерфейсу обращаться за интернетом. Для того что бы исправить это нам надо указать маршрут и метрику. Чем больше число метрики, тем меньше приоритет интерфейса. В данном случае для WAN он 10, а для LAN 5000.
Узнаём имена интерфейсов с помощью команды
ip a
Команда post-up выполняет действие после подключения интерфейса.
## /etc/network/interfaces source /etc/network/interfaces.d/* auto lo iface lo inet loopback # WAN allow-hotplug enp1s0 iface enp1s0 inet dhcp post-up sh -c 'ip route del default || true; ip route add default via 192.168.1.1 dev enp1s0 metric 10' post-up sh -c 'echo "nameserver 9.9.9.9" > /etc/resolv.conf' # Фикс перезаписи resolv долбанным systemd-resolved # LAN auto enp3s0 iface enp3s0 inet static address 192.168.2.1 netmask 255.255.255.0 dns-nameservers 192.168.2.1 metric 5000
Настройка SSH
Генерация ключей ssh
sudo ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ''
sudo ssh-keygen -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -N ''
sudo ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ''
## /etc/ssh/sshd_config Port 2222 ListenAddress 0.0.0.0 # Ключи хоста (серверные) HostKey /etc/ssh/ssh_host_ed25519_key HostKey /etc/ssh/ssh_host_ecdsa_key HostKey /etc/ssh/ssh_host_rsa_key # RSA 4096 # Аутентификация #PubkeyAuthentication yes PubkeyAuthentication no # Явное отключение аутентификации по ключам PasswordAuthentication yes # Разрешаем только парольную аутентификацию #ChallengeResponseAuthentication yes ChallengeResponseAuthentication no # Отключаем интерактивные вызовы #KbdInteractiveAuthentication yes KbdInteractiveAuthentication no # Отключаем интерактивную аутентификацию (kbd-interactive) PermitRootLogin no # Запрет входа под root по SSH # Шифры (ciphers) — баланс безопасности и совместимости Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr # MAC алгоритмы MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com # Алгоритмы обмена ключами (Kex) KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1 # Ограничение по времени и объёму для смены ключа сессии (Forward Secrecy) RekeyLimit 1G 1h # Логирование SyslogFacility AUTH LogLevel VERBOSE # Отключаем DNS-обратные запросы для ускорения и безопасности UseDNS no # Разрешаем форвардинг TCP и порты AllowTcpForwarding yes GatewayPorts yes # Отключаем X11 форвардинг — снижает риск атак X11Forwarding no # Подсистема SFTP отключена #Subsystem sftp /usr/lib/openssh/sftp-server Subsystem sftp /bin/false # Сжатие данных отключено (лучше для безопасности) Compression no # Удержание живого соединения и таймауты TCPKeepAlive yes ClientAliveInterval 300 ClientAliveCountMax 3 # Использовать PAM (при необходимости) UsePAM yes
Настройка параметров ядра
# --- Основное (маршрутизация, NAT) --- net.ipv4.ip_forward = 1 # --- Защита TCP --- net.ipv4.tcp_syncookies = 1 # Защита от SYN flood net.ipv4.tcp_fin_timeout = 10 # Ускоренное закрытие TCP соединений # --- Быстрое открытие TCP-соединений (TFO) --- net.ipv4.tcp_fastopen = 3 # Клиент и сервер # --- Безопасность и фильтрация --- net.ipv4.conf.all.rp_filter = 2 # Усиленный антиспуфинг (strict mode) net.ipv4.conf.default.rp_filter = 2 net.ipv4.conf.all.accept_redirects = 0 # Отключаем ICMP redirect net.ipv4.conf.default.accept_redirects = 0 net.ipv4.conf.all.send_redirects = 0 # Не отправлять ICMP redirect net.ipv4.conf.default.send_redirects = 0 net.ipv4.conf.all.accept_source_route = 0 # Отключаем source routing net.ipv4.conf.default.accept_source_route = 0 # --- Ограничение ICMP (защита от DoS) --- net.ipv4.icmp_echo_ignore_broadcasts = 1 # Игнорирование broadcast ping # --- Оптимизация TCP --- net.ipv4.tcp_abort_on_overflow = 1 # Быстро сбрасывать соединения при переполнении очереди net.ipv4.tcp_mtu_probing = 1 # Автоматическое определение MTU net.ipv4.tcp_timestamps = 1 # Включить TCP timestamps # --- Современный congestion control --- net.core.default_qdisc = fq net.ipv4.tcp_congestion_control = bbr # --- Защита памяти --- kernel.dmesg_restrict = 1 kernel.kptr_restrict = 2 kernel.yama.ptrace_scope = 2
Настройка DHCP (выдача ip-адресов)
Установка
apt install isc-dhcp-server
Конфигурация
## /etc/dhcp/dhcpd.conf option captive-portal code 160 = text; option captive-portal "http://freedom.local"; default-lease-time 600; max-lease-time 7200; ddns-update-style none; authoritative; subnet 192.168.2.0 netmask 255.255.255.0 { range 192.168.2.1 192.168.2.254; option domain-name-servers 192.168.2.1; option domain-name "freedom.local"; option routers 192.168.2.1; option broadcast-address 192.168.2.255; default-lease-time 600; max-lease-time 7200; }
Выбор интерфейса раздачи адресов
## /etc/default/isc-dhcp-server INTERFACESv4="enp3s0" INTERFACESv6=""
Настройка простого DNS сервера с апстримом dnscrypt (DoH)
Установка
apt install dnsmasq
Актуальный билд dnscrypt можно взять тут
Возьмите за привычку пользовательские программы которые были установлены вручную размещать либо в /usr/local, либо в /opt
Конфигурация dnsmasq
## /etc/dnsmasq.conf port=53 # Не пересылать запросы без доменного имени (например, просто "localhost") domain-needed # Привязывать dnsmasq только к указанным интерфейсам, чтобы не слушать на всех bind-interfaces # Не использовать системный файл /etc/resolv.conf для поиска upstream DNS-серверов no-resolv # Защита от DNS rebind-атак — блокирует ответы с подозрительными IP-адресами stop-dns-rebind # Жёстко назначить домен freedom.net на IP-адрес 192.168.2.1 address=/freedom.net/192.168.2.1 # Жёстко назначить домен freedom.local на IP-адрес 192.168.2.1 address=/freedom.local/192.168.2.1 # Заменяем yandex на duckduckgo. Что бы узнать адреса используйте dig +short +nodnssec duckduckgo.com # Для моего региона это: address=/yandex.ru/20.204.244.192 address=/ya.ru/20.204.244.192 # ---- address=/yandex.ru/40.114.177.156 address=/ya.ru/40.114.177.156 # Использовать локальный DNSCrypt сервер на 127.0.0.1:5353 как upstream DNS server=127.0.0.1#5353 # Вариант: использовать публичный DNS-сервер Quad9 # server=9.9.9.9 # Слушать DNS-запросы на сетевом интерфейсе enp3s0 interface=enp3s0 # dnsmasq работает только как DNS no-dhcp-interface=*
Конфигурация DNSCrypt
