| model | CPU | cores | GPU | RAM/Flash | LAN | USB | SATA | video | audio | ref |
|---|---|---|---|---|---|---|---|---|---|---|
| Raspberry Pi Pico | RP2040, 133MHz | 2 | - | 264kB/2MB | - | 1 OTG | - | - | - | 1, 2 |
| Raspberry Pi Pico W | RP2040, 133MHz | 2 | - | 264kB/2MB | WiFi 802.11n | 1 OTG | - | - | - | 1, 2 |
| Raspberry Pi Pico 2 | RP2350, 150MHz | 2 | - | 520kB/4MB | - | 1 OTG | - | TMDS encoder | - | 1 |
| Raspberry Pi Zero | BCM2835, 1GHz | 1 | VideoCore IV | 512MB/µSD | - | 1 OTG | - | HDMI | HDMI | 1 |
| Raspberry Pi A | BCM2835, 700MHz | 1 | VideoCore IV | 256MB/SD | - | 1 OTG | - | HDMI, CSI/DSI, analog | HDMI, analog | 1 |
| Raspberry Pi A+ | BCM2835, 700MHz | 1 | VideoCore IV | 256/512MB/µSD | - | 1 OTG | - | HDMI, CSI/DSI, analog | HDMI, analog | 1 |
| Raspberry Pi B | BCM2835, 700MHz | 1 | VideoCore IV | 256/512MB/SD | 100Mbit | 2 | - | HDMI, CSI/DSI, analog | HDMI, analog | 1 |
| Raspberry Pi B+ | BCM2835, 700MHz | 1 | VideoCore IV | 512MB/µSD | 100Mbit | 4 | - | HDMI, CSI/DSI, analog | HDMI, analog | 1 |
| Raspberry Pi 2 B | BCM2836, 900MHz | 4 | VideoCore IV | 1GB/µSD | 100Mbit | 4 | - | HDMI, CSI/DSI, analog | HDMI, analog | 1, 2 |
| Raspberry Pi 3 | BCM2837 64b, 1,2GHz | 4 | VideoCore IV | 1GB/µSD | 100Mbit + WiFi + BT 4.1 | 4 | - | HDMI, CSI/DSI, analog | HDMI, analog | 1, 2, 3 |
| Raspberry Pi 3 B+ | BCM2837B0 64b, 1,4GHz | 4 | VideoCore IV | 1GB/µSD | 1000Mbit + WiFi + BT 4.2 | 4 | - | HDMI, CSI/DSI, analog | HDMI, analog | 1 |
| Raspberry Pi 4 B | BCM2711B0 64b, 1,8GHz | 4 | VideoCore VI | 1-8GB/µSD | 1000Mbit + WiFi + BT 5.0 | 2x 3.0 + 2 | - | 2x µHDMI 2.0, DPI/CSI/DSI, analog | HDMI, analog | 1, 2 |
| Raspberry Pi 5 | BCM2712 64b, 2,4GHz | 4 | VideoCore VII | 4-8GB/µSD | 1000Mbit + WiFi + BT 5.0 | 2x 3.0 + 2 | - | 2x µHDMI 2.0, 2*MIPI/PCIe 2.0 x1 | HDMI | 1 |
| Banana Pi M1 | Allwinner A20, 1GHz | 2 | Mali-400MP2 | 1GB/SD | 1000Mbit | 2 + 1 OTG | 1 | HDMI, LVDS, CSI, analog | HDMI, analog, onboard mic. | 1 |
| Banana Pi M1+ | Allwinner A20, 1GHz | 2 | Mali-400MP2 | 1GB/µSD | 1000Mbit + WiFi | 2 + 1 OTG | 1 | HDMI, LVDS, CSI, analog | HDMI, analog, onboard mic. | 1 |
| Banana Pi M2 | Allwinner A31S, 1,2GHz | 4 | PowerVR SGX544MP2 | 1GB/µSD | 1000Mbit + WiFi | 4 | - | HDMI, LVDS, RGB, CSI | HDMI, analog, onboard mic. | 1 |
| Banana Pi M2+ | Allwinner H3, 1GHz | 4 | Mali-400MP2 | 1GB/µSD, 8GB eMMC | 1000Mbit + WiFi + BT 4.0 | 2 + 1 OTG | - | HDMI, CSI | HDMI | 1 |
