🔧 Configurar OpenVPN Server
En tu ordenador con WiFi X (Linux/macOS):
# Instalar OpenVPN
sudo apt update && sudo apt install openvpn easy-rsa
# Configurar CA y certificados
make-cadir ~/openvpn-ca
cd ~/openvpn-ca
source vars
./clean-all
./build-ca
./build-key-server server
./build-dh
./build-key client1
# Generar archivo de configuración
sudo cp keys/{server.crt,server.key,ca.crt,dh2048.pem} /etc/openvpn/
# Crear server.conf
sudo nano /etc/openvpn/server.conf
Contenido de server.conf:
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
# Iniciar servidor OpenVPN
sudo systemctl start openvpn@server
sudo systemctl enable openvpn@server
# Verificar que está ejecutándose
sudo systemctl status openvpn@server
🔧 Configurar IKEv2 Server (strongSwan)
# Instalar strongSwan
sudo apt update && sudo apt install strongswan strongswan-pki
# Generar certificados
mkdir ~/pki && cd ~/pki
ipsec pki --gen --type rsa --size 4096 --outform pem > ca-key.pem
ipsec pki --self --ca --lifetime 3650 --in ca-key.pem \
--type rsa --dn "CN=VPN CA" --outform pem > ca-cert.pem
# Certificado del servidor
ipsec pki --gen --type rsa --size 4096 --outform pem > server-key.pem
ipsec pki --pub --in server-key.pem --type rsa | \
ipsec pki --issue --lifetime 1825 --cacert ca-cert.pem \
--cakey ca-key.pem --dn "CN=192.168.1.58" \
--san="192.168.1.58" --flag serverAuth \
--flag ikeIntermediate --outform pem > server-cert.pem
# Copiar certificados
sudo cp ca-cert.pem /etc/ipsec.d/cacerts/
sudo cp server-cert.pem /etc/ipsec.d/certs/
sudo cp server-key.pem /etc/ipsec.d/private/
Configurar /etc/ipsec.conf:
config setup
charondebug="ike 1, knl 1, cfg 0"
uniqueids=no
conn ikev2-vpn
auto=add
compress=no
type=tunnel
keyexchange=ikev2
fragmentation=yes
forceencaps=yes
dpdaction=clear
dpddelay=300s
rekey=no
left=%any
leftid=192.168.1.58
leftcert=server-cert.pem
leftsendcert=always
leftsubnet=0.0.0.0/0
right=%any
rightid=%any
rightauth=eap-mschapv2
rightsourceip=10.10.10.0/24
rightdns=8.8.8.8,8.8.4.4
rightsendcert=never
eap_identity=%identity
🔧 Configurar WireGuard Server
# Instalar WireGuard
sudo apt update && sudo apt install wireguard
# Generar claves
cd /etc/wireguard/
umask 077
wg genkey | sudo tee server_private_key | wg pubkey | sudo tee server_public_key
wg genkey | sudo tee client_private_key | wg pubkey | sudo tee client_public_key
Crear /etc/wireguard/wg0.conf:
[Interface]
PrivateKey = SERVER_PRIVATE_KEY_AQUI
Address = 10.0.0.1/24
ListenPort = 51820
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
[Peer]
PublicKey = CLIENT_PUBLIC_KEY_AQUI
AllowedIPs = 10.0.0.2/32
# Habilitar IP forwarding
echo 'net.ipv4.ip_forward=1' | sudo tee -a /etc/sysctl.conf
sudo sysctl -p
# Iniciar WireGuard
sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0