## dnscrypt-proxy.toml ############################################################################### # Global settings # ############################################################################### ## List of servers to use ## ## Servers from the "public-resolvers" source (see down below) can ## be viewed here: https://dnscrypt.info/public-servers ## ## The proxy will automatically pick working servers from this list. ## Note that the require_* filters do NOT apply when using this setting. ## ## By default, this list is empty and all registered servers matching the ## require_* filters will be used instead. ## ## Remove the leading # first to enable this; lines starting with # are ignored. # server_names = ['scaleway-fr', 'google', 'yandex', 'cloudflare'] ## List of local addresses and ports to listen to. Can be IPv4 and/or IPv6. ## Example with both IPv4 and IPv6: ## listen_addresses = ['127.0.0.1:53', '[::1]:53'] ## ## To listen to all IPv4 addresses, use `listen_addresses = ['0.0.0.0:53']` ## To listen to all IPv4+IPv6 addresses, use `listen_addresses = ['[::]:53']` listen_addresses = ['127.0.0.1:5353'] ## Maximum number of simultaneous client connections to accept max_clients = 250 ## Switch to a different system user after listening sockets have been created. ## Note (1): this feature is currently unsupported on Windows. ## Note (2): this feature is not compatible with systemd socket activation. ## Note (3): when using -pidfile, the PID file directory must be writable by the new user # user_name = 'nobody' ############################################################################### # Server Selection # ############################################################################### ## Require servers (from remote sources) to satisfy specific properties # Use servers reachable over IPv4 ipv4_servers = true # Use servers reachable over IPv6 -- Do not enable if you don't have IPv6 connectivity ipv6_servers = false # Use servers implementing the DNSCrypt protocol dnscrypt_servers = true # Use servers implementing the DNS-over-HTTPS protocol doh_servers = false # Use servers implementing the Oblivious DoH protocol odoh_servers = true ## Require servers defined by remote sources to satisfy specific properties # Server must support DNS security extensions (DNSSEC) require_dnssec = false # Server must not log user queries (declarative) require_nolog = true # Server must not enforce its own blocklist (for parental control, ads blocking...) require_nofilter = true # Server names to avoid even if they match all criteria disabled_server_names = [] ############################################################################### # Connection Settings # ############################################################################### ## Always use TCP to connect to upstream servers. ## This can be useful if you need to route everything through Tor. ## Otherwise, leave this to `false`, as it doesn't improve security ## (dnscrypt-proxy will always encrypt everything even using UDP), and can ## only increase latency. force_tcp = false ## Enable *experimental* support for HTTP/3 (HTTP over QUIC) ## Note that, like DNSCrypt but unlike other HTTP versions, this uses ## UDP and (usually) port 443 instead of TCP. http3 = false ## When http3 is true, always try HTTP/3 first for DoH servers. ## If the HTTP/3 connection fails, fallback to HTTP/2 and don't try ## HTTP/3 again for that server. By default, HTTP/3 is only used for ## servers that advertise support via the Alt-Svc header. ## ## WARNING: This setting is disabled by default because it will make ## connections significantly slower for servers that don't support HTTP/3. ## This is primarily a workaround for server operators who haven't ## configured their servers to send proper Alt-Svc headers. The better ## solution is to reach out to these operators and encourage them to ## fix their servers to correctly advertise HTTP/3 support. http3_probe = false ## How long a DNS query will wait for a response, in milliseconds. ## If you have a network with *a lot* of latency, you may need to ## increase this. Startup may be slower if you do so. ## Don't increase it too much. 10000 is the highest reasonable value. ## A timeout below 5000 is not recommended. timeout = 5000 ## Keepalive for HTTP (HTTPS, HTTP/2, HTTP/3) queries, in seconds keepalive = 30 ## Use the system logger (syslog on Unix, Event Log on Windows) # use_syslog = true ## Automatic log files rotation # Maximum log files size in MB - Set to 0 for unlimited. log_files_max_size = 10 # How long to keep backup files, in days log_files_max_age = 7 # Maximum log files backups to keep (or 0 to keep all backups) log_files_max_backups = 1 ############################################################################### # Certificate Management # ############################################################################### ## The maximum concurrency to reload certificates from the resolvers. ## Default is 10. # cert_refresh_concurrency = 10 ## Delay, in minutes, after which certificates are reloaded cert_refresh_delay = 240 ## Initially don't check DNSCrypt server certificates for expiration, and ## only start checking them after a first successful connection to a resolver. ## This can be useful on routers with no battery-backed clock. # cert_ignore_timestamp = false ## DNSCrypt: Create a new, unique key for every single DNS query ## This may improve privacy but can also have a significant impact on CPU usage ## Only enable if you don't have a lot of network load # dnscrypt_ephemeral_keys = false ## DoH: Disable TLS session tickets - increases privacy but also latency # tls_disable_session_tickets = false ## DoH: Use TLS 1.2 and specific cipher suite instead of the server preference ## 49199 = TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ## 49195 = TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ## 52392 = TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 ## 52393 = TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 ## ## On non-Intel CPUs such as MIPS routers and ARM systems (Android, Raspberry Pi...), ## uncommenting the following line may improve performance. ## This may also help on Intel CPUs running 32-bit operating systems. ## However, this can cause issues fetching sources or connecting to some HTTP servers, ## and should not be set on regular CPUs. ## ## Keep tls_cipher_suite undefined to let the app automatically choose secure parameters. tls_cipher_suite = [52393, 49199] ## Log TLS key material to a file, for debugging purposes only. ## This file will contain the TLS master key, which can be used