openvpn 是不是彻底死了？

[cattyhouse]

我在server上建立的
客户端用iOS的openvpn app
udp模式下，可以连接，有时候能打开网站，一会儿就打不开了
tcp模式下，有时候流量被reset by peer，基本不能用的状态。

在openvpn官方找到一份文档，用iOS profile安装openvpn （也就是无需装openvpn connect app）根据这份文档，可以想想，如果在服务器建立了一个自定义的SSL VPN，就可以用Apple Configurator给iOS配置自定义SSL VPN了。 目前想到的就是用Softether创建SSL VPN服务端。


Q: Can I use iOS 6 VPN-On-Demand with OpenVPN?

A: Yes. VPN-On-Demand (VoD) is a new technology introduced by Apple in iOS 6 that allows a VPN profile to specify the conditions under which it will automatically connect. In addition, using a VoD profile on iOS 7 allows OpenVPN to be connected and disconnected using the iOS Settings App under the VPN tab. OpenVPN on iOS fully supports VoD, with the following features:

The iPhone Configuration Utility can be used to create an OpenVPN VoD profile by entering OpenVPN configuration file parameters as key/value pairs.
The OpenVPN app supports connect and disconnect actions triggered by the iOS VoD subsystem.
The OpenVPN app recognizes VoD profiles and will show them in the UI and allow them to be monitored and controlled like other OpenVPN profiles (with the exception that VoD profiles cannot be manually connected from the app UI, they can only be disconnected -- this is because a VoD profile is designed to be connected automatically by iOS).
OpenVPN VoD profiles can be created using the iPhone Configuration utility. Unfortunately, the process is a bit cumbersome at the moment because the directives of the OpenVPN profile must be manually entered as key/value pairs into the iPhone Configuration utility UI.

For now, to create a VoD profile, open the iPhone Configuration utility (these directions were tested with version 3.5 on a Mac tethered to an iPad running iOS 6.0.1), go to the File menu, and select "New Configuration Profile".

Next, edit the newly created Configuration Profile. Click on General in the left pane and fill out the fields such as Name, Identifier, Organization, etc. Click on VPN in the left pane and a "Configure VPN" dialog box should appear in the main window. Click the "Configure" button. Fill out the VPN settings as described below:

Connection Name should be set to a name that will identity this profile on the device.
Connection Type should be set to Custom SSL.
Identifier should be set to "net.openvpn.OpenVPN-Connect.vpnplugin".
Server can be set to a hostname, or "DEFAULT" to use the hostname(s) from the OpenVPN configuration.
User Authentication should be set to Certificate, and the client certificate+key should be attached as a PKCS#12 file.
VPN On Demand should be enabled and match entries should be defined to instruct iOS under which conditions the VPN profile should be automatically connected.
In addition, parameters normally given in the OpenVPN client configuration file may instead be defined using key/value pairs in the Custom Data section:

VoD requires an OpenVPN autologin profile, i.e. a profile that authenticates using only a client certificate and key, without requiring a connection password.
Define each OpenVPN directive as a key, with arguments specified as the value. As in the OpenVPN configuration file, arguments are space-delimited and may be quoted.
At a minimum, key/value pairs for ca and remote must be defined (Note that OpenVPN cannot get the CA list from the VoD profile, therefore it must be provided using a ca key/value pair).
Key value pairs for tls-auth, key-direction, comp-lzo, cipher, ns-cert-type, and remote-cert-tls must be defined if the server requires them.
For OpenVPN directives with no arguments, use "NOARGS" as the value.
If multiple instances of the same directive are present, when entering the directive as a key, number the directives in the order they should be given to OpenVPN by appending .n to the directive, where n is an integer, such as remote.1 or remote.2
For multi-line directives such as ca and tls-auth, where the argument is a multi-line file, an escaping model has been provided to allow the file content to be specified as a single-line value. The procedure is to convert the multi-line data to a single line by replacing line breaks with "\n" (without the quotes). Note that because of this escaping model, you must use "\\" to pass backslash itself.
For OpenVPN Access Server meta-directives such as "OVPN_ACCESS_SERVER_USERNAME", remove the OVPN_ACCESS_SERVER_ prefix, giving USERNAME as the directive.
Once the VoD profile has been defined, you have two options for exporting it to an iOS device:

If your device is currently tethered, click on your device name in the left pane. Then in the main window, click on the Configuration Profiles tab. You should see the name of your Configuration Profile and a button to install it on the device.
You can also save the Configuration Profile as a .mobileconfig file, and make it available to iOS clients via email or the web. To do this, select your Configuration Profile, go to the File menu, and select "Export...". An Export Configuration Profile dialog box will appear. Select a Security option -- "Sign configuration profile" is a reasonable choice. Press the Export button and save the profile.
When an iOS device receives a VoD profile (via Mail attachment, Safari download, or pushed by the iPhone Configuration utility), it will raise a dialog box to facilitate import of the profile. After import, the profile will be visible in the Settings App under General / Profiles. It will also be visible as a profile in the OpenVPN app. Note that the profile must be the currently-enabled VPN profile in order for the VoD functionality to work.

[lsylsy2]

试试用static模式

[tititake]

好像对网络质量依赖比较大，丢包稍微一多就容易失去反应。
不过在连接情况较好的的VPS还可以。

[Showfom]

OpenVPn Static 方式，只要你本地网络支持 P2P 用起来妥妥的

[tititake]

@Showfom @lsylsy2

static方式是指这个文档里面说的吗？抗干扰能力强么？
http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html

[cattyhouse]

@lsylsy2 感谢你的回复，但是：
OpenVPN Connect iOS FAQ：
secret — Static key encryption mode (non-TLS) is not supported.

[cattyhouse]

@tititake 这不是网络质量的问题，墙在2012年就找到了openvpn的加密规律，然后封了。

[hjc4869]

ipsec保平安……

[tititake]

@cattyhouse 我一般不长时间使用openvpn，最近只是更新google play时使用。
连美国的vps有时会有点问题，比如速度慢，没流量等。
不过最近弄了个新加坡的vps，同样的连接方式，还没碰到问题。

[cattyhouse]

@hjc4869 ipsec已经搞定了，只是iOS的 dead peer detect 还是不完美，具体表现就是WIFI切换到3G，VPN需要很久才断开，大约30s左右。

[wske]

openvpn 一直都没有问题啊，你看很多国外的VPN服务商依然主要采用openvpn

[Showfom]

@tititake 不支持 iOS

[tititake]

@Showfom 嗯，我没有iOS设备，我只是没用过static方式，所以问下。刚刚搭了个试了一下，连接极快，估计比较难被封？不过缺点static方式只能一对一，个人vps自用倒是也够了。

[Showfom]

@tititake 是的，只能一个节点用，而且本地的网络要支持 P2P，比如无法下载 BT 的网络环境下就用不了。低调低调，被太多人知道就会被封了= =

[hjc4869]

@cattyhouse 这个确实是，iOS也不给个VPN的快捷按钮。。。

[masterqing]

@Showfom statickey 情况下如何把DNS PUCH到客户端

[Showfom]

@masterqing 我都是本地自己设置DNS的

[cosmain]

对于 GFW 来说是的，不过国内连国内还是很好用的，有时候比 wireguard 稳定。