| Banana Pi M3 | Allwinner A83T, 1,8GHz | 8 | PowerVR SGX544MP1 | 2GB/µSD, 8GB eMMC | 1000Mbit + WiFi + BT 4.0 | 2 + 1 OTG | 1 | HDMI, MIPI/DSI, CSI | HDMI, analog, onboard mic. | 1, 2, 3 |
| Banana Pi M64 | Allwinner A53 64b, 1,2GHz | 4 | Mali-400MP2 | 2GB/µSD, 8GB eMMC | 1000Mbit + WiFi + BT 4.0 | 2 + 1 OTG | - | HDMI, MIPI/DSI, CSI | HDMI, analog, onboard mic. | 1 |
| Orange Pi One | Allwinner H3, 1,2GHz | 4 | Mali-400MP2 | 512MB/µSD | 100Mbit | 1 + 1 OTG | - | HDMI, CSI | HDMI | 1, 2 |
| Orange Pi One Lite | Allwinner H3, 1,2GHz | 4 | Mali-400MP2 | 512MB/µSD | WiFi | 2 + 1 OTG | - | HDMI, CSI | HDMI, onboard mic. | 1 |
| Orange Pi+ | Allwinner H3, 1,6GHz | 4 | Mali-400MP2 | 1GB/µSD | 1000Mbit + WiFi | 4 + 1 OTG | 1 | HDMI, CSI, analog | HDMI, analog, onboard mic. | 1, 2 |
| Orange Pi PC | Allwinner H3, 1,6GHz | 4 | Mali-400MP2 | 1GB/µSD | 100Mbit | 3 + 1 OTG | - | HDMI, CSI, analog | HDMI, analog, onboard mic. | 1 |
| Orange Pi PC+ | Allwinner H3, 1,3GHz | 4 | Mali-400MP2 | 1GB/µSD, 8GB eMMC | 100Mbit + WiFi | 3 + 1 OTG | - | HDMI, CSI, analog | HDMI, analog, onboard mic. | |
| Orange Pi mini 2 | Allwinner H3, 1,6GHz | 4 | Mali-400MP2 | 1GB/µSD | 100Mbit | 4 + 1 OTG | - | HDMI, CSI, analog | HDMI, analog, onboard mic. | 1 |
| Orange Pi 2 | Allwinner H3, 1,6GHz | 4 | Mali-400MP2 | 1GB/µSD | 100Mbit + WiFi | 4 + 1 OTG | - | HDMI, CSI, analog | HDMI, analog, onboard mic. | 1, 2 |
| Orange Pi+ 2 | Allwinner H3, 1,6GHz | 4 | Mali-400MP2 | 2GB/µSD, 16GB eMMC | 1000Mbit + WiFi | 4 + 1 OTG | 1 | HDMI, CSI, analog | HDMI, analog, onboard mic. | 1 |
| Orange Pi PC 2 | Allwinner H5 64b, 1,6GHz | 4 | Mali-450MP4 (4k) | 1GB/µSD, 2MB SPI | 1000Mbit | 3 + 1 OTG | - | HDMI 1.4, CSI | HDMI, analog, onboard mic. | 1 |
| Orange Pi Lite 2 | Allwinner H6 64b, 1,8GHz | 4 | Mali T-722 (4k) | 1GB/µSD | WiFi + BT 4.1 | 1x 3.0 + 1 | - | HDMI 2.0a, CSI | HDMI, onboard mic. | 1 |
| PINE A64 | Allwinner A53 64b, 1,2GHz | 4 | Mali-400MP2 | 512MB/µSD | 100Mbit | 2 | - | HDMI, CSI, DSI | HDMI, analog | 1 |
| PINE A64+ | Allwinner A53 64b, 1,2GHz | 4 | Mali-400MP2 | 1GB/µSD | 1000Mbit | 2 | - | HDMI, CSI, DSI | HDMI, analog | 1 |
| PINE H64 | Allwinner H6 64b, 1,8GHz | 4 | Mali T-722 (4k) | 1-4GB/µSD, eMMC5.0 | 1000Mbit, mini PCIe | 1x 3.0 + 2 | - | HDMI 2.0a, analog | HDMI, analog | 1 |
| ODROID-C0 | Amlogic S805, 1,5GHz | 4 | Mali-450MP2 | 1GB/µSD, eMMC4.5 | - | 2 neos. | - | HDMI | HDMI, I2S | 1 |