to decrypt ## all TLS traffic to/from DoH servers. ## Never ever enable except for debugging purposes with a tool such as mitmproxy. # tls_key_log_file = '/tmp/keylog.txt' ############################################################################### # Startup & Network # ############################################################################### ## Bootstrap resolvers ## ## These are normal, non-encrypted DNS resolvers, that will be only used ## for one-shot queries when retrieving the initial resolvers list and if ## the system DNS configuration doesn't work. ## ## No user queries will ever be leaked through these resolvers, and they will ## not be used after IP addresses of DoH resolvers have been found (if you are ## using DoH). ## ## They will never be used if lists have already been cached, and if the stamps ## of the configured servers already include IP addresses (which is the case for ## most of DoH servers, and for all DNSCrypt servers and relays). ## ## They will not be used if the configured system DNS works, or after the ## proxy already has at least one usable secure resolver. ## ## Resolvers supporting DNSSEC are recommended, and, if you are using ## DoH, bootstrap resolvers should ideally be operated by a different entity ## than the DoH servers you will be using, especially if you have IPv6 enabled. ## ## People in China may want to use 114.114.114.114:53 here. ## Other popular options include 8.8.8.8, 9.9.9.9 and 1.1.1.1. ## ## If more than one resolver is specified, they will be tried in sequence. ## ## TL;DR: put valid standard resolver addresses here. Your actual queries will ## not be sent there. If you're using DNSCrypt or Anonymized DNS and your ## lists are up to date, these resolvers will not even be used. bootstrap_resolvers = ['9.9.9.9:53', '8.8.8.8:53'] ## When internal DNS resolution is required, for example to retrieve ## the resolvers list: ## ## - queries will be sent to dnscrypt-proxy itself, if it is already ## running with active servers (*) ## - or else, queries will be sent to fallback servers ## - finally, if `ignore_system_dns` is `false`, queries will be sent ## to the system DNS ## ## (*) this is incompatible with systemd sockets. ## `listen_addresses` must not be empty. ignore_system_dns = true ## Maximum time (in seconds) to wait for network connectivity before ## initializing the proxy. ## Useful if the proxy is automatically started at boot, and network ## connectivity is not guaranteed to be immediately available. ## Use 0 to not test for connectivity at all (not recommended), ## and -1 to wait as much as possible. netprobe_timeout = 60 ## Address and port to try initializing a connection to, just to check ## if the network is up. It can be any address and any port, even if ## there is nothing answering these on the other side. Just don't use ## a local address, as the goal is to check for Internet connectivity. ## On Windows, a datagram with a single, nul byte will be sent, only ## when the system starts. ## On other operating systems, the connection will be initialized ## but nothing will be sent at all. netprobe_address = '9.9.9.9:53' ## Offline mode - Do not use any remote encrypted servers. ## The proxy will remain fully functional to respond to queries that ## plugins can handle directly (forwarding, cloaking, ...) # offline_mode = false ## Additional data to attach to outgoing queries. ## These strings will be added as TXT records to queries. ## Do not use, except on servers explicitly asking for extra data ## to be present. ## encrypted-dns-server can be configured to use this for access control ## in the [access_control] section # query_meta = ['key1:value1', 'key2:value2', 'token:MySecretToken'] ############################################################################### # Filters # ############################################################################### ## Note: if you are using dnsmasq, disable the `dnssec` option in dnsmasq if you ## configure dnscrypt-proxy to do any kind of filtering (including the filters ## below and blocklists). ## You can still choose resolvers that do DNSSEC validation. ## Immediately respond to IPv6-related queries with an empty response ## This makes things faster when there is no IPv6 connectivity, but can ## also cause reliability issues with some stub resolvers. block_ipv6 = false ## Immediately respond to A and AAAA queries for host names without a domain name ## This also prevents "dotless domain names" from being resolved upstream. block_unqualified = true ## Immediately respond to queries for local zones instead of leaking them to ## upstream resolvers (always causing errors or timeouts). block_undelegated = true ## TTL for synthetic responses sent when a request has been blocked (due to ## IPv6 or blocklists). reject_ttl = 10 ############################################################################### # Forwarding # ############################################################################### ## Route queries for specific domains to a dedicated set of servers ## See the `example-forwarding-rules.txt` file for an example # forwarding_rules = 'forwarding-rules.txt' ############################################################################### # Cloaking # ############################################################################### ## Cloaking returns a predefined address for a specific name. ## In addition to acting as a HOSTS file, it can also return the IP address ## of a different name. It will also do CNAME flattening. ## If 'cloak_ptr' is set, then PTR (reverse lookups) are enabled ## for cloaking rules that do not contain wild cards. ## ## See the `example-cloaking-rules.txt` file for an example # cloaking_rules = 'cloaking-rules.txt' ## TTL used when serving entries in cloaking-rules.txt # cloak_ttl = 600 # cloak_ptr = false ############################################################################### # DNS Cache # ############################################################################### ## Enable a DNS cache to reduce latency and outgoing traffic cache = true ## Cache size cache_size = 4096 ## Minimum TTL for cached entries cache_min_ttl = 2400 ## Maximum TTL for cached entries cache_max_ttl = 86400 ## Minimum TTL for negatively cached entries cache_neg_min_ttl = 60 ## Maximum TTL for negatively cached entries