- 2014-11-19 0:55
- 短网址
- 字号
-
Pritunl：简易搭建个人VPN
一 直以来安装 VPN 服务、提供全局加密代理，是租用VPS（虚拟主机）的一个重要用途，无奈各种命令行操作和复杂繁琐的设置过程，让小白们望而却步。特别是当这种技术被广泛 运用到翻墙手段中后，国家防火墙 GFW（Great Fire Wall）就通过智能识别判定，加大了对境外 VPN 服务器的限制和干扰：例如搭建最简单但安全性能较之最薄弱 PPTP 方式的 VPN 链接，很早就遭到联通和电信等 ISP 服务商的封杀；前年十八大之后，没有采用混淆技术的 Openvpn 也被干扰很难使用，因此让更多的初级用户转向其他翻墙手段，或者购买商业付费服务。
那么有没有一种简单有效的VPN方式，一方面能有一个相对简单的途径，易于初级用户迅速搭建 VPN 服务；另一方面有能抵御 GFW 的干扰，提供稳定有效的代理服务呢？最近我们找到一款免费开源的 VPN 平台软件— Pritunl，非常符合上述两个要求。
访问它的官网，界面非常美观简洁，它采用 OpenVPN 代理方式，一方面提供了 API 供高级开发者使用，同时还针对不同平台和不同 VPS 供应商（包括 DigitalOcean和AWS）提供了详尽的安装使用说明，同时我们根据官网上提供的测试发现，此款产品竟然具备图形化界面，方便了初级用户的使用，官方称其能在数分钟内完成搭建过程，这大大的降低了使用门槛。同时，它还提供每月2.5美元的高级会员服务，提供更加强大的功能，我们将在后面予以描述。
搬瓦工作虚拟主机
上 面已经提到，官网教程中已经为 DigitalOcean 等虚拟主机服务商提供了详细的安装方法，但我们认为如果仅仅是搭建一个 VPN 服务器提供代理服务，那么上述主机中价格最低的 DigitalOcean 最低配的主机每月 5美元的租赁费用还是过高，512M的内存也有浪费之嫌。因此这里，我们使用最近非常火热的搬瓦工（BandwagonHost）主机作为本次测试的 VPS。
搬瓦工之所以这么火热，就是因为它低配主机的廉价，非常符合国人搭建代理服务的需求。我们这里选用的是一款内存64M的单核主机，年费才3.99美元，平均每个月的开销才2元人民币，1.5G的硬盘和每月100G的流量也完全满足我们需求。它支持信用卡和 Paypal付款，目前有两个美国机房，一个地处东海岸的 Florida 州，一个地处西海岸的 Arizona 州（推荐）。
价格的便宜不意味着服务的缩水，它带有一个强大的后台管理面板 KiwiVM，可以设置 Two-factor authentication 加强安全性，甚至还可以通过面板直接安装 OpenVPN服务。
系 统默认安装的 CentOS系统，又有编译安装过程太蛋疼，首先通过 KiwiVM 面板重新安装我们更加熟悉的 Ubuntu 12.04 32位系统，然后甚至都不需要使用 Putty ，直接使用面板中的 RootShell-Interactive 就可以进入命令行：
配置环境
1. VPS供应商：Bandwagon Host；
2. VPS配置：1.5G硬盘，单核处理器 64M内存，每月100G流量；
3. 服务器系统：Ubuntu 12.04 32位系统；
4. 客户端系统：Windows7 64位系统
一、安装 Pritunl
| 1
2 3 4 5 6 7 8 9 10 11 |
apt-get update #首先更新软件源
apt-get install -y python-software-properties #安装add-apt-repository工具包
add-apt-repository ppa:pritunl/ppa #添加软件源
apt-get update #更新
apt-get install -y pritunl #安装 pritunl
apt-get upgrade -y #当新版本发布时用此命令进行更新 |
二、设置 Pritunl
在浏览器中输入：https://<Server_Address>:9700/,注意用自己 VPS 的IP地址进行替换：
正常情况就应该出现 Pritunl 的登陆界面，默认的用户名和密码都是“Admin”；
进入“Users”选项卡，点击“Add Organization”输入名称后添加组；
点击“Add User”命令输入名称后在组下添加用户；
继续点击“Servers”选项卡，点击“Add Server”输入名称后添加服务器；
然后点击“Attach Oranization”，将刚新建的组添加到服务器中；
最后点击“Start Server”运行服务，结束设置环节。
三、客户端的设置
到 OpenVPN 官网上下载 Windows 平台的桌面客户端并安装；
进入 Pritunl 设置界面，点击“Users”选项卡，点击用户名右侧的图标下载 OpenVPN 的 Profile设置文件压缩包，里面包含密钥；
用加压缩软件将其解压，并将 Profile 文件拷贝到 Open configuration file directory目录中；
以管理员身份运行 OpenVPN（如果用一般用户运行可能会出现无法翻墙的情况），使用配置好的情景链接服务器，成功！
四、其它
1. Pritunl 还提供每个月2.5美元的高级服务，主要功能是提供每个用户产生的流量并以图形化界面反应，如果不是商业运用，这个功能应该和个人用户联系不大，效果如下图：
2.上述教程是以Ubuntu 12.04作为服务器端系统，以Windows平台作为客户端系统的，其它系统的安装和设置过程请参见官方教程；
3.Pritunl为保证安全性还提供了两步认证（ Two-step authenticatioon）；
4. Pritunl作为VPN服务搭建工具最大的优势就是图形化和简约化，甚至针对目前较为流行的低价主机服务商 DigitalOcean 开发了API接口，能够迅速完成服务器端的搭建和维护。
5. 上面提到过 Pritunl 采用的 OpenVPN 模式在十八大之后遭遇到一段时间的干扰和屏蔽，但以目前的情况来看链接非常稳定速度也很好，但此款应用刚刚推出，不知道在大规模使用后情况会不会出现逆 转，但这一点也妨碍原来高高在上的VPN 搭建过程正逐步向简单化，图形化和普及化方向发展的趋势，在这方面，Pritunl给了我们一个很好的启示和榜样，希望日后类似的应用越来越广泛。
本文链接：Pritunl：简易搭建个人VPN
美博园文章均为“原创 - 首发”，请尊重辛劳撰写，转载请以上面完整链接注明来源！
软件版权归原作者！个别转载文，本站会注明为转载。
网 友 留 言
6条评论 in “Pritunl：简易搭建个人VPN”这里是你留言评论的地方
这是搭建吗？哄人
Lantern-1.5.11
https://github.com/getlantern/lantern/releases
(常)
@Andrzeja
更新很快，1.5.12也发布了，谢谢：蓝灯 Lantern - v1.5.12（2014-11-22） - 美博园
Twister 0.9.26.1
Update : 4 hours ago
https://github.com/dryabov/twister-webkit/releases/
(美博园)
@Andrzeja
已经发布，谢谢：Twister（龙卷风） P2P社交网络 v0.9.26（20141121） - 美博园
TrueCryptⓇ
Final Release Repository
https://www.grc.com/misc/truecrypt/truecrypt.htm
"Yes . . . TrueCrypt is still safe to use.