| ODROID-C1+ | Amlogic S805, 1,5GHz | 4 | Mali-450MP2 | 1GB/µSD, eMMC4.5 | 1000Mbit | 4 + 1 OTG | - | HDMI | HDMI, I2S | 1 |
| ODROID-C2 | Amlogic S905 64b, 2GHz | 4 | Mali-450MP3 | 2GB/µSD, eMMC5.0 | 1000Mbit | 4 + 1 OTG | - | HDMI 2.0 | HDMI 2.0, I2S | 1 |
| ODROID-XU4 | Samsung Exynos5422, 2GHz | 4+4 | Mali-T628MP6 | 2GB/µSD, eMMC5.0 | 1000Mbit | 2x 3.0 + 1 | - | HDMI 1.4a | HDMI 1.4a, I2S | 1, 2 |
| CHIP | Allwinner R8, 1GHz | 1 | Mali-400 | 512MB/4GB | WiFi + BT 4.0 | 1 + 1 OTG | - | analog | analog | 1, 2, 3, 4 |
| Omega2 | MT7688K (MIPS), 580MHz | 1 | - | 64MB/16MB | WiFi | 1 | - | - | - | 1, 2, 3 |
| intel Edison | Atom Z34XX x86, 500MHz | 2 | - | 1GB/4GB eMMC | WiFi + BT 4.0 | 1 + 1 OTG | - | - | - | 1, 2 |
| intel Galileo | Quark SoC X1000 x86, 400MHz | 1 | - | 256MB/8MB, µSD | 100Mbit | 1 + 1 cli | - | ext. PCIe 2.0 | - | 1 |
| 86Duino | Vortex86EX, 300MHz | 1 | - | 128MB/8MB, µSD | ext. 100Mbit | 1 + 1 cli | 1 | ext. PCIe 1.0 | ext. HD Audio | 1, 2 |
25.10.2012 Rzn vvojov destiky byly k dispozici i dve, ale k masovmu rozen dolo a po vydn prvnho modelu Raspberry Pi 1 zatkem roku 2012. Viz Raspberry Pi Foundation bylo vytvoit a dodvat mal, levn pota pro vukov ely do kol. Eben Upton (jeden ze spoluzakladatel) v t dob pracoval ve spolenosti Broadcom a podailo se mu zajistit dodvku SoC BCM2835. Vvoj trval nkolik let a v dob vydn u procesor nepatil k nejvkonnjm. Pesto vak prvn nkolikatiscov srie vyrbn v UK, prodvan za pznivch 25 $ (model A), resp. 35 $ (model B), zmizely z prodeje takka okamit a do roku 2015 se jich prodalo u 5 milin kus. Dky tto rozenosti m Raspberry Pi silnou podporu OpenSource / OpenHW komunity (rzn distribuce OS, knihovny a zveejnn SW / HW projekty) a tak ada vrobc zaala nabzet pro Pi celou adu produkt, od krabiek po rzn periferie.
V prci pouvme Raspberry Pi vude tam, kde je poteba pro njakou specifickou lohu rychle nasadit komplexnj systm jak jednoipky, ale klasick PC je pro to zbyten velk, rav a drah. Nap. pro rzn HW testery do vroby nebo dataloggery s penosem dat po sti. I j jsem si podil jednu malinu na hran. Pokal jsem si na HW revizi 2.0 s 512 MB RAM (star revize mly jen 256 MR RAM). Dle se nebudu moc ze iroka rozepisovat, nebo by to bylo noen dv do lesa. Spe si zde budu zapisovat osobn poznmky k instalaci a konfiguraci, abych je ml pehledn k dispozici. Kdy to pome i nkomu dalmu, tm lpe. S dotazy se lze obrtit na mezinrodn frum nebo na esk frum.
