apt-get install openvpn 

mkdir /etc/openvpn/vpnkeys  

touch /etc/openvpn/server.conf

touch /etc/openvpn/ipp.txt

mkdir /var/log/openvpn

# Порт на котором сервер работает, протокол и тип интерфейса 
port 1194
proto udp
dev tun
#Место храннения ключей и сертификатов
ca /etc/openvpn/vpnkeys/ca.crt
cert /etc/openvpn/vpnkeys/server.crt
key /etc/openvpn/vpnkeys/server.key # Данный фаил хранить в боольшом секрете!!!!
dh /etc/openvpn/vpnkeys/dh1024.pem
# включаем TLS аутификацию
tls-server
# указываем tls-ключ, и указываем 0 для сервера(1 ставиться для клиента).
tls-auth "/etc/openvpn/vpnkeys/ta.key" 0
# время до переподключения 
tls-timeout 120
auth MD5
#Пул выдаваемых клиентам адресов
server 10.10.10.0 255.255.255.0
#Сюда будем писать какее адреса сервер выдал клиенту
ifconfig-pool-persist "/etc/openvpn/ipp.txt"
#Задаем МАРШРУТ, который передаём клиенту и маску подсети для того чтобы он #"видел" сеть за OpenVPN сервером (сеть 192.168.124.0/24)
push "route 192.168.124.0 255.255.255.0"
# DNS-сервер внутренней сети. Если поднят «настоящий» локальный DNS, тогда
# при установленном vpn-соединении, если подключаться например по Microsoft RDP
# достаточно набрать имя компьютера а не вбивать его ip-шник
push "dhcp-option DNS 192.168.124.1"
# Удерживать установленное соединение(если есть nat или прокся)
keepalive 10 120
# Включаем шифрацию пакетов
cipher BF-CBC
# Включить сжатие
comp-lzo
# Максимум число клиентов
max-clients 6
#Прописываем пользователя и группу, от имени которых будет запускаться VPN:
user nobody
group nogroup
# Не перечитывать ключи после получения
# SIGUSR1 или ping-restart
persist-key
# Не закрывать и переоткрывать TUN\TAP
# устройство, после получения
# SIGUSR1 или ping-restart
persist-tun
# Даём возможность клиентам "видеть" друг друга(не пробовал работает ли это)
client-to-client
# Логи сервера
status "/var/log/openvpn/openvpn-status.log"
log "/var/log/openvpn/openvpn.log"
log-append "/var/log/openvpn/openvpn.log"
# Уровень детализации в логах
verb 3

cd /usr/share/doc/openvpn/examples/easy-rsa/2.0

bash

. ./vars

./clean-all

./build-ca

./build-key-server server

./build-dh

./build-key vova

./build-key masha

openvpn --genkey --secret ta.key

/etc/init.d/openvpn restart

iptables -I FORWARD 1 -i eth1 -o tun0 -j ACCEPT
iptables -I FORWARD 1 -o eth1 -i tun0 -j ACCEPT

client
dev tun
proto udp
#Адрес и порт нашего сервера
remote 333.222.111.123 1194
resolv-retry infinite # Говорят, нужен если пользуешся службой DynDNS
nobind
persist-key
persist-tun
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\vova.crt"
key "C:\\Program Files\\OpenVPN\\config\\vova.key"
tls-client
tls-auth "C:\\Program Files\\OpenVPN\\config\\ta.key" 1
auth MD5
ns-cert-type server
comp-lzo
verb 3

remote 333.222.111.123 1194
client
dev tun
proto udp
resolv-retry infinite 
nobind
user nobody
group nogroup
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/client/masha.crt
key /etc/openvpn/client/masha.key
tls-client
tls-auth /etc/openvpn/client/ta.key 1
auth MD5
comp-lzo
verb 4
mute 20