Although the disappearance of the TrueCrypt site, whose ever-presence the Internet community long ago grew to take for granted, shocked and surprised many, it clearly came as no surprise to the developers who maintained the site and its namesake code for the past ten years. An analysis of the extensive changes made to TrueCrypt's swan song v7.2 release, and to the code's updated v3.1 license, shows that this departure, which was unveiled without preamble, was in fact quite well planned.
For reasons that remain a titillating source of hypothesis, intrigue and paranoia, TrueCrypt's developers chose not to graciously turn their beloved creation over to a wider Internet development community, but rather, as has always been their right granted by TrueCrypt's longstanding license, to attempt to kill it off by creating a dramatically neutered 7.2 version that can only be used to view, but no longer to create new, TrueCrypt volumes.
Then, leveraging the perverse and wrongheaded belief that software whose support was just cancelled renders it immediately untrustworthy, they attempted to foreclose on TrueCrypt's current and continued use by warning the industry that future problems would remain unrepaired. This being said of the latest 7.1a version of the code that has been used by millions, without change, since its release in February of 2012, more than 27 months before. Suddenly, for no disclosed reason, we should no longer trust it?
The mistake these developers made was in believing that
they still “owned” TrueCrypt, and that it was theirs to kill.
But that's not the way the Internet works. Having created something of such enduring value, which inherently requires significant trust and buy-in, they are rightly unable to now take it back. They might be done with it, but the rest of us are not.
The developers' jealousy is perhaps made more understandable by examining the code they have created. It is truly lovely. It is beautifully constructed. It is amazing work to be deeply proud of. Creating something of TrueCrypt's size and complexity, and holding it together as they did across the span of a decade, is a monumental and truly impressive feat of discipline. So it is entirely understandable when they imply, as quoted below, that they don't trust anyone else to completely understand and maintain their creation as they have. Indeed, it will not be easy. They might look at the coding nightmare atrocity that OpenSSL became over the same span of time and think: “Better to kill off our perfect creation than turn it over to others and have it become that.”
Those who believe that there is something suddenly “wrong” with TrueCrypt because its creators have decided they no longer have so much to give are misguided.
TrueCrypt's creators may well be correct. TrueCrypt may never be as pure and perfect as it is at this moment, today—in the form they created and perfected. Their true final version, 7.1a, may be the pinnacle of this story. So anyone would and should be proud to use and to continue to use this beautiful tool as it is today.
TrueCrypt's formal code audit will continue as planned. Then the code will be forked, the product's license restructured, and it will evolve. The name will be changed because the developers wish to preserve the integrity of the name they have built. They won't allow their name to continue without them. But the world will get some future version, that runs on future operating systems, and future mass storage systems.
There will be continuity . . . as an interesting new chapter of Internet lore is born.
................................................."
(美博园)