 |
 |
Schma zapojen
a pehled parametr:
| SoC: | Broadcom BCM2835 |
| CPU jdro: | ARM1176JZF-S, 1 jdro, 700 MHz |
| GPU: | VideoCore IV, 250 MHz, OpenGL ES 2.0, HW kodeky MPEG-2, VC-1 (s licenc), H264/MPEG-4 AVC (1080p30) |
| Pam: | 512 MB DDR3 SDRAM (sdlen s GPU) Samsung K4P4G324EB slot na SD/MMC/SDIO kartu |
| Sovka: | SMSC LAN9514-JZX 10/100 Mbit Ethernet na vnitnm USB portu, RJ-45 |
| Audio: | analogov stereo vstup na 3,5mm jack, digitln pes HDMI |
| Porty: | 2 x USB 2.0 (S7) + 1 x napjec microUSB (S1) 1 x RJ45 pro LAN (P4) 1 x HDMI 1.3, max. 1920 x 1200 @60 Hz (S3) 1 x RCA kompozitn analogov video-vstup (S4) 1 x 15-pinov DSI digitln video-vstup (sriov, 2-lane) na LCD (S2) 1 x 15-pinov MIPI digitln vstup pro kameru (S5) 1 x 3,5mm analogov audio-vstup (S6) 2x13-pinov GPIO header s UART, I2C, SPI, I2S, 5 V, 3,3 V... (P1) 2x4-pinov neosazen GPIO header (P5) |
| Pkon: | 3,5 W (700 mA) |
| Rozmry: | 85,6 x 56,5 mm |
| Hmotnost: | 45 g |
| Vydn: | v roce 2012 |
| Cena: | 35 $ |
Operan systmy a instalace
- Raspbian (Debian-Jessie) full - velikost image: ~4 GB, nutn min. 8GB SD karta
- Raspbian (Debian-Jessie) lite - velikost image: ~1,4 GB, nutn min. 2GB SD karta, neobsahuje X-server a GUI.
pidn X-serveru s Openbox: ~ 100 MB (apt-get install xinit xrdp openbox)
pidn X-serveru s LXDE: ~ 770 MB
- XBian (Debian-Jessie) - velikost image: ~950 MB, nutn min. 1GB SD karta
- DietPi - velikost image: ~600 MB, nutn min. 1GB SD karta
- Moebius 2.x - velikost image: ~120 MB, nutn min. 128MB SD karta
- OpenELEC 6.x - velikost image: ~580 MB, nutn min. 1GB SD karta
- OSMC - velikost image: ~270 MB, nutn min. 512MB SD karta
Zkladn nastaven
- vchoz pihlaovac daje pro Raspbian: user = pi, password = raspberry (root nem nastaven heslo)
- vchoz pihlaovac daje pro DietPi: user = root, password = dietpi
- zkladn nastaven: pkaz raspi-config - zm heslo uivatele pi, povol pihlen po SSH (standardn na portu 22), expanduj FS
- nastaven hesla pro uivatele root: pkaz sudo passwd root, dle pedpokldm prci pod rootem, take u bez sudo
- povolen pihlaovn uivatele root pes SSH: v souboru /etc/ssh/sshd_config pepi dek:
PermitRootLogin without-password -> PermitRootLogin yes
Zapnut DHCP
- v souboru /etc/network/interfaces pepi dek:
iface eth0 inet manual -> iface eth0 inet dhcp - zkontroluj pidlen IP adresy: pkaz ifconfig
Nastaven dynamick DNS sluby
Pokud mte k dispozici veejnou IP adresu, avak nikoliv pevnou (nap. u ISP UPC) a chcete se na malinu snadno pipojovat zvenku, je dobr si zadit takovouto slubu, kter bude na DNS serveru automaticky aktualizovat vai IP adresu a vy se budete pipojovat na vai registrovanou domnu.- vytvo si et na DNSdynamic a zaregistruj domnov jmno (na vbr je vce top domn)
- nainstaluj klienta ddclient: apt-get install ddclient
- vytvo konfiguran soubor /etc/ddclient.conf a uprav zvraznn daje podle sv registrace:
# Configuration file for ddclient: /etc/ddclient.conf daemon=600 # IP update check period [s] syslog=yes #mail=root #mail-failure=root pid=/var/run/ddclient.pid ssl=yes use=web, web=myip.dnsdynamic.org # get IP from server server=www.dnsdynamic.org login=username # username password='pwd' # password protocol=dyndns2 userdomain.dnsd.info # user domain
- aby sprvn fungovalo natn IP adresy pi bootu, kdy startuje ddclient dmon, je teba v raspi-config
