root@gate.corp13.un:~# cat nat.sh
iptables -t nat --flush
iptables -t nat -A POSTROUTING -o eth1 -s 192.168.13.0/24 -j MASQUERADE
iptables -t nat -A PREROUTING -i eth1 --destination 172.16.1.13 -p udp --dport 1194 -j DNAT --to-destination 192.168.13.10:1194
conntrack -F

=== openvpn, по старинке, как ПО на VM ===

Перподаватель демонстрирует/напоминает из ЛИН3

Недостатки: множество разбросанных файлов ...

# apt update && apt install -y openvpn

----------
# cat > /etc/openvpn/openvpn1.conf <<END
cat > openvpn1.conf <<END
dev tun
keepalive 10 120
server 192.168.113.0 255.255.255.0
#server 192.168.213.0 255.255.255.0
push "route 192.168.13.0 255.255.255.0"
status /var/log/openvpn1-status.log
dh /etc/openvpn/dh2048.pem
key /etc/ssl/private/server.key
ca /etc/ssl/certs/server.crt
cert /etc/ssl/certs/server.crt
plugin /usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so login
verify-client-cert none
username-as-common-name
END

# cat > /etc/openvpn/dh2048.pem <<END
cat > dh2048.pem <<END
-----BEGIN DH PARAMETERS-----
MIIBCAKCAQEAktLujXOj4jofgbhkz20HO44bi16fHIANQihM/hSkpxrSpca1gfCD
pN63ey40/EjeVooN85FUuKhtpguqx7HtRk/In2YoRxJmrNsg7NO/TuYTbFqYA4kJ
UbffeN/M6YlyIRpZm4QXvnC2zRFIsoIY9tovtO2CWBuCSexT0WtpONBz6Joexj46
dsOovvZc4zxVbnRA0q9kfmHAqDuk/1K5dl/DrNWsjAFIMfen8bG3SMEx+1dPKCE6
fNzcZnIxcj/FpyccY0kV4o35NuHmxEKzAvHpB0ZMXnKa0rtmxI+BUCKECrubFihc
y55WsdklJ59FGtA7STWE6CAetNKjnLO+awIBAg==
-----END DH PARAMETERS-----
END

# cat > /etc/ssl/private/server.key <<END
cat > server.key <<END
-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEA1u3kT6uahUov6eYd0AFp7RJlLlVKKlCOi56Dx7m44MaxaaGe
65ba0GwlQZ3ZTgbEXNVVYmXFdojqj0jASXb9HJ2HaderjcEJ6gTCqhy4IZkmJwDW
MqnGpte49K9sz9TUgvi9dW8QuRh3bKRAyWwX3XileLojcnzyHFu5ss8ZeA5TO+sb
A1sgphB2/VN6MaSHoly4U09IZ0L7gb27HpbID00UwUSkoe1oVcgq+Mp9D5PjgOSd
5CrDa2oXbuRSXjpAnebBa/vpONJ7EZoW5+DJfjTptO1f7rdOys4TeCnO+huHicj7
AM+i0QY7GVXoULjqqSfpEyhqY18n1GchwzgdpQIDAQABAoIBAQCh9xWlQDEqntRq
k+IFfPtBDyq2dsl0B87TwjmWigubP8A0VPo4mS79/3E3+GbomMrjFlTI2N6sS9NO
9MkK06M8LC3+gesi4MTC2KGFpizQDOQmYkgIV85+rnQP2B7Mo5sds6q6U18rzRc6
BLFZ2J5HZIJ17veFcEjXO/w9ljmgMPHZk3zFYhAH7TfQVfaphEiXKRVrQHbGsZGH
927o3gS26kzhDpr6VF6nMHhOOwDTx/SjJdb+lM7E0lxas+4wTwqmlnARu0v5PSrS
XUO+0f/2+8SHgZy8THzriw5+i2M4MHNQSjCmwuX87hnbNL2mKcOMFrxz3LV6jv67
Co9aTmGFAoGBAOskAbsmv3qZ2vMmLrZv0UitAujnfGEKimc4dChPQWYqAyYN7QWR
0y5ByWwztaaq5phoMFn++Il8gRAcNhMU0eTqsKzRWeEXjW0aIc3OfK+I9MHH50Hl
1DEMyEK52jR4d5DoTHNMqreJBMNuIkoDrvm7TDzwvzEE1xFSGgyfDKvLAoGBAOn+
440xTDa4e6j/l43tvD2jtNc7JqItMPX6VkDJ/VoyzGCmEI9Tc1UKP9fEOCXD0SKr
YW/ASlP3iksKYQdG+bHePUw6U2toYIBK1M5g0QTvAX1G2/lLTtrqcNBl7pmMtYXN
Q5wd5Bb2xMeRADlmACvwfrvVEQI4V4g4aHhtfg5PAoGAE/aOnxD/GK2PRS1ssdh0
cDMgGB3vFV4Lug+07OctqjrO4aA1C1ACGd9D9oe9WFUSFsZhtIJNH38OhgufG6ec
2k6CiWmMs+uH+kdJr2tkcpKyFPGf1Jxqk29+YQveVq4TmJ3gP7m2lLZxTRZAmwAN
Du6z3kiiMssyZyoNRB0MulkCgYEA6WrQ1USq8R8ghBnKtdLD530JZXZk+Hw6DfWV
2vVjXHm19GdTt5WYQ+mAfB0JoWpvkbUB8ncP7ijNdEO7PIYpiKvX29WG52rscK21
ENX1S4Wbp7tqrYjY9XnN5aT42YVKglmbKv2KTPoGm8jiP1+npi02TuqhF+TaNFGI
rTEUAPMCgYBK2ek5krlPPXyAeaNoGEJQemUkcQiIvhnn+oGpixPt/9aeXnnypFVJ
sW2cfGWPfijmHbNa5n5QeDwcSCDNutpBceUwF3FVGwbnyp4t9+inNP26QJsX1c5u
fzu4vGO3QrQmVAHlYLoRLyAYCMAMmiiix1niOuncHq3gB/HxMl5YsQ==
-----END RSA PRIVATE KEY-----
END