cache_neg_max_ttl = 600 ############################################################################### # Captive portal handling # ############################################################################### [captive_portals] ## A file that contains a set of names used by operating systems to ## check for connectivity and captive portals, along with hard-coded ## IP addresses to return. # map_file = 'example-captive-portals.txt' ############################################################################### # Local DoH server # ############################################################################### [local_doh] ## dnscrypt-proxy can act as a local DoH server. By doing so, web browsers ## requiring a direct connection to a DoH server in order to enable some ## features will enable these, without bypassing your DNS proxy. ## Addresses that the local DoH server should listen to # listen_addresses = ['127.0.0.1:3000'] ## Path of the DoH URL. This is not a file, but the part after the hostname ## in the URL. By convention, `/dns-query` is frequently chosen. ## For each `listen_address` the complete URL to access the server will be: ## `https://<listen_address><path>` (ex: `https://127.0.0.1/dns-query`) # path = '/dns-query' ## Certificate file and key - Note that the certificate has to be trusted. ## Can be generated using the following command: ## openssl req -x509 -nodes -newkey rsa:2048 -days 5000 -sha256 -keyout localhost.pem -out localhost.pem ## See the documentation (wiki) for more information. # cert_file = 'localhost.pem' # cert_key_file = 'localhost.pem' ############################################################################### # Query logging # ############################################################################### [query_log] ## Path to the query log file (absolute, or relative to the same directory as the config file) ## Can be set to /dev/stdout in order to log to the standard output. # file = 'query.log' ## Query log format (currently supported: tsv and ltsv) format = 'tsv' ## Do not log these query types, to reduce verbosity. Keep empty to log everything. # ignored_qtypes = ['DNSKEY', 'NS'] ############################################################################### # Suspicious queries logging # ############################################################################### [nx_log] ## Log queries for nonexistent zones ## These queries can reveal the presence of malware, broken/obsolete applications, ## and devices signaling their presence to 3rd parties. ## Path to the query log file (absolute, or relative to the same directory as the config file) # file = 'nx.log' ## Query log format (currently supported: tsv and ltsv) format = 'tsv' ############################################################################### # Pattern-based blocking (blocklists) # ############################################################################### ## Blocklists are made of one pattern per line. Example of valid patterns: ## ## example.com ## =example.com ## *sex* ## ads.* ## ads*.example.* ## ads*.example[0-9]*.com ## ## Example blocklist files can be found at https://download.dnscrypt.info/blocklists/ ## A script to build blocklists from public feeds can be found in the ## `utils/generate-domains-blocklists` directory of the dnscrypt-proxy source code. [blocked_names] ## Path to the file of blocking rules (absolute, or relative to the same directory as the config file) # blocked_names_file = 'blocked-names.txt' ## Optional path to a file logging blocked queries # log_file = 'blocked-names.log' ## Optional log format: tsv or ltsv (default: tsv) # log_format = 'tsv' ############################################################################### # Pattern-based IP blocking (IP blocklists) # ############################################################################### ## IP blocklists are made of one pattern per line. Example of valid patterns: ## ## 127.* ## fe80:abcd:* ## 192.168.1.4 [blocked_ips] ## Path to the file of blocking rules (absolute, or relative to the same directory as the config file) # blocked_ips_file = 'blocked-ips.txt' ## Optional path to a file logging blocked queries # log_file = 'blocked-ips.log' ## Optional log format: tsv or ltsv (default: tsv) # log_format = 'tsv' ############################################################################### # Pattern-based allow lists (blocklists bypass) # ############################################################################### ## Allowlists support the same patterns as blocklists ## If a name matches an allowlist entry, the corresponding session ## will bypass names and IP filters. ## ## Time-based rules are also supported to make some websites only accessible at specific times of the day. [allowed_names] ## Path to the file of allow list rules (absolute, or relative to the same directory as the config file) # allowed_names_file = 'allowed-names.txt' ## Optional path to a file logging allowed queries # log_file = 'allowed-names.log' ## Optional log format: tsv or ltsv (default: tsv) # log_format = 'tsv' ############################################################################### # Pattern-based allowed IPs lists (blocklists bypass) # ############################################################################### ## Allowed IP lists support the same patterns as IP blocklists ## If an IP response matches an allowed entry, the corresponding session ## will bypass IP filters. ## ## Time-based rules are also supported to make some websites only accessible at specific times of the day. [allowed_ips] ## Path to the file of allowed ip rules (absolute, or relative to the same directory as the config file) # allowed_ips_file = 'allowed-ips.txt' ## Optional path to a file logging allowed queries # log_file = 'allowed-ips.log' ## Optional log format: tsv or ltsv (default: tsv) # log_format = 'tsv' ############################################################################### # Time access restrictions # ############################################################################### ## One or more weekly schedules can be defined here. ## Patterns in the name-based blocked_names file can optionally be followed with @schedule_name ## to apply the pattern 'schedule_name' only when it matches a time range of that schedule. ## ## For example, the following rule in a blocklist file: ## *.youtube.