Chain INPUT (policy DROP)
target     prot opt source               destination        
SSHBRUT    tcp  --  anywhere             anywhere            tcp dpt:rockwell-csp2 state NEW recent: UPDATE seconds: 900 hit_count: 2 name: DEFAULT side: source
SSHCONNECT  tcp  --  anywhere             anywhere            tcp dpt:rockwell-csp2 state NEW recent: SET name: DEFAULT side: source
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:rockwell-csp2
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            state ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            state RELATED
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ftp
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:smtp
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:nicname
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:domain
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:pop3
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:imap
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:rmt
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:xinuexpansion3
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:6843
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:openvpn
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:pptp
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:sip
ACCEPT     tcp  --  anywhere             anywhere            tcp dpts:ndmp:dnp
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:5900
ACCEPT     tcp  --  anywhere             anywhere            tcp dpts:5900:5906
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:tproxy
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:oms
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:6883
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:51413
ACCEPT     udp  --  anywhere             anywhere            udp dpts:avt-profile-1:5082
ACCEPT     udp  --  anywhere             anywhere            udp dpts:ndmp:dnp
bad_tcp_packets  tcp  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     udp  --  anywhere             anywhere            state NEW
ACCEPT     icmp --  192.168.0.0/21       anywhere            
icmp_packets  icmp --  anywhere             anywhere            
tcp_packets  tcp  --  192.168.0.0/21       anywhere            
DROP       tcp  --  anywhere             anywhere            
udp_packets  udp  --  192.168.0.0/21       anywhere            
DROP       udp  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
LOG        tcp  --  anywhere             anywhere            tcp flags:RST/RST,ACK limit: avg 5/min burst 5 LOG level notice prefix `SYN/RST'
DROP       tcp  --  anywhere             anywhere            tcp flags:RST/RST,ACK
ACCEPT     tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,ACK/SYN limit: avg 1/sec burst 5
ACCEPT     tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,ACK/RST limit: avg 1/sec burst 5
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request limit: avg 1/sec burst 5

Chain FORWARD (policy DROP)
target     prot opt source               destination        
DROP       tcp  --  192.168.0.0/21       anywhere            tcp dpt:smtp
bad_tcp_packets  tcp  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination        
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     udp  --  anywhere             anywhere            state NEW
ACCEPT     all  --  anywhere             anywhere            

Chain SSHBRUT (1 references)
target     prot opt source               destination        
LOG        all  --  anywhere             anywhere            LOG level debug prefix `BROUTFORCE:'
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable

Chain SSHCONNECT (1 references)
target     prot opt source               destination        
LOG        all  --  anywhere             anywhere            LOG level debug prefix `SSHINCON:'

Chain bad_tcp_packets (2 references)
target     prot opt source               destination        
REJECT     tcp  --  anywhere             anywhere            tcp flags:SYN,ACK/SYN,ACK state NEW reject-with tcp-reset

Chain icmp_packets (1 references)
target     prot opt source               destination        
ACCEPT     icmp --  anywhere             anywhere            icmp destination-unreachable
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request
ACCEPT     icmp --  anywhere             anywhere            icmp time-exceeded
DROP       icmp --  anywhere             anywhere            

Chain tcp_packets (1 references)
target     prot opt source               destination        
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ftp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:smtp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:nicname
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:domain
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pop3
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:imap
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:rmt
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:xinuexpansion3
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:6843
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:openvpn
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pptp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:sip
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:5900
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:tproxy
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:oms
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:6883
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:51413
DROP       tcp  --  anywhere             anywhere            

Chain udp_packets (1 references)
target     prot opt source               destination        
ACCEPT     udp  --  anywhere             anywhere            udp dpt:domain
ACCEPT     udp  --  anywhere             anywhere            udp dpt:openvpn
ACCEPT     udp  --  anywhere             anywhere            udp dpt:61194
ACCEPT     udp  --  anywhere             anywhere            udp dpt:oms
ACCEPT     udp  --  anywhere             anywhere            udp dpt:rfa
ACCEPT     udp  --  anywhere             anywhere            udp dpt:6357
ACCEPT     udp  --  anywhere             anywhere            udp dpt:6883
DROP       udp  --  anywhere             anywhere

