基于openwrt的超低廉目田猫制作

只要60！！！！！！！！！只花60你就能够无缝翻墙！！！！赶快行动吧！！！！！（仿豆瓣咆哮组）

神马翻墙猫、神马崂山路由器、还有那个神马威众山寨路由器（他们挺黑的，一个破RG100A的猫要卖360，还有一年几百的VPN费用）统统趴下

现在你只需要去淘宝购买一个RG100A-AA或者DB120路由器（如果店主不错估计已经给你刷好了openwrt中文版）成色好点一般淘宝70-80，成色差点就50-60

制作前准备：

1、RG100A-AA路由器一个

2、OPENVPN服务器或者帐号一台（推荐 rapidxen.net的VPS制作OPENVPN，不限流量，速度保证快，我北京联通24小时看u2b的480p不卡，但是由于是PR的线路，老抽 疯，抽抽就好了，最近似乎抽得比较厉害，先观望观望，一年80刀左右，20个朋友一起分担基本上完全够用，或者用我的纯公益性质一年50的 openvpn，哈哈）

3、能上网

4、OPENWRT的固件

开始：

一般在淘宝买的都刷好了openwrt.org.cn站长制作的backfire 10.03.166中文版，如果使用的这个版本可以直接跳过网络配置这一段直接到OPENVPN的配置

1、下载固件

最新的openwrt固件 Backfire 10.03.1-rc3，在下面选择openwrt-RG100A_DB120-squashfs-cfe.bin

下载地址：http://downloads.openwrt.org/backfire/10.03.1-rc3/brcm63xx/

推荐固件 openwrt.org.cn站长制作的backfire 10.03.166中文版（如果使用这个版本可直接跳过网络配置）

下载地址：http://www.openwrt.org.cn/bbs/viewthread.php?tid=737

2、更新路由器固件

如果之前就是openwrt就直接用固件更新

不是的话就用免TTL的更新方式：

关掉电源，按住RESET键开机，电脑上一直ping 192.168.1.1，直到出现TTL=100的ping值出现即可松开RESET，用浏览器打开192.168.1.1，输入用户 名：telecomadmin，密码：nE7jA%5m，然后进行升级。由于某些CFE版本不一样，还有以下用户和密码可能。

3、网络配置（刷166的可跳过）

首先要用浏览器登录192.168.1.1，点击右边的Administrator变成管理员模式，设置了Admin的密码才能启用SSH

SSH到192.168.1.1

编辑network添加VLAN

vim /etc/config/network

config interface loopback

option ifname   lo

option proto    static

option ipaddr   127.0.0.1

option netmask  255.0.0.0

 

config interface lan

option type     bridge

option ifname   eth1.0

option proto    static

option ipaddr   192.168.0.38

option netmask  255.255.255.0

option gateway 192.168.0.1

option dns 192.168.0.1

option nat      1

 

config interface wan

option ifname eth1.1

option proto dhcp

config switch eth1

option reset 1

option enable_vlan 1

 

config switch eth1

option reset 1

option enable_vlan 1

 

config switch_vlan

option device eth1

option vlan 0

option ports “1 2 3 5*”

 

config switch_vlan

option device eth1

option vlan 1

option ports “0 5*”