* @time-to-sleep ## would block access to YouTube during the times defined by the 'time-to-sleep' schedule. ## ## {after='21:00', before= '7:00'} matches 0:00-7:00 and 21:00-0:00 ## {after= '9:00', before='18:00'} matches 9:00-18:00 [schedules] # [schedules.time-to-sleep] # mon = [{after='21:00', before='7:00'}] # tue = [{after='21:00', before='7:00'}] # wed = [{after='21:00', before='7:00'}] # thu = [{after='21:00', before='7:00'}] # fri = [{after='23:00', before='7:00'}] # sat = [{after='23:00', before='7:00'}] # sun = [{after='21:00', before='7:00'}] # [schedules.work] # mon = [{after='9:00', before='18:00'}] # tue = [{after='9:00', before='18:00'}] # wed = [{after='9:00', before='18:00'}] # thu = [{after='9:00', before='18:00'}] # fri = [{after='9:00', before='17:00'}] ############################################################################### # Servers # ############################################################################### ## Remote lists of available servers ## Multiple sources can be used simultaneously, but every source ## requires a dedicated cache file. ## ## Refer to the documentation for URLs of public sources. ## ## A prefix can be prepended to server names in order to ## avoid collisions if different sources share the same for ## different servers. In that case, names listed in `server_names` ## must include the prefixes. ## ## If the `urls` property is missing, cache files and valid signatures ## must already be present. This doesn't prevent these cache files from ## expiring after `refresh_delay` hours. ## `refreshed_delay` must be in the [24..168] interval. ## The minimum delay of 24 hours (1 day) avoids unnecessary requests to servers. ## The maximum delay of 168 hours (1 week) ensures cache freshness. [sources] ### An example of a remote source from https://github.com/DNSCrypt/dnscrypt-resolvers [sources.public-resolvers] urls = [ 'https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md', 'https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md', ] cache_file = 'public-resolvers.md' minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3' refresh_delay = 73 prefix = '' ### Anonymized DNS relays [sources.relays] urls = [ 'https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/relays.md', 'https://download.dnscrypt.info/resolvers-list/v3/relays.md', ] cache_file = 'relays.md' minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3' refresh_delay = 73 prefix = '' ### ODoH (Oblivious DoH) servers and relays [sources.odoh-servers] urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/odoh-servers.md', 'https://download.dnscrypt.info/resolvers-list/v3/odoh-servers.md'] cache_file = 'odoh-servers.md' minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3' refresh_delay = 73 prefix = '' [sources.odoh-relays] urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/odoh-relays.md', 'https://download.dnscrypt.info/resolvers-list/v3/odoh-relays.md'] cache_file = 'odoh-relays.md' minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3' refresh_delay = 73 prefix = '' ### Quad9 # [sources.quad9-resolvers] # urls = ['https://quad9.net/dnscrypt/quad9-resolvers.md', 'https://raw.githubusercontent.com/Quad9DNS/dnscrypt-settings/main/dnscrypt/quad9-resolvers.md'] # minisign_key = 'RWQBphd2+f6eiAqBsvDZEBXBGHQBJfeG6G+wJPPKxCZMoEQYpmoysKUN' # cache_file = 'quad9-resolvers.md' # prefix = 'quad9-' ### Another example source, with resolvers censoring some websites not appropriate for children ### This is a subset of the `public-resolvers` list, so enabling both is useless. # [sources.parental-control] # urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/parental-control.md', 'https://download.dnscrypt.info/resolvers-list/v3/parental-control.md'] # cache_file = 'parental-control.md' # minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3' ### dnscry.pt servers - See https://www.dnscry.pt # [sources.dnscry-pt-resolvers] # urls = ["https://www.dnscry.pt/resolvers.md"] # minisign_key = "RWQM31Nwkqh01x88SvrBL8djp1NH56Rb4mKLHz16K7qsXgEomnDv6ziQ" # cache_file = "dnscry.pt-resolvers.md" # refresh_delay = 73 # prefix = "dnscry.pt-" ############################################################################### # Servers with known bugs # ############################################################################### [broken_implementations] ## Cisco servers currently cannot handle queries larger than 1472 bytes, and don't ## truncate responses larger than questions as expected by the DNSCrypt protocol. ## This prevents large responses from being received over UDP and over relays. ## ## Older versions of the `dnsdist` server software had a bug with queries larger ## than 1500 bytes. This is fixed since `dnsdist` version 1.5.0, but ## some server may still run an outdated version. ## ## The list below enables workarounds to make non-relayed usage more reliable ## until the servers are fixed. fragments_blocked = [ 'cisco', 'cisco-ipv6', 'cisco-familyshield', 'cisco-familyshield-ipv6', 'cisco-sandbox', 'cleanbrowsing-adult', 'cleanbrowsing-adult-ipv6', 'cleanbrowsing-family', 'cleanbrowsing-family-ipv6', 'cleanbrowsing-security', 'cleanbrowsing-security-ipv6', ] ############################################################################### # Certificate-based client authentication for DoH # ############################################################################### [doh_client_x509_auth] ## Use an X509 certificate to authenticate yourself when connecting to DoH servers. ## This is only useful if you are operating your own, private DoH server(s). ## 'creds' maps servers to certificates, and supports multiple entries. ## If you are not using the standard root CA, an optional "root_ca" ## property set to the path to a root CRT file can be added to a server entry. # creds = [ # { server_name='*', client_cert='client.crt', client_key='client.key' } # ] ############################################################################### # Anonymized DNS # ############################################################################### [anonymized_dns] ## Routes are indirect ways to reach DNSCrypt servers. ## ## A route maps a server name ("server_name") to one or more relays that will be ## used to connect to that server. ## ## A relay can be specified as a DNS Stamp (either a relay