iptables-save -c
# Generated by iptables-save v1.3.5 on Mon Apr 11 21:16:49 2011
*nat
:PREROUTING ACCEPT [1540:116718]
:POSTROUTING ACCEPT [269:22596]
:OUTPUT ACCEPT [426:34625]
[562:54798] -A POSTROUTING -o eth0 -j MASQUERADE
[0:0] -A POSTROUTING -o eth2 -j MASQUERADE
[0:0] -A POSTROUTING -o tap0 -j MASQUERADE
[0:0] -A POSTROUTING -o eth1 -j MASQUERADE
COMMIT
# Completed on Mon Apr 11 21:16:49 2011
# Generated by iptables-save v1.3.5 on Mon Apr 11 21:16:49 2011
*mangle
:PREROUTING ACCEPT [11675:1338448]
:INPUT ACCEPT [5186887:677115381]
:FORWARD ACCEPT [14753770:6540821193]
:OUTPUT ACCEPT [11642:3349715]
:POSTROUTING ACCEPT [2942734:1776353641]
COMMIT
# Completed on Mon Apr 11 21:16:49 2011
# Generated by iptables-save v1.3.5 on Mon Apr 11 21:16:49 2011
*filter
:INPUT DROP [0:0]
:FORWARD DROP [1:40]
:OUTPUT ACCEPT [89:32574]
:SSHBRUT - [0:0]
:SSHCONNECT - [0:0]
:bad_tcp_packets - [0:0]
:icmp_packets - [0:0]
:tcp_packets - [0:0]
:udp_packets - [0:0]
[0:0] -A INPUT -i eth0 -p tcp -m tcp --dport 2222 -m state --state NEW -m recent --update --seconds 900 --hitcount 2 --name DEFAULT --rsource -j SSHBRUT
[1:60] -A INPUT -i eth0 -p tcp -m tcp --dport 2222 -m state --state NEW -m recent --set --name DEFAULT --rsource -j SSHCONNECT
[668:50789] -A INPUT -i eth0 -p tcp -m tcp --dport 2222 -j ACCEPT
[587:48524] -A INPUT -i lo -j ACCEPT
[6873:793525] -A INPUT -m state --state ESTABLISHED -j ACCEPT
[1:70] -A INPUT -m state --state RELATED -j ACCEPT
[1:60] -A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 43 -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 110 -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 143 -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 411 -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 2023 -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 6843 -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 1194 -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 1723 -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 5060 -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m tcp --dport 10000:20000 -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 5900 -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m tcp --dport 5900:5906 -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 8081 -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 4662 -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 6883 -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 51413 -j ACCEPT
[0:0] -A INPUT -i eth0 -p udp -m udp --dport 5004:5082 -j ACCEPT
[0:0] -A INPUT -i eth0 -p udp -m udp --dport 10000:20000 -j ACCEPT
[614:29488] -A INPUT -p tcp -j bad_tcp_packets
[0:0] -A INPUT -i lo -j ACCEPT
[0:0] -A INPUT -i lo -j ACCEPT
[915:72640] -A INPUT -i eth1 -j ACCEPT
[0:0] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A INPUT -p udp -m state --state NEW -j ACCEPT
[0:0] -A INPUT -s 192.168.0.0/255.255.248.0 -i eth1 -p icmp -j ACCEPT
[2:122] -A INPUT -i eth0 -p icmp -j icmp_packets
[0:0] -A INPUT -s 192.168.0.0/255.255.248.0 -i eth1 -p tcp -j tcp_packets
[5:232] -A INPUT -i eth0 -p tcp -j DROP
[0:0] -A INPUT -s 192.168.0.0/255.255.248.0 -i eth1 -p udp -j udp_packets
[0:0] -A INPUT -i eth0 -p udp -j DROP
[0:0] -A INPUT -i tap+ -j ACCEPT