zapnout volbu "Wait for Network at Boot" (bez pipojen k sti pak ek asi 20s) nebo pidat zpodnou
obnovu IP adresy jako kol do cronu:
zadej pkaz crontab -e (ukld se do souboru /var/spool/cron/crontabs) a pidej dky:
# zpozdena aktualizace DDNS, kdyz uz je spravne nactena IP adresa @reboot sleep 30 ; /usr/sbin/ddclient -force # pro sichr jeste opakuj 1 denne @daily /usr/sbin/ddclient -force
Bez tto pravy jsem ml problm v tom, e po startu systmu (dmon ddclient zejm startuje dve, ne se stihne piadit IP adresa z DHCP) obsahoval soubor /var/cache/ddclient/ddclient.cache przdnou poloku ip=, kter se u nikdy neaktualizovala. Pomohlo jedin smazn cache souboru nebo vynucen obnoven pkazem ddclient -force. - otestuj funknost pkazy ddclient -force nebo ddclient -query -verbose
- pihla se na DNSdynamic a zkontroluj svou IP adresu, jestli odpovd dle ifconfig
Instalace a nastaven OpenVPN serveru
U dve jsem si kal, e nhodn pipojovn pes rzn pochybn Wi-Finy ve mst i v zahrani a pihlaovn se skrz n na sv ty nen zrovna nejbezpenj. Komunikaci si me odposlechnout kde kdo - majitel Wi-Fi hotspotu (nebo ten, kdo ho hacknul), jeho ISP, i njak muchal sedc pobl. Nkte vtiplci se dokonce bav tm, e spust na mst, kde se vyskytuje hodn lid, vlastn free Wi-Fi hotspot prv za elem sbru dat. Zajmav je t popis, jak pomoc VPN zachytvat a deifrovat HTTPS komunikaci. Napadlo m tedy zkusit si rozbhnout vlastn VPNku a malina se k tomu se svou malou spotebou docela hod. Android standardn podporuje VPN protokoly PPTP (u nen bezpen) a L2TP. J jsem zvolil OpenVPN, pro n je teba na Androidu nainstalovat klientskou aplikaci. Vychzel jsem z tchto tutoril: Building A Raspberry Pi VPN pt.1, 2 a Set up a Hardened OpenVPN Server on Debian 8 pt.1, 2 3 a aplikoval je na Raspbian-Jessie. Podobn postup by el pout i na chytej routery s Linuxem.- nainstaluj openvpn: apt-get install openvpn
- zkopruj vechny soubory z /usr/share/easy-rsa do /etc/openvpn/easy-rsa
- v souboru /etc/openvpn/easy-rsa/vars nastav promnn:
export EASY_RSA="/etc/openvpn/easy-rsa"
export KEY_SIZE=1024
- vygeneruj CA certifikt a Root CA certifikt:
cd /etc/openvpn/easy-rsa
source ./vars
./clean-all
./build-ca
a vypl identifikan daje do certifiktu (nepovinn) - vygeneruj serverov kl:
./build-key-server servername
poloka Common Name mus bt shodn se jmnem serveru servername
poloka A challenge password mus bt przdn
na dotaz "Sign the certificate? [y/n]" odpovz "y"
na dotaz "1 out of 1 certificate requests certified, commit? [y/n]" odpovz "y"
- vygeneruj klientsk kl:
./build-key-pass clientname
na dotaz "Enter PEM pass phrase" zadej uivatelsk heslo, kterm se bude pihlaovat do VPN (zopakuj dvakrt po sob)
poloka A challenge password mus bt przdn
na dotaz "Sign the certificate? [y/n]" odpovz "y"
na dotaz "1 out of 1 certificate requests certified, commit? [y/n]" odpovz "y"
zopakuj pp. tento postup pro dal klienty
- zaifruj klientsk kl algoritmem Triple DES:
