Différences

Ci-dessous, les différences entre deux révisions de la page.

--- auto-hebergement [2022/11/28 00:03] – admin_elemac
+++ auto-hebergement [2023/12/13 12:25] (Version actuelle) – admin_elemac
@@ Ligne 13: / Ligne 13: @@
   * tous les [[https://fr.wikipedia.org/wiki/Domaine_de_premier_niveau|tld]] ont [[https://www.iana.org/domains/root/db|un sens]] et participent à l'identité du domaine. **.edu**(cation), **.com**(mercial), **.t**(u)**v**(alu), **.**(british )**i**(ndian )**o**(cean territory)
   * la vente de noms de domaine n'ayant pas de limite, c'est une [[https://www.capital.fr/economie-politique/comment-tuvalu-a-fait-fortune-avec-lextension-web-tv-1358864|source importante de revenus]] pour certains pays
-===== Prendre un VPN =====
+===== Option 1 Prendre un VPN "classique"=====
 ==== Introduction ====
@@ Ligne 76: / Ligne 76: @@
 sudo chmod 644 /etc/openvpn/client/ta.key</code>
+===== option 2 VPN sur un VPS =====
+==== Introduction ====
+L'intérêt est de passer par wireguard, beaucoup plus efficace qu'openvpn, et améliorer les débits.
+Également permettre un accès pour le la collaboration distante (DaVinci Resolve par exemple)
+Un tuto pour configurer le VPN sur le VPS
+https://forum.yunohost.org/t/homemade-wireguard-vpn-on-a-vps-server/15662/74?page=4
+En cas de soucis accès internet avec tunnel wireguard
+https://www.reddit.com/r/WireGuard/comments/tr1tq7/client_has_no_internet_access_while_connected_to/
+==== Config WG sur VPS ====
+installer debian 11
+installer WG
+fichier /etc/wireguard/wg0.conf :
+<code>
+[Interface]
+Address = 10.66.66.1/24,fd42:42:42::1/64
+ListenPort = 51820
+PrivateKey = ******
+PostUp = bash /etc/wireguard/PostUp.sh
+PostDown = bash /etc/wireguard/PostDown.sh
+#PostUp = iptables -I INPUT -p udp --dport 51820 -j ACCEPT
+#PostUp = iptables -I FORWARD -i ens6 -o wg0 -j ACCEPT
+#PostUp = iptables -I FORWARD -i wg0 -j ACCEPT
+#PostUp = iptables -t nat -A POSTROUTING -o ens6 -j MASQUERADE
+#PostUp = ip6tables -I FORWARD -i wg0 -j ACCEPT
+#PostUp = ip6tables -t nat -A POSTROUTING -o ens6 -j MASQUERADE
+#PostDown = iptables -D INPUT -p udp --dport 51820 -j ACCEPT
+#PostDown = iptables -D FORWARD -i ens6 -o wg0 -j ACCEPT
+#PostDown = iptables -D FORWARD -i wg0 -j ACCEPT
+#PostDown = iptables -t nat -D POSTROUTING -o ens6 -j MASQUERADE
+#PostDown = ip6tables -D FORWARD -i wg0 -j ACCEPT
+#PostDown = ip6tables -t nat -D POSTROUTING -o ens6 -j MASQUERADE
+### Client yunohost
+[Peer]
+PublicKey = ******
+PresharedKey = ******
+AllowedIPs = 10.66.66.2/32,fd42:42:42::2/128
+</code>
+Fichier PostUp.sh
+<code>
+iptables -A FORWARD -i wg0 -j ACCEPT;
+iptables -t nat -A POSTROUTING -o ens6 -j MASQUERADE;
+#ip6tables -A FORWARD -i wg0 -j ACCEPT;
+#ip6tables -t nat -A POSTROUTING -o ens6 -j MASQUERADE;
+# icmp
+iptables -A INPUT -p icmp -j ACCEPT;
+#ip6tables -A INPUT -p ipv6-icmp -j ACCEPT;
+# Routing TCP port 25 and 587 from Yunohost Server to internet
+for j in 25 587
+do
+	iptables -t nat -A POSTROUTING -s 10.66.66.2 -p tcp --dport $j -j SNAT --to 217.160.99.43;
+	iptables -A FORWARD -s 10.66.66.2 -p tcp --dport $j -j ACCEPT;
+	#ip6tables -t nat -A POSTROUTING -s fd42:42:42::2 -p tcp --dport $j -j SNAT --to [insert public IPV6 of the VPS];
+	#ip6tables -A FORWARD -s fd42:42:42::2 -p tcp --dport $j -j ACCEPT;
+done
+# Routing TCP port required from VPN server to Yunohost server
+for i in 25 53 80 140 443 587 993 1194 1195 1935 5222 5269 5432 5665 8099 8443 8447 50059 51820
+do