保存文件，重启后

这样一来，路由器的LAN1口变成了WAN口，可以用这个口连接ADSL猫或者上级路由，通过web管理设置好IP后保证能连上网。

对于无线，如果有问题可以在SSH下通过这个命令重置无线的参数，然后再通过web管理进行设置。

rm -f /etc/config/wireless; wifi detect > /etc/config/wireless

4、OPENVPN设置

确保连上网后可以进行openvpn的安装和配置，超级简单！！！！！！！

首先更新于软件源

opkg update

然后安装openvpn

opkg install openvpn

这样会附带把openvpn需要的lzo压缩库一并就安装好了

完了。。。到这儿就完了。。哈哈

其实重点还是在我之前的翻墙猫的教程中OPENVPN客户端的配置文件上

一般openvpn配置都有ca.crt user.key user.crt user.ovpn文件，我们需要把这4个文件合并成一个文件

可以参照下面的这个文件，如果不需要国内外分流全局VPN就从配置文件中去掉route那些参数

然后执行openvpn –config openvpn.conf 就可以自由翻墙了。。。。（把这个做个执行脚本放在启动里面，开机就自动翻，多爽）

等等。。。。

这里还有一个关键的设置，没有iptables的可以通过opkg install 安装

iptables -I FORWARD -o tun0 -j ACCEPT

iptables -t -nat -A POSTROUTEING -s 192.168.1.0/24 -j MASQUERADE

这个可以添加到 /etc/firewall.user里面，就不用每次都输入了，上面那个IP段是路由器下面的IP段，根据你自己设置的LAN下的情况自行更改

#OPENVPN的基本配置

client

dev tun

proto udp

remote openvpn.suoluo.org

resolv-retry infinite

nobind

persist-key

persist-tun

reneg-sec 86400

auth-user-pass suoluo #这个是用户名密码验证的参数，不需要用户密码验证的去掉这行，顺便说一下啊，suoluo就是刚才下载的那个文件，这个文件的格式很操蛋，必须要多一个回车，也就是用户一行，密码一行，最后还有一个空行才行，官方文档都没写，我都不知道自己怎么琢磨出来的

auth-retry interact

ns-cert-type server

comp-lzo

verb 3

max-routes 2000 # 这个就是设置国内外分路由的参数了，我设置的最大2000跳，其实就940多条，只不过为了以后的扩展预留。这些都是国内的IP，也就是说加了这个之后， 国内的流量就直接走，不去VPN，这样保证了国内的速度，而且降低了openvpn服务器的压力，IP地址池你也可以自己维护，我是用的http://ftp.apnic.net/apnic/dbase/data/country-ipv4.lst 的列表做的，目前是最新的。

#push_cn_routes

route 110.6.0.0 255.254.0.0 net_gateway 5

route 110.16.0.0 255.252.0.0 net_gateway 5

…….文章太长了，这里截掉的一段在这里下载 routes

route 61.232.0.0 255.252.0.0 net_gateway 5

route 61.236.0.0 255.254.0.0 net_gateway 5

route 61.240.0.0 255.252.0.0 net_gateway 5

#push_chn_route

#下面是CA证书，也就是你服务器生成的ca.crt文件内容

<ca>

—–BEGIN CERTIFICATE—–

证书内容

—–END CERTIFICATE—–

</ca>

#下面是用户证书，也就是你服务器生成的client.crt文件内容，比如我的suoluo.crt

<cert>

—–BEGIN CERTIFICATE—–

证书内容

—–END CERTIFICATE—–

</cert>

#下面是用户key，也就是你服务器生成的client.key文件内容，比如我的suoluo.key

<key>

—–BEGIN RSA PRIVATE KEY—–

KEY内容

—–END RSA PRIVATE KEY—–

</key>

key-direction 1

#下面是tls认证，也就是你服务器生成的ta.key文件内容，可以不要，看服务器是否启用了tls认证

<tls-auth>

#

# 2048 bit OpenVPN static key

#

—–BEGIN OpenVPN Static key V1—–

ta.key内容

—–END OpenVPN Static key V1—–

</tls-auth>

最后，这里 http://downloads.openwrt.org/backfire/10.03.1-rc3/brcm63xx/packages/

有很多软件，可以自己装来玩玩

对了，DNSmasq是默认安装的，这个一定要启用，可以防止GFW的DNS污染。

多说几句：

以前写翻墙猫的教程目的就是让大家自己动起手来制作，后来出了ddwrt的自动vpn翻墙项目(http://code.google.com/p/autoddvpn/)还有神马威众路由器我还挺高兴，就打算不再折腾了，留给大家继续研究，我就算是起了一个带头作用，结果你们一犯懒就有人用此来谋利。

我不反对利用翻墙来谋利，淘宝上卖VPN的多得是，但是把这个翻墙猫做成垄断的而且谋暴利我就要反对了。我一直倡导的是参与的人越多，TG就越没法管这个翻墙猫，因为无从下手，像威众这样做成独家，TG一旦有目标就好动手了，害的不仅是自己，还有可能还殃及使用这个路由器的朋友们。