[0:0] -A INPUT -i eth0 -p tcp -m tcp --tcp-flags RST RST,ACK -m limit --limit 5/min -j LOG --log-prefix "SYN/RST" --log-level 5
[0:0] -A INPUT -i eth0 -p tcp -m tcp --tcp-flags RST RST,ACK -j DROP
[49:2376] -A INPUT -i ! eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 1/sec -j ACCEPT
[0:0] -A INPUT -i ! eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec -j ACCEPT
[0:0] -A INPUT -i ! eth0 -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j ACCEPT
[0:0] -A FORWARD -s 192.168.0.0/255.255.248.0 -i eth0 -p tcp -m tcp --dport 25 -j DROP
[1353:237658] -A FORWARD -p tcp -j bad_tcp_packets
[1249:118134] -A FORWARD -i eth1 -j ACCEPT
[1078:244847] -A FORWARD -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -o tap+ -j ACCEPT
[0:0] -A FORWARD -i tap+ -j ACCEPT
[0:0] -A FORWARD -o tun+ -j ACCEPT
[0:0] -A FORWARD -i tun+ -j ACCEPT
[587:48524] -A OUTPUT -o lo -j ACCEPT
[5561:2502092] -A OUTPUT -o eth1 -j ACCEPT
[5316:760208] -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
[89:6317] -A OUTPUT -p udp -m state --state NEW -j ACCEPT
[0:0] -A OUTPUT -o tap+ -j ACCEPT
[0:0] -A SSHBRUT -j LOG --log-prefix "BROUTFORCE:" --log-level 7
[0:0] -A SSHBRUT -j REJECT --reject-with icmp-port-unreachable
[1:60] -A SSHCONNECT -j LOG --log-prefix "SSHINCON:" --log-level 7
[0:0] -A bad_tcp_packets -p tcp -m tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
[0:0] -A icmp_packets -p icmp -m icmp --icmp-type 3 -j ACCEPT
[2:122] -A icmp_packets -p icmp -m icmp --icmp-type 8 -j ACCEPT
[0:0] -A icmp_packets -p icmp -m icmp --icmp-type 11 -j ACCEPT
[0:0] -A icmp_packets -p icmp -j DROP
[0:0] -A tcp_packets -p tcp -m tcp --dport 21 -j ACCEPT
[0:0] -A tcp_packets -p tcp -m tcp --dport 25 -j ACCEPT
[0:0] -A tcp_packets -p tcp -m tcp --dport 43 -j ACCEPT
[0:0] -A tcp_packets -p tcp -m tcp --dport 53 -j ACCEPT
[0:0] -A tcp_packets -p tcp -m tcp --dport 80 -j ACCEPT
[0:0] -A tcp_packets -p tcp -m tcp --dport 110 -j ACCEPT
[0:0] -A tcp_packets -p tcp -m tcp --dport 143 -j ACCEPT
[0:0] -A tcp_packets -p tcp -m tcp --dport 443 -j ACCEPT
[0:0] -A tcp_packets -p tcp -m tcp --dport 411 -j ACCEPT
[0:0] -A tcp_packets -p tcp -m tcp --dport 2023 -j ACCEPT
[0:0] -A tcp_packets -p tcp -m tcp --dport 6843 -j ACCEPT
[0:0] -A tcp_packets -p tcp -m tcp --dport 1194 -j ACCEPT
[0:0] -A tcp_packets -p tcp -m tcp --dport 1723 -j ACCEPT
[0:0] -A tcp_packets -p tcp -m tcp --dport 5060 -j ACCEPT
[0:0] -A tcp_packets -p tcp -m tcp --dport 5900 -j ACCEPT
[0:0] -A tcp_packets -p tcp -m tcp --dport 8081 -j ACCEPT
[0:0] -A tcp_packets -p tcp -m tcp --dport 4662 -j ACCEPT
[0:0] -A tcp_packets -p tcp -m tcp --dport 6883 -j ACCEPT
[0:0] -A tcp_packets -p tcp -m tcp --dport 51413 -j ACCEPT
[0:0] -A tcp_packets -p tcp -j DROP
[0:0] -A udp_packets -i eth0 -p udp -m udp --dport 53 -j ACCEPT
[0:0] -A udp_packets -i eth0 -p udp -m udp --dport 1194 -j ACCEPT
[0:0] -A udp_packets -i eth0 -p udp -m udp --dport 61194 -j ACCEPT
[0:0] -A udp_packets -i eth0 -p udp -m udp --dport 4662 -j ACCEPT
[0:0] -A udp_packets -i eth0 -p udp -m udp --dport 4672 -j ACCEPT
[0:0] -A udp_packets -i eth0 -p udp -m udp --dport 6357 -j ACCEPT
[0:0] -A udp_packets -i eth0 -p udp -m udp --dport 6883 -j ACCEPT
[0:0] -A udp_packets -i eth0 -p udp -j DROP
COMMIT
# Completed on Mon Apr 11 21:16:49 2011