stamp, or a ## DNSCrypt stamp) or a server name. ## ## The following example routes "example-server-1" via `anon-example-1` or `anon-example-2`, ## and "example-server-2" via the relay whose relay DNS stamp is ## "sdns://gRIxMzcuNzQuMjIzLjIzNDo0NDM". ## ## !!! THESE ARE JUST EXAMPLES !!! ## ## Review the list of available relays from the "relays.md" file, and, for each ## server you want to use, define the relays you want connections to go through. ## ## Carefully choose relays and servers so that they are run by different entities. ## ## "server_name" can also be set to "*" to define a default route, for all servers: ## { server_name='*', via=['anon-example-1', 'anon-example-2'] } ## ## If a route is ["*"], the proxy automatically picks a relay on a distinct network. ## { server_name='*', via=['*'] } is also an option, but is likely to be suboptimal. ## ## Manual selection is always recommended over automatic selection, so that you can ## select (relay,server) pairs that work well and fit your own criteria (close by or ## in different countries, operated by different entities, on distinct ISPs...) # routes = [ # { server_name='example-server-1', via=['anon-example-1', 'anon-example-2'] }, # { server_name='example-server-2', via=['sdns://gRIxMzcuNzQuMjIzLjIzNDo0NDM'] } # ] ## Skip resolvers incompatible with anonymization instead of using them directly skip_incompatible = false ## If public server certificates for a non-conformant server cannot be ## retrieved via a relay, try getting them directly. Actual queries ## will then always go through relays. # direct_cert_fallback = false ############################################################################### # DNS64 # ############################################################################### [dns64] ## DNS64 is a mechanism for synthesizing AAAA records from A records. ## It is used with an IPv6/IPv4 translator to enable client-server ## communication between an IPv6-only client and an IPv4-only server, ## without requiring any changes to either the IPv6 or the IPv4 node, ## for the class of applications that work through NATs. ## ## There are two options to synthesize such records: ## Option 1: Using a set of static IPv6 prefixes; ## Option 2: By discovering the IPv6 prefix from DNS64-enabled resolver. ## ## If both options are configured - only static prefixes are used. ## (Ref. RFC6147, RFC6052, RFC7050) ## ## Do not enable unless you know what DNS64 is and why you need it, or else ## you won't be able to connect to anything at all. ## Static prefix(es) as Pref64::/n CIDRs # prefix = ['64:ff9b::/96'] ## DNS64-enabled resolver(s) to discover Pref64::/n CIDRs ## These resolvers are used to query for Well-Known IPv4-only Name (WKN) "ipv4only.arpa." to discover only. ## Set with your ISP's resolvers in case of custom prefixes (other than Well-Known Prefix 64:ff9b::/96). ## IMPORTANT: Default resolvers listed below support Well-Known Prefix 64:ff9b::/96 only. # resolver = ['[2606:4700:4700::64]:53', '[2001:4860:4860::64]:53'] ############################################################################### # IP Encryption # ############################################################################### [ip_encryption] ## Encrypt client IP addresses in plugin logs using IPCrypt ## This provides privacy for client IP addresses while maintaining ## the ability to distinguish between different clients in logs ## Encryption algorithm (default: "none") ## - "none": No encryption (default) ## - "ipcrypt-deterministic": Deterministic encryption (same IP always encrypts to same value) - requires 16-byte key ## - "ipcrypt-nd": Non-deterministic encryption with 8-byte tweak - requires 16-byte key ## - "ipcrypt-ndx": Non-deterministic encryption with 16-byte tweak (extended) - requires 32-byte key algorithm = "none" ## Encryption key in hexadecimal format (required if algorithm is not "none") ## Key size depends on algorithm: ## - ipcrypt-deterministic: 32 hex chars (16 bytes) - Generate with: openssl rand -hex 16 ## - ipcrypt-nd: 32 hex chars (16 bytes) - Generate with: openssl rand -hex 16 ## - ipcrypt-ndx: 64 hex chars (32 bytes) - Generate with: openssl rand -hex 32 ## Example for deterministic/nd: key = "1234567890abcdef1234567890abcdef" ## Example for ndx: key = "1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef" ## IMPORTANT: Keep this key secret key = "" ############################################################################### # Monitoring UI # ############################################################################### [monitoring_ui] ## Enable the monitoring UI enabled = false ## Listen address for the monitoring UI listen_address = "127.0.0.1:8080" ## Optional username and password for basic authentication ## To disable authentication, set username to an empty string: username = "" ## If both username and password are empty, no authentication is required username = "admin" password = "changeme" ## Optional TLS certificate and key for HTTPS ## If both are empty, HTTP will be used tls_certificate = "" tls_key = "" ## Enable query logging in the monitoring UI ## This will show recent queries in the UI enable_query_log = true ## Privacy level for the monitoring UI ## 0: show all details including client IPs ## 1: anonymize client IPs (default) ## 2: aggregate data only (no individual queries or domains shown) privacy_level = 1 ## Maximum number of recent query log entries to keep in memory ## Helps control memory usage on high-traffic servers ## Default: 100 # max_query_log_entries = 100 ## Maximum memory usage in MB for recent query logs ## Automatic cleanup when limit is exceeded ## Default: 1 # max_memory_mb = 1 ## Enable Prometheus metrics endpoint ## Default: false # prometheus_enabled = false ## Path for Prometheus metrics endpoint ## Default: /metrics # prometheus_path = "/metrics" ############################################################################### # Static entries # ############################################################################### [static] ## Optional, local, static list of additional servers ## Mostly useful for testing your own servers. # [static.myserver] # stamp = 'sdns://AQcAAAAAAAAAAAAQMi5kbnNjcnlwdC1jZXJ0Lg'
Вопрос знающим: С чем связано падение сервиса dnscrypt 2.1.12 при подключении опции использования ODoH? Раньше такого не наблюдалось.