# cat > /etc/ssl/certs/server.crt <<END
cat > server.crt <<END
-----BEGIN CERTIFICATE-----
MIIDjzCCAnegAwIBAgIUauO/bmoISReiQAPw0WMQ/zt6g3MwDQYJKoZIhvcNAQEL
BQAwVzELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEQMA4GA1UEAwwHb3BlbnZwbjAeFw0y
MjA2MDkxMDI4MjVaFw0zMjA2MDYxMDI4MjVaMFcxCzAJBgNVBAYTAkFVMRMwEQYD
VQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBM
dGQxEDAOBgNVBAMMB29wZW52cG4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQDW7eRPq5qFSi/p5h3QAWntEmUuVUoqUI6LnoPHubjgxrFpoZ7rltrQbCVB
ndlOBsRc1VViZcV2iOqPSMBJdv0cnYdp16uNwQnqBMKqHLghmSYnANYyqcam17j0
r2zP1NSC+L11bxC5GHdspEDJbBfdeKV4uiNyfPIcW7myzxl4DlM76xsDWyCmEHb9
U3oxpIeiXLhTT0hnQvuBvbselsgPTRTBRKSh7WhVyCr4yn0Pk+OA5J3kKsNrahdu
5FJeOkCd5sFr++k40nsRmhbn4Ml+NOm07V/ut07KzhN4Kc76G4eJyPsAz6LRBjsZ
VehQuOqpJ+kTKGpjXyfUZyHDOB2lAgMBAAGjUzBRMB0GA1UdDgQWBBQ5CHGPFNOA
xKCAeJ5L2znt2eHI6DAfBgNVHSMEGDAWgBQ5CHGPFNOAxKCAeJ5L2znt2eHI6DAP
BgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBJWW0b0COcCnWsoAQX
ziWFMzjOk3dn6TWAWtPBGVRhAhKmFR7/hpJ/T64dspWt23Ii4t+JExb9RsD7h+oy
7T9pq2MjK2Km6OruH1U2q6uH37jzPLEzb1xS/bbKPehyAy/1TJiU64pfB6HdNfzn
N8T2UkvnkCXoedKoAJLpUTsfj0W80pjSsnInw64OdcTZnvHKldj7hw6xudLj7ZKW
K3vEnLjF+Yhcu04oASaAD2n9BUupGfm2FVDtUOD7mgW8omczIzehf6lTnfSSNry4
JnWJ+lE9wn0f/Ksjqlw1GXcdxKRrznV8KEQajlqD1UdrKdU2k8YkMhHtx4aX+Q64
w4eH
-----END CERTIFICATE-----
END

----------------

# useradd user1 && echo user1:password1 | chpasswd



=== Контейнер с openvpn вручную ===

Можно ВСЕМ урок с webd (до, включительно, Dockerfile), потом преподаватель собирает контейнер вручную:

# docker run -it --name openvpn1 --hostname openvpn1 -p 1194:1194/udp --cap-add=NET_ADMIN \
--device /dev/net/tun:/dev/net/tun debian bash

...

# /usr/sbin/openvpn --config /etc/openvpn/openvpn1.conf

# docker rm openvpn1


=== Готовый проект контейнера ===

student@node1:~/openvpn1$ cat Dockerfile
FROM debian:bullseye

RUN apt-get update && apt-get install -y openvpn && useradd user1 && echo user1:password1 | chpasswd

COPY openvpn1.conf /etc/openvpn/openvpn1.conf
COPY dh2048.pem /etc/openvpn/dh2048.pem
COPY server.key /etc/ssl/private/server.key
COPY server.crt /etc/ssl/certs/server.crt

ENTRYPOINT /usr/sbin/openvpn --config /etc/openvpn/openvpn1.conf


Можно ВСЕМ урок с webd до docker-compose, включительно, затем

student@node2:~/openvpn1$ cat docker-compose.yml
openvpn1:
  build: .
  ports:
    - 1194:1194/udp
  cap_add:
    - NET_ADMIN
  devices:
    - /dev/net/tun:/dev/net/tun
  tty: true

=== Маршрутизация/NAT ===

Обсуждаем, препод может продемонстрировать, но, пока не заморачиваемся

root@node1:~# ip route add 192.168.113.0/24 via 172.17.0.2
root@node2:~# ip route add 192.168.213.0/24 via 172.17.0.2


root@gate.corp13.un:~# ip r add 192.168.113.0/24 via 192.168.13.10
root@gate.corp13.un:~# ip r add 192.168.213.0/24 via 192.168.13.20

===