# Masquerade local subnet
# Masquerade local subnet
iptables -t nat -A POSTROUTING -s 10.8.1.0/24 -o eth0 -j MASQUERADE

route add -net

mode p2p
local внешний_адрес_ubuntu_client
remote внешний_адрес_ideco_главный_офис
secret /etc/openvpn/keys/openvpn.rsa.key
port 1194
proto udp
dev tun0
dev-type tun
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
ifconfig 10.10.0.1 192.168.1.254
verb 1

tcpdump: listening on tun0, link-type RAW (Raw IP), capture size 96 bytes
13:21:42.983832 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
10.10.0.1 > 192.168.1.254: ICMP echo request, id 11288, seq 1, length 64
13:21:43.991117 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)

Mon Jul 25 17:48:19 2011 SIGUSR1[soft,ping-restart] received, process restarting
Mon Jul 25 17:48:21 2011 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Mon Jul 25 17:48:21 2011 /usr/sbin/openvpn-vulnkey -q /etc/openvpn/keys/openvpn.rsa.key
Mon Jul 25 17:48:21 2011 Re-using pre-shared static key
Mon Jul 25 17:48:21 2011 LZO compression initialized
Mon Jul 25 17:48:21 2011 Preserving previous TUN/TAP instance: tun0
Mon Jul 25 17:48:21 2011 UDPv4 link local (bound): [AF_INET]85.123.32.205:1194
Mon Jul 25 17:48:21 2011 UDPv4 link remote: [AF_INET]85.234.31.26:1194
Mon Jul 25 17:50:21 2011 Inactivity timeout (--ping-restart), restarting
Mon Jul 25 17:50:21 2011 SIGUSR1[soft,ping-restart] received, process restarting
Mon Jul 25 17:50:23 2011 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Mon Jul 25 17:50:23 2011 /usr/sbin/openvpn-vulnkey -q /etc/openvpn/keys/openvpn.rsa.key
Mon Jul 25 17:50:23 2011 Re-using pre-shared static key
Mon Jul 25 17:50:23 2011 LZO compression initialized
Mon Jul 25 17:50:23 2011 Preserving previous TUN/TAP instance: tun0
Mon Jul 25 17:50:23 2011 UDPv4 link local (bound): [AF_INET]85.123.32.205:1194
Mon Jul 25 17:50:23 2011 UDPv4 link remote: [AF_INET]85.234.31.26:1194

port 1194
proto udp
dev tun
ca /etc/openvpn/vpnkeys/ca.crt
cert /etc/openvpn/vpnkeys/server.crt
key /etc/openvpn/vpnkeys/server.key
dh /etc/openvpn/vpnkeys/dh1024.pem
tls-server
tls-auth "/etc/openvpn/vpnkeys/ta.key" 0
tls-timeout 120
auth MD5
server 10.10.10.0 255.255.255.0
ifconfig-pool-persist "/etc/openvpn/ipp"
push "route 192.168.10.0 255.255.255.0"
push "route 192.168.11.0 255.255.255.0"
push "dhcp-option DNS 192.168.20.1"
keepalive 10 120
cipher BF-CBC
comp-lzo
max-clients 6
user nobody
group nobody
persist-key
persist-tun
client-to-client
status "/var/log/openvpn/openvpn-status.log"
log "/var/log/openvpn/openvpn.log"
log-append "/var/log/openvpn/openvpn.log"
verb 3

iptables -t mangle -A PREROUTING -s 10.10.10.0/24 -d 192.168.10.0/24 -j ACCEPT
iptables -t mangle -A POSTROUTING -d 10.10.10.0/24 -s 192.168.10.0/24 -j ACCEPT
iptables -t mangle -A POSTROUTING -s 10.10.10.0/24 -d 192.168.10.0/24 -j ACCEPT
iptables -t mangle -A PREROUTING -d 10.10.10.0/24 -s 192.168.10.0/24 -j ACCEPT

client
dev tun
proto udp
remote 91.ХХ.ХХХ.ХХ 1194
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/kursakovo.crt
key /etc/openvpn/kursakovo.key
tls-client
tls-auth "/etc/openvpn/ta.key" 1
auth MD5
ns-cert-type server
comp-lzo
verb 3

iptables -t mangle -A PREROUTING -s 192.168.10.0/24 -d 10.10.10.0/24 -j ACCEPT
iptables -t mangle -A POSTROUTING -d 192.168.10.0/24 -s 10.10.10.0/24 -j ACCEPT
iptables -t mangle -A POSTROUTING -s 192.168.10.0/24 -d 10.10.10.0/24 -j ACCEPT
iptables -t mangle -A PREROUTING -d 192.168.10.0/24 -s 10.10.10.0/24 -j ACCEPT

port 1194
proto udp
dev tun
ca /etc/openvpn/vpnkeys/ca.crt
cert /etc/openvpn/vpnkeys/server.crt
key /etc/openvpn/vpnkeys/server.key dh /etc/openvpn/vpnkeys/dh1024.pem
tls-server
tls-auth "/etc/openvpn/vpnkeys/ta.key" 0
tls-timeout 120
auth MD5
server 192.168.50.0 255.255.255.0
ifconfig-pool-persist "/etc/openvpn/ipp.txt"
push "route 192.168.0.0 255.255.255.255 192.168.50.0"
push redirect-gateway
push "dhcp-option DNS 192.168.0.30"
push "dhcp-option DNS 94.100.91.2" #днс провайдера
keepalive 10 120
cipher BF-CBC
comp-lzo
max-clients 6
user nobody
group nogroup
persist-key
persist-tun
client-to-client
status "/var/log/openvpn/openvpn-status.log"
log "/var/log/openvpn/openvpn.log"
log-append "/var/log/openvpn/openvpn.log"
verb 3