Настройка OpenVPN для аутентификации
apt install openvpn
Свежий билд EasyRSA качаем тут
Переименовываем vars.example в vars
Изменяем параметр set_var EASYRSA_KEY_SIZE на 4096
Даём права EasyRSA на исполнение:
chmod +x easyrsa
./easy-rsa init-pki
./easy-rsa build-ca
./easy-rsa gen-req server nopass
./easy-rsa sign-req server server
./easy-rsa gen-dh
openvpn --genkey secret /etc/openvpn/server/pki/ta.key
## /etc/openvpn/server серверная часть port 1192 proto tcp # Виртуальный сетевой интерфейс TUN (уровень IP) dev tun # Сертификат центра сертификации (CA) ca /etc/openvpn/server/pki/ca.crt # Сертификат сервера cert /etc/openvpn/server/pki/issued/server.crt # Закрытый ключ сервера key /etc/openvpn/server/pki/private/server.key # Параметры Диффи-Хеллмана для ключевого обмена dh /etc/openvpn/server/pki/dh.pem # Подсеть VPN и маска подсети (выдача IP клиентам) server 10.8.0.0 255.255.255.0 # Использовать топологию подсети (одинаковый пул IP для всех клиентов) topology subnet # Перенаправлять весь трафик клиента через VPN (default route через VPN-сервер) push "redirect-gateway def1" # Настроить DNS клиента push "dhcp-option DNS 192.168.2.1" # Минимальная версия TLS для обеспечения безопасности tls-version-min 1.2 # TLS-crypt ключ для защиты tls-crypt /etc/openvpn/server/pki/ta.key # Специфический набор TLS-шифров для безопасности tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 # Качественные современные шифры для данных data-ciphers AES-256-GCM:CHACHA20-POLY1305 # Алгоритм хэширования (аутентификация сообщений) auth SHA256 # Сохранять ключи между перезапусками туннеля persist-key # Сохранять туннельное устройство между рестартами persist-tun # Использовать имя пользователя как common name клиента username-as-common-name # Не проверять сертификаты клиента (аутентификация через username/password) verify-client-cert none # Скрипт для проверки логина и пароля пользователя auth-user-pass-verify "/usr/bin/php /etc/openvpn/server/verify.php" via-file # Позволяет выполнять скрипты с максимальным уровнем безопасности script-security 3 # Без логов verb
Даём права на исполнение скрипту
chmod +x verify.php
// тут должно быть про MariaDB и SQL
Установка и настройка СУБД MariaDB
apt install apt-transport-https curl
mkdir -p /etc/apt/keyrings
curl -o /etc/apt/keyrings/mariadb-keyring.pgp 'https://mariadb.org/mariadb_release_signing_key.pgp' echo "deb [signed-by=/etc/apt/keyrings/mariadb-keyring.pgp] https://mirror.mariadb.org/repo/11.8/debian bookworm main" > /etc/apt/sources.list.d/mariadb118.list
apt install mariadb-server mariadb-client
Базовая настройка безопасности. При настройке не забудьте отключить unix auth иначе скрипт не сможет присоединиться.
mysql_secure_installation
Подготовка таблицы
-- Хост: localhost -- Время создания: Июл 26 2025 г., 08:25 -- Версия сервера: 11.8.2-MariaDB-deb12 -- Версия PHP: 8.2.28 SET SQL_MODE = "NO_AUTO_VALUE_ON_ZERO"; START TRANSACTION; SET time_zone = "+00:00"; /*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */; /*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */; /*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */; /*!40101 SET NAMES utf8mb4 */; -- -- База данных: `openvpn` -- -- -------------------------------------------------------- -- -- Структура таблицы `users` -- CREATE TABLE `users` ( `id` bigint(255) NOT NULL, `username` varchar(120) NOT NULL, `password_hash` varchar(255) NOT NULL, `start_date` date NOT NULL, `next_date` date NOT NULL ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci; -- -- Индексы сохранённых таблиц -- -- -- Индексы таблицы `users` -- ALTER TABLE `users` ADD PRIMARY KEY (`id`), ADD UNIQUE KEY `username` (`username`); -- -- AUTO_INCREMENT для сохранённых таблиц -- -- -- AUTO_INCREMENT для таблицы `users` -- ALTER TABLE `users` MODIFY `id` bigint(255) NOT NULL AUTO_INCREMENT; COMMIT; /*!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT */; /*!40101 SET CHARACTER_SET_RESULTS=@OLD_CHARACTER_SET_RESULTS */; /*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */;
#!/usr/bin/php <?php declare(strict_types=1); class Database { private $pdo; /** * Конструктор класса Database. * * @param array $config Массив конфигурации подключения к БД. * @throws PDOException Если подключение к БД не удалось. */ public function __construct(array $config) { if (!isset($config['host'], $config['dbname'], $config['user'], $config['password'])) { throw new InvalidArgumentException("Недостаточно данных для подключения к БД"); } try { $options = [ PDO::MYSQL_ATTR_INIT_COMMAND => 'SET NAMES utf8mb4', PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC, PDO::ATTR_EMULATE_PREPARES => false, ]; $this->pdo = new PDO( "mysql:host={$config['host']};dbname={$config['dbname']};charset=utf8mb4", $config['user'], $config['password'], $options ); } catch (PDOException $e) { throw new PDOException("Database connection failed: " . $e->getMessage()); } } /** * Подготавливает и выполняет SQL-запрос. * * @param string $sql SQL-запрос. * @param array $params Параметры запроса. * @return PDOStatement Подготовленный и выполненный запрос. */ public function query(string $sql, array $params = []): PDOStatement { $stmt = $this->pdo->prepare($sql); $stmt->execute($params); return $stmt; } /** * Выполняет SQL-запрос и возвращает все результаты. * * @param string $sql SQL-запрос. * @param array $params Параметры запроса. * @return array Массив результатов. */ public function getAll(string $sql, array $params = []): array { $stmt = $this->query($sql, $params); return $stmt->fetchAll(PDO::FETCH_ASSOC); } } // Рекомендуется хранить конфиг подключения в отдельном файле с ограниченным доступом $dbConfig = [ 'host' => 'localhost', 'dbname' => 'openvpn_auth', 'user' => 'openvpn_user', 'password' => 'strongpassword', ]; // Проверка, что передан ровно один аргумент (путь к файлу с учётными данными) if ($argc !