听说最近VPN都不保了，所以这年头还是自己动手好，教程都写得很清楚了，只要多花一点点时间就能搞定，有问题可以问我。

到此为止路由器上Tomato、DD-wrt、openwrt三种固件的翻墙方案都有了，任君选择。

from https://suoluo.org/2010/09/297/

———————————————————————————-

VPN software brings the security of a private network to an insecure network, and allows you to access private local networks from anywhere. As we’ve explained in the past, you can do things between computers on your local network you can’t from out on the internet: like listen to a shared iTunes library or access files in shared folders. Virtual private network applications give you access to your computer from anywhere on the internet as if you were home on your local network. Earlier this week we asked you to share your favorite software for establishing and maintaining virtual private networks. We rounded up the votes, and now we’re back with the five most popular VPN applications.

If you’re new to the idea of virtual private networks, you can read up on the technical nitty-gritty at the Wikipedia entry for VPNs. Note: This Hive Five contains both VPN server applications (the apps that create virtual private networks on your local network so it’s accessible from the outside world) and VPN client applications (the apps that connect to virtual private networks from the outside world). In many instances companies produce VPN servers, VPN clients, VPN servers with accompanying clients, or VPN clients that are designed to work with a variety of servers.

OpenVPN (Windows/Mac/Linux, Free)

OpenVPN is an open source VPN server that’s easy to set up for use with open source VPN clients. You can easily export configuration files from OpenVPN to import into a variety of open source and commercial clients. OpenVPN is also integrated into several router firmware packages including popular DD-WRT, OpenWRT, and Tomato. The OpenVPN system isn’t compatible with popular commercial VPN providers, but it provides an open source and free alternative for setting up VPNs to expensive and closed commercial models.

Cisco VPN (Windows/Mac/Linux, Variable Cost)

Cisco has a high market saturation in corporate and educational environments, and for many of you, any experience you’ve had with virtual private networks is through such exposure. The price to run a Cisco VPN is highly variable—and you can’t even get a concrete number without a quote from the company—but you can, as an end user, download the free Cisco VPN client for Windows and Mac—though many readers complained about the lack of 64-bit support in the free Cisco client.

LogMeIn Hamachi (Windows/Mac/Linux, Free)

Hamachi’s strongest attribute is its ease of use. If you’ve read some of the other entries in the Hive Five and realized that you don’t want a contract for a corporate VPN or the hassle of configuring a bunch of routers with open-source firmware packages, and you just want to set up a simple virtual network between you and your friend, your phone, or your office, Hamachi offers nearly instant deployment. Install the Hamachi client on all the machines and devices you want to connect into your network and add them to your Hamachi VPN and you’re done. It’s dead simple. The downside, if you’re concerned about it, is that your VPN isn’t locally managed—it’s centrally managed by Hamachi through their servers.

Shrew Soft (Windows/Linux, Free)

Shrew Soft offers a VPN that, while popular in its own right, received quite a boost when people started adopting Windows 7 64-bit in droves and found that Cisco wasn’t in any hurry to release a 64-bit client to accommodate them. Shrew Soft works with a variety of VPN server protocols including IPsec, OpenSWAN, freeSWAN, and strongSWAN.

Windows Built-In VPN (Windows, Free)

Windows has a built-in VPN client. Surprised? Many people are. It’s not a heavily advertised feature, but it covers many people’s needs. Before exploring other client solutions, it’s worth pulling up the quick launch box in the Windows start menu and typing “VPN” to start the configuration process. In Windows versions prior to Windows Vista, the built-in VPN client received a fair amount of criticism for lacking features and supported protocols. Since Vista and especially in the Windows 7 implementation, it’s grown significantly and unless you need a feature or standard that isn’t implemented you may not need to install anything at all.
Now that you’ve had a chance to look at the five most popular VPN solutions, it’s time to cast your vote in the poll below:

An honorable mention goes out to the Mac OS X built-in VPN client. Have a VPN tip, trick, or application to share? Let’s hear about it in the comments