+	iptables -t nat -A PREROUTING -i ens6 -p tcp --dport $i -j DNAT --to-destination 10.66.66.2;
+	iptables -A FORWARD -d 10.66.66.2 -p tcp --dport $i -j ACCEPT;
+	#ip6tables -t nat -A PREROUTING -i ens6 -p tcp --dport $i -j DNAT --to-destination fd42:42:42::2;
+	#ip6tables -A FORWARD -d fd42:42:42::2 -p tcp --dport $i -j ACCEPT;
+done
+# Routing UDP port required from VPN server to Yunohost server
+iptables -A PREROUTING -t nat -i ens6 -p udp --dport 8099 -j DNAT --to-destination 10.66.66.2
+# Save and quit (CTRL+O, CTRL+X)
+</code>
+==== Config client WG sur Yunohost ====
+/opt/yunohost/wireguard_client/vps.conf :
+<code>[Interface]
+PrivateKey = ******
+Address = 10.66.66.2/32,fd42:42:42::2/128
+DNS = 1.1.1.1,1.0.0.1
+PostUp = bash /opt/yunohost/wireguard_client/PostUp.sh
+PostDown = bash /opt/yunohost/wireguard_client/PostDown.sh
+[Peer]
+PublicKey = *****
+PresharedKey = ******
+Endpoint = ***.**.**.**:51820
+AllowedIPs = 0.0.0.0/0,::/0
+PersistentKeepalive = 25
+</code>
+Le fichier PostUp.sh
+<code># PostUp.sh
+#Begin IPV4
+iptables -w -N vpnclient_in;
+iptables -w -N vpnclient_out;
+iptables -w -N vpnclient_fwd;
+iptables -w -A vpnclient_in -p icmp -j ACCEPT;
+iptables -w -A vpnclient_in -s 10.66.66.2/24 -j ACCEPT;
+#Allowing required TCP ports
+for i in 25 53 80 140 443 587 993 1194 1195 1935 5222 5269 5462 5665 51820
+do
+iptables -w -A vpnclient_in -p tcp --dport $i -j ACCEPT;
+done
+iptables -w -A vpnclient_in -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT;
+iptables -w -A vpnclient_in -j DROP;
+iptables -w -A vpnclient_out -j ACCEPT;
+iptables -w -A vpnclient_fwd -j DROP;
+iptables -w -I INPUT 1 -i wg0 -j vpnclient_in;
+iptables -w -I OUTPUT 1 -o wg0 -j vpnclient_out;
+iptables -w -I FORWARD 1 -o  wg0 -j vpnclient_fwd;
+#End IPV4
+#Begin IPV6
+#ip6tables -w -N vpnclient_in;
+#ip6tables -w -N vpnclient_out;
+#ip6tables -w -N vpnclient_fwd;
+#ip6tables -w -A vpnclient_in -p ipv6-icmp -j ACCEPT;
+#ip6tables -w -A vpnclient_in -s fd42:42:42::2/64 -j ACCEPT;
+#Allowing required TCP ports
+#for i in 25 80 140 443 587 993 5222 5269
+#do
+#	ip6tables -w -A vpnclient_in -p tcp --dport $i -j ACCEPT;
+#done
+#ip6tables -w -A vpnclient_in -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT;
+#ip6tables -w -A vpnclient_in -j DROP;
+#ip6tables -w -A vpnclient_out -j ACCEPT;
+#ip6tables -w -A vpnclient_fwd -j DROP;
+#ip6tables -w -I INPUT 1 -i wg0 -j vpnclient_in;
+#ip6tables -w -I OUTPUT 1 -o wg0 -j vpnclient_out;
+#ip6tables -w -I FORWARD 1 -o  wg0 -j vpnclient_fwd;
+#End IPV6
+# Save and quit (CTRL+O, CTRL+X)
+</code>
+Le fichier PostDown.sh :
+<code># PostDown.sh
+#Begin IPV4
+iptables -w -F vpnclient_in;
+iptables -w -F vpnclient_out;
+iptables -w -F vpnclient_fwd;
+iptables -D INPUT -i wg0 -j vpnclient_in;
+iptables -D FORWARD -o wg0 -j vpnclient_fwd;
+iptables -D OUTPUT -o wg0 -j vpnclient_out;
+iptables -w -X vpnclient_in;
+iptables -w -X vpnclient_out;
+iptables -w -X vpnclient_fwd;
+#End IPV4
+#Begin IPV6
+#ip6tables -w -F vpnclient_in;
+#ip6tables -w -F vpnclient_out;
+#ip6tables -w -F vpnclient_fwd;
+#ip6tables -D INPUT -i wg0 -j vpnclient_in;
+#ip6tables -D FORWARD -o wg0 -j vpnclient_fwd;
+#ip6tables -D OUTPUT -o wg0 -j vpnclient_out;
+#ip6tables -w -X vpnclient_in;
+#ip6tables -w -X vpnclient_out;
+#ip6tables -w -X vpnclient_fwd;
+#End IPV6
+# Save and quit (CTRL+O, CTRL+X)
+</code>
 ===== Trouver une machine =====
@@ Ligne 109: / Ligne 302: @@
 sudo su
 app=flarum
 cd /var/www/$app
 sudo -u $app php7.4 composer.phar require vendor/extension