== 2) { error_log("OpenVPN auth error: expected exactly 1 argument, got " . ($argc - 1)); exit(1); } $credentialsFile = $argv[1]; // Проверка существования и читаемости файла с учетными данными if (!is_file($credentialsFile) || !is_readable($credentialsFile)) { error_log("OpenVPN auth error: credentials file '$credentialsFile' not found or unreadable"); exit(1); } // Чтение строк: первая — username, вторая — пароль $lines = file($credentialsFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES); if (count($lines) < 2) { error_log("OpenVPN auth error: invalid credentials file format"); exit(1); } $username = trim($lines[0]); $password = trim($lines[1]); try { $db = new Database($dbConfig); // Получаем хеш пароля по username $stmt = $db->query('SELECT password_hash FROM users WHERE username = :username LIMIT 1', ['username' => $username]); $user = $stmt->fetch(); if (!$user || !password_verify($password, $user['password_hash'])) { error_log("OpenVPN auth failed for user '{$username}'"); exit(1); } // Успешная аутентификация exit(0); } catch (Throwable $e) { error_log("OpenVPN auth error: " . $e->getMessage()); exit(1); }
# openvpn клиентская часть client dev tun proto tcp remote 192.168.2.1 1192 resolv-retry infinite nobind # Встроенный сертификат CA <ca> -----BEGIN CERTIFICATE----- (текст вашего ca.crt) -----END CERTIFICATE----- </ca> remote-cert-tls server persist-key persist-tun auth-user-pass tls-version-min 1.2 # Встроенный TLS-crypt ключ <tls-crypt> -----BEGIN OpenVPN Static key V1----- (текст вашего ta.key) -----END OpenVPN Static key V1----- </tls-crypt> tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 data-ciphers AES-256-GCM:CHACHA20-POLY1305 auth SHA256 verb 0
Обход шизоидной блокировки РосКомПозора
Свежие билды ByeDPI для linux тут
Создаём файл byedpi.service по пути /etc/systemd/system/
[Unit] Description=byedpi daemon service After=network.target [Service] # Type=simple для приложений исполняющихся в основном (родительском) процессе. # Если исполняется в дочернем процессе Type=forking ExecStart=/usr/local/bin/ciadpi -D --transparent ---tfo -s1 -o1 -r1+s -a1 -Ar -o2 -a1 -At -f-1 -r1+s -a1 --tlsrec 3+s -b+300 --fake-sni "www.yandex.ru" --ttl 65 Restart=on-failure RestartSec=5s # При необходимости использовать неполные права (запуск не от root): # User=someuser # Group=somegroup # Автоматический рестарт при сбоях Restart=on-failure RestartSec=5s # Логирование в журнал systemd StandardOutput=journal StandardError=journal [Install] WantedBy=multi-user.target
Перечитываем список сервисов и запускаем
systemctl daemon-reload
systemctl enable byedpi
systemctl start byedpi
systemctl status byedpi
Вопрос знающим: Как указать список сайтов к чему применять обход? Если глобально, то некоторые сервисы с IPS/IDS начинают откидывать "аномальные" пакеты.
Настройка правил nftables
#!/usr/sbin/nft -f flush ruleset define VPN = "tun0" define WAN = "enp1s0" define LAN = "enp3s0" table inet filter { chain input { type filter hook input priority filter; policy drop; # Разрешаем весь трафик с loopback интерфейса iifname "lo" accept; # Разрешаем установленные и связанные соединения ct state {established, related} accept; # ICMP echo-request (ping) с LAN с rate limit iifname $LAN icmp type echo-request limit rate 5/second burst 10 packets accept; # # OpenVPN TCP 1194 iifname $LAN tcp dport 1194 accept; # # SSH TCP 2222 с WAN с rate limiting и только новые соединения iifname $WAN tcp dport 2222 ct state new limit rate 20/second burst 30 packets accept; # # HTTP и HTTPS TCP (80, 443) tcp dport {80, 443} ct state new limit rate 30/second burst 40 packets accept; # # UDP 443 (QUIC) udp dport 443 ct state new limit rate 40/second burst 50 packets accept; # # DNS UDP 53 на LAN и VPN с ограничением iifname { $VPN, $LAN } udp dport 53 limit rate 30/second burst 40 packets accept; # # DNSCrypt-proxy UDP 5353 с lo и LAN iifname { "lo", $LAN } udp dport 5353 accept; # # ByeDPI - SOCKS5. В режиме transparent не нужен, трафик идёт напрямую. # iifname $VPN tcp dport 1080 accept; } chain output { type filter hook output priority filter; policy accept; } chain forward { type filter hook forward priority filter; policy drop; # Разрешаем установленные и связанные соединения ct state {established, related} accept; # Трафик VPN -> WAN (интернет) iifname $VPN oifname $WAN accept; # Трафик WAN -> VPN iifname $WAN oifname $VPN accept; } } table ip nat { chain prerouting { type nat hook prerouting priority -100; policy accept; # captive portal - перенаправление неавторизованных пользователей, на домашний сайт ip saddr 192.168.2.0/24 tcp dport 80 redirect to 80; } chain postrouting { type nat hook postrouting priority 100; policy accept; # Доступ в интернет авторизированным iifname $VPN oifname $WAN masquerade; } }
Если требуется смотрим какие порты используют приложения
ss -tulnp или ss -tulnp | grep :PORT если требуется конкретный порт