cd cd /etc/openvpn/easy-rsa/keys
openssl rsa -in clientname.key -des3 -out clientname.3des.key
na dotaz "Enter pass phrase for clientname.key" zadej uivatelsk heslo zadan v pedchozm kroku
na dotaz "Enter PEM pass phrase" zadej uivatelsk heslo zadan v pedchozm kroku (zopakuj dvakrt po sob)
zopakuj pp. tento postup pro dal klienty
- vygeneruj Diffie-Hellman key exchange:
cd /etc/openvpn/easy-rsa
./build-dh
(na Raspberry Pi 1 to trv asi minutu pro dlku kle 1024 bit)
- vygeneruj statick HMAC
pro obranu OpenVPN proti ppadnm DoS tokm
a skenovn port:
openvpn --genkey --secret keys/ta.key
(pokud klient nezahj pihlaovac fzi sprvnm klem, bude server veker neplatn pakety zahazovat)
- vytvo konfiguran soubor /etc/openvpn/server.conf a uprav zvraznn daje:
dev tun proto udp #Some people prefer to use tcp. Don't change it if you don't know. port 1194 ca /etc/openvpn/easy-rsa/keys/ca.crt cert /etc/openvpn/easy-rsa/keys/servername.crt # SWAP WITH YOUR CRT NAME key /etc/openvpn/easy-rsa/keys/servername.key # SWAP WITH YOUR KEY NAME dh /etc/openvpn/easy-rsa/keys/dh1024.pem # If you changed to 2048, change that here! server 10.8.0.0 255.255.255.0 # server and remote endpoints ifconfig 10.8.0.1 10.8.0.2 # Add route to Client routing table for the OpenVPN Server #push "route 10.8.0.1 255.255.255.255" # Add route to Client routing table for the OpenVPN Subnet #push "route 10.8.0.0 255.255.255.0" # your local subnet #push "route 89.212.77.131 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS # Use Google DNS push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 8.8.4.4" # Override the Client default gateway by using 0.0.0.0/1 and # 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of # overriding but not wiping out the original default gateway. push "redirect-gateway def1" client-to-client duplicate-cn # keepalive sends ping-like messages between server and client keepalive 10 120 # use tls-auth key : 0=server, 1=client tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0 cipher AES-128-CBC comp-lzo user nobody group nogroup persist-key persist-tun status /var/log/openvpn-status.log 20 log /var/log/openvpn.log verb 1
- zapni IP forwarding:
v souboru /etc/sysctl.conf najdi a odkomentuj tento dek:
net.ipv4.ip+forward=1
aplikuj zmnu pkazem sysctl -p - spus OpenVPN server:
service openvpn start
zkontroluj log soubor /var/log/openvpn.log
OpenVPN 2.3.4 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jan 23 2016 library versions: OpenSSL 1.0.1t 3 May 2016, LZO 2.08 Control Channel Authentication: using '/etc/openvpn/easy-rsa/keys/ta.key' as a OpenVPN static key file TUN/TAP device tun0 opened do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 /sbin/ip link set dev tun0 up mtu 1500 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2 GID set to nogroup UID set to nobody UDPv4 link local (bound): [undef] UDPv4 link remote: [undef] Initialization Sequence Completed
zkontroluj vpis otevench port, jestli openvpn b sprvn na UDP portu 1194 pkazem netstat -tulpna
Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 449/sshd tcp6 0 0 :::22 :::* LISTEN 449/sshd udp 0 0 0.0.0.0:1194 0.0.0.0:* 408/openvpn udp 0 0 0.0.0.0:5353 0.0.0.0:* 371/avahi-daemon: r udp 0 0 0.0.0.0:68 0.0.0.0:* 377/dhcpcd udp 0 0 0.0.0.0:60275 0.0.0.0:* 371/avahi-daemon: r udp 0 0 89.187.24.113:123 0.0.0.0:* 486/ntpd udp 0 0 10.8.0.1:123 0.0.0.0:* 486/ntpd udp 0 0 127.0.0.1:123 0.0.0.0:* 486/ntpd udp 0 0 0.0.0.0:123 0.0.0.0:* 486/ntpd udp6 0 0 :::45256 :::* 371/avahi-daemon: r udp6 0 0 :::5353 :::* 371/avahi-daemon: r udp6 0 0 fe70::ca3:fab6:f014:123 :::* 486/ntpd udp6 0 0 ::1:123 :::* 486/ntpd udp6 0 0 :::123 :::* 486/ntpd
nebo pkazem lsof -i
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME avahi-dae 371 avahi 12u IPv4 8309 0t0 UDP *:mdns avahi-dae 371 avahi 13u IPv6 8310 0t0 UDP *:mdns avahi-dae 371 avahi 14u IPv4 8311 0t0 UDP *:60275 avahi-dae 371 avahi 15u IPv6 8312 0t0 UDP *:45256 dhcpcd 377 root 8u IPv4 9072 0t0 UDP *:bootpc openvpn 408 nobody 4u IPv4 8233 0t0 UDP *:openvpn sshd 449 root 3u IPv4 8703 0t0 TCP *:ssh (LISTEN) sshd 449 root 4u IPv6 8713 0t0 TCP *:ssh (LISTEN) ntpd 486 ntp 16u IPv4 8749 0t0 UDP *:ntp ntpd 486 ntp 17u IPv6 8750 0t0 UDP *:ntp ntpd 486 ntp 18u IPv4 8847 0t0 UDP localhost:ntp ntpd 486 ntp 19u IPv4 8848 0t0 UDP 10.8.0.1:ntp ntpd 486 ntp 20u IPv6 8849 0t0 UDP localhost:ntp ntpd 486 ntp 22u IPv6 9093 0t0 UDP [fe80::ba3:fbe8:f121:97d3]:ntp ntpd 486 ntp 23u IPv4 9199 0t0 UDP ip-xxx.cz:ntp
- nastav automatick sputn openvpn serveru pi startu systmu: update-rc.d openvpn defaults
- nainstaluj perzistentn iptables: apt-get install iptables-persistent
- pidej pravidlo pro NAT routovn: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
- ulo trval nastaven pravidel iptables: iptables-save >/etc/iptables/rules.v4
- restartuj systm, ve vpisech pi startu by se ml objevit dek: [OK] Started OpenVPN service.
- zkontroluj, jestli se naetla pravidla iptables: iptables-save
- zkontroluj, jestli se objevil nov virtuln sov adaptr tun0 ve vpisu ifconfig
- uiten pkazy pro ladn sovin (pedpokld instalaci utilit tcpdump
a netcat):
low-level dump UDP paketu: tcpdump -i eth0 -nvvv udp port 1194
odesln UDP paketu: echo "Ahoj" | nc -u xx.xx.xx.xx 1194
pjem a vpis obsahu UDP paketu: nc -ulp 1194
Instalace a nastaven klienta OpenVPN Connect pro Android
Nejprve si vytvome OpenVPN profil v unifikovanm formtu - jedin, snadno penositeln soubor, kter obsahuje vechny potebn certifikty a kle (soubory: ca.crt, clientname.crt, clientname.3des.key a ta.key, kter jsme si vytvoili v postupu ve).- zkopruj si nkam soubor /usr/share/doc/openvpn/examples/sample-config-files/client.conf,
pejmenuj ho na client.ovpn a uprav zvraznn daje. Zejmna nezapome
pidat dek key-direction 1, kter uruje smr TLS autentizace (v naem
ppad klient). V pvodnm pkladu konfigurku mla tento vznam 1 za
nzvem souboru ta.key, ale tm, e jsem dek zakomentoval, tak klient tuto
dleitou informaci nedostal. Pak jsem dlouho nemohl pijt na to, pro mi od klienta na server pichzely
42B UDP pakety, ale server neodpovdal. Pitom server dlal to, co ml - pakety s neplatnm HMAC zahazoval
(pi pouit UDP protokolu, nelze takto nastaven VPN server odhalit skenovnm port).