# Generated by iptables-save v1.4.8 on Tue May 15 12:42:51 2012
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
[30335:3941191] -A INPUT -i lo -j ACCEPT
[84146:17410495] -A INPUT -i eth0 -j NFQUEUE --queue-num 0
[35864:6610795] -A INPUT -i eth1 -j NFQUEUE --queue-num 0
[132762:15665056] -A INPUT -j ACCEPT
[0:0] -A INPUT -i lo -j ACCEPT
[0:0] -A INPUT -i eth0 -j NFQUEUE --queue-num 0
[0:0] -A INPUT -i eth1 -j NFQUEUE --queue-num 0
[0:0] -A INPUT -j ACCEPT
[0:0] -A FORWARD -p tcp -m mark --mark 0xfffd -j DROP
[0:0] -A FORWARD -p tcp -m mark --mark 0xfffe -j DROP
[0:0] -A FORWARD -p tcp -m mark --mark 0xffff -j DROP
[1:60] -A FORWARD -i eth2 -o tun0 -j ACCEPT
[0:0] -A FORWARD -i tun0 -o eth2 -j ACCEPT
[73302:62375339] -A FORWARD -j ACCEPT
[30414:3948774] -A OUTPUT -o lo -j ACCEPT
[89987:8249558] -A OUTPUT -o eth0 -j NFQUEUE --queue-num 0
[39060:3167428] -A OUTPUT -o eth1 -j NFQUEUE --queue-num 0
[84751:20828748] -A OUTPUT -j ACCEPT
[0:0] -A OUTPUT -o lo -j ACCEPT
[0:0] -A OUTPUT -o eth0 -j NFQUEUE --queue-num 0
[0:0] -A OUTPUT -o eth1 -j NFQUEUE --queue-num 0
[0:0] -A OUTPUT -j ACCEPT
COMMIT
# Completed on Tue May 15 12:42:51 2012
# Generated by iptables-save v1.4.8 on Tue May 15 12:42:51 2012
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [3407:628434]
:FORWARD ACCEPT [73303:62375399]
:OUTPUT ACCEPT [3672:1639692]
:POSTROUTING ACCEPT [0:0]
[108:12940] -A PREROUTING -i lo -j ACCEPT
[53223:60586485] -A PREROUTING -i eth0 -j ACCEPT
[0:0] -A PREROUTING -i lo -j ACCEPT
[0:0] -A PREROUTING -i eth1 -j ACCEPT
[384:24256] -A PREROUTING -d 192.168.0.30/32 -j ACCEPT
[276:19592] -A PREROUTING -d 192.168.0.35/32 -j ACCEPT
[0:0] -A PREROUTING -i lo -j ACCEPT
[25112:2730382] -A PREROUTING -j NFQUEUE --queue-num 0
[108:12940] -A POSTROUTING -o lo -j ACCEPT
[25395:3791584] -A POSTROUTING -o eth0 -j ACCEPT
[0:0] -A POSTROUTING -o lo -j ACCEPT
[64:5376] -A POSTROUTING -o eth1 -j ACCEPT
[382:79739] -A POSTROUTING -s 192.168.0.30/32 -j ACCEPT
[269:88744] -A POSTROUTING -s 192.168.0.35/32 -j ACCEPT
[0:0] -A POSTROUTING -o lo -j ACCEPT
[50745:60035930] -A POSTROUTING -j NFQUEUE --queue-num 0
COMMIT
# Completed on Tue May 15 12:42:51 2012
# Generated by iptables-save v1.4.8 on Tue May 15 12:42:51 2012
*nat
:PREROUTING ACCEPT [1923:114638]
:POSTROUTING ACCEPT [7:492]
:OUTPUT ACCEPT [1056:77863]
[0:0] -A PREROUTING -p tcp -m mark --mark 0xfffd -j REDIRECT --to-ports 80
[0:0] -A PREROUTING -p tcp -m mark --mark 0xfffe -j REDIRECT --to-ports 80
[0:0] -A PREROUTING -p tcp -m mark --mark 0xffff -j REDIRECT --to-ports 80
[2376:150776] -A POSTROUTING -o eth0 -j SNAT --to-source 95.172.43.170
[16:1344] -A POSTROUTING -o eth1 -j SNAT --to-source 192.168.10.10
COMMIT
# Completed on Tue May 15 12:42:51 2012