############################################## # Sample client-side OpenVPN 2.0 config file # # for connecting to multi-client server. # # # # This configuration can be used by multiple # # clients, however each client should have # # its own cert and key files. # # # # On Windows, you might want to rename this # # file so it has a .ovpn extension # ############################################## # Specify that we are a client and that we # will be pulling certain config file directives # from the server. client # Use the same setting as you are using on # the server. # On most systems, the VPN will not function # unless you partially or fully disable # the firewall for the TUN/TAP interface. ;dev tap dev tun # Windows needs the TAP-Win32 adapter name # from the Network Connections panel # if you have more than one. On XP SP2, # you may need to disable the firewall # for the TAP adapter. ;dev-node MyTap # Are we connecting to a TCP or # UDP server? Use the same setting as # on the server. ;proto tcp proto udp # The hostname/IP and port of the server. # You can have multiple remote entries # to load balance between the servers. remote userdomain.dnsd.info 1194 # Keep trying indefinitely to resolve the # host name of the OpenVPN server. Very useful # on machines which are not permanently connected # to the internet such as laptops. resolv-retry infinite # Most clients don't need to bind to # a specific local port number. nobind # Downgrade privileges after initialization (non-Windows only) user nobody group nobody # Try to preserve some state across restarts. persist-key persist-tun # If you are connecting through an # HTTP proxy to reach the actual OpenVPN # server, put the proxy server/IP and # port number here. See the man page # if your proxy server requires # authentication. ;http-proxy-retry # retry on connection failures ;http-proxy [proxy server] [proxy port #] # Wireless networks often produce a lot # of duplicate packets. Set this flag # to silence duplicate packet warnings. ;mute-replay-warnings # SSL/TLS parms. # See the server config file for more # description. It's best to use # a separate .crt/.key file pair # for each client. A single ca # file can be used for all clients. ;ca ca.crt ;cert client.crt ;key client.key <ca> -----BEGIN CERTIFICATE----- zde vlo cel obsah souboru ca.crt -----END CERTIFICATE----- </ca> <cert> -----BEGIN CERTIFICATE----- zde vlo obsah z konece souboru clientname.crt -----END CERTIFICATE----- </cert> <key> -----BEGIN RSA PRIVATE KEY----- zde vlo cel obsah souboru clientname.3des.key -----END RSA PRIVATE KEY----- </key> # Verify server certificate by checking that the # certicate has the correct key usage set. # This is an important precaution to protect against # a potential attack discussed here: # http://openvpn.net/howto.html#mitm # # To use this feature, you will need to generate # your server certificates with the keyUsage set to # digitalSignature, keyEncipherment # and the extendedKeyUsage to # serverAuth # EasyRSA can do this for you. # Options: server|client remote-cert-tls server # If a tls-auth key is used on the server # then every client must also have the key. # 0=server, 1=client ;tls-auth ta.key 1 key-direction 1 <tls-auth> -----BEGIN OpenVPN Static key V1----- zde vlo obsah souboru ta.key -----END OpenVPN Static key V1----- </tls-auth> # Select a cryptographic cipher. # If the cipher option is used on the server # then you must also specify it here. cipher AES-128-CBC # Enable compression on the VPN link. # Don't enable this unless it is also # enabled in the server config file. comp-lzo # Set log file verbosity. verb 3 # Silence repeating messages ;mute 20 # The keepalive directive causes ping-like # messages to be sent back and forth over # the link so that each side knows when # the other side has gone down. # Ping every 10 seconds, assume that remote # peer is down if no ping received during # a 120 second time period. keepalive 10 120
- na telefon nainstaluj android aplikaci OpenVPN Connect
- nahraj soubor client.ovpn do telefonu
- ve sprvci soubor najdi soubor client.ovpn, ukni na nj a naimportuj ho do aplikace OpenVPN Connect
- zadej uivatelsk heslo, zadan pi generovn kle a ukni na tlatko "Connect".
Po chvilce pipojovn by se v okn "Connection stats" mly zat inkrementovat potadla "Bytes in" a "Bytes out" a bhem dal vteinky by mlo dojt k navzn spojen. Ve stavov lit se objev ikonka klku a od tto chvle by mly vechny android aplikace komunikovat skrze VPNku. To si lze ovit i na stran serveru teba pomoc tcpdump, kde by ml bt poznat zven traffic v okamiku naten njak webov strnky na telefonu.
 |