212 lines
4.6 KiB
Markdown
212 lines
4.6 KiB
Markdown
|
|
# Guía Completa: Configurar VPN con ZeroTier en VPS Ubuntu 22.04
|
|
|
|
## Paso 1: Preparación Inicial del VPS
|
|
|
|
### 1.1 Crear Usuario (Opcional pero Recomendado)
|
|
|
|
```bash
|
|
# Si estás usando root, crear usuario regular
|
|
adduser zero # (o el nombre que prefieras)
|
|
usermod -aG sudo zero
|
|
mkdir -p /home/zero/.ssh
|
|
cp /root/.ssh/authorized_keys /home/zero/.ssh/
|
|
chown -R zero:zero /home/zero/.ssh
|
|
chmod 700 /home/zero/.ssh
|
|
chmod 600 /home/zero/.ssh/authorized_keys
|
|
|
|
# Cambiar al nuevo usuario
|
|
su - zero
|
|
```
|
|
|
|
### 1.2 Actualizar Sistema
|
|
|
|
```bash
|
|
sudo apt update && sudo apt upgrade -y
|
|
```
|
|
|
|
### 1.3 Instalar Herramientas Necesarias
|
|
|
|
```bash
|
|
sudo apt install iptables iptables-persistent curl -y
|
|
```
|
|
|
|
## Paso 2: Instalación y Configuración de ZeroTier
|
|
|
|
### 2.1 Instalar ZeroTier
|
|
|
|
```bash
|
|
# Instalar ZeroTier
|
|
curl -s https://install.zerotier.com | sudo bash
|
|
|
|
# Verificar instalación
|
|
sudo zerotier-cli info
|
|
```
|
|
|
|
### 2.2 Unirse a la Red ZeroTier
|
|
|
|
```bash
|
|
# Reemplazar NETWORK_ID con tu ID real
|
|
sudo zerotier-cli join b6079f73c60af212
|
|
|
|
# Verificar estado
|
|
sudo zerotier-cli listnetworks
|
|
```
|
|
|
|
### 2.3 Autorizar en ZeroTier Central
|
|
|
|
1. Ir a **my.zerotier.com**
|
|
2. Entrar a tu red
|
|
3. En "Members", marcar **"Auth"** para el VPS
|
|
4. Asignar nombre descriptivo: "VPS-Buenos-Aires"
|
|
|
|
## Paso 3: Configurar VPS como Gateway VPN
|
|
|
|
### 3.1 Identificar Interfaces de Red
|
|
|
|
```bash
|
|
# Ver todas las interfaces
|
|
ip addr show
|
|
|
|
# Identificar:
|
|
# - Interfaz ZeroTier: ztyxazlaou (ejemplo)
|
|
# - Interfaz pública: eth1 (en este caso)
|
|
# - IP ZeroTier asignada: 172.25.177.175 (ejemplo)
|
|
```
|
|
|
|
### 3.2 Habilitar IP Forwarding
|
|
|
|
```bash
|
|
# Verificar estado actual
|
|
cat /proc/sys/net/ipv4/ip_forward
|
|
|
|
# Habilitar permanentemente
|
|
echo 'net.ipv4.ip_forward=1' | sudo tee -a /etc/sysctl.conf
|
|
sudo sysctl -p
|
|
```
|
|
|
|
### 3.3 Configurar Reglas de iptables
|
|
|
|
```bash
|
|
# IMPORTANTE: Usar la interfaz pública correcta (eth1 en nuestro caso)
|
|
sudo iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
|
|
sudo iptables -A FORWARD -i ztyxazlaou -o eth1 -j ACCEPT
|
|
sudo iptables -A FORWARD -i eth1 -o ztyxazlaou -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
|
|
# Guardar reglas permanentemente
|
|
sudo netfilter-persistent save
|
|
```
|
|
|
|
## Paso 4: Configurar Rutas en ZeroTier Central
|
|
|
|
### 4.1 Configuración en my.zerotier.com
|
|
|
|
1. Ir a **my.zerotier.com**
|
|
2. Seleccionar tu red "Casa Parma"
|
|
3. Ir a sección **"Advanced"**
|
|
4. En **"Managed Routes"** agregar:
|
|
- **Destination**: `0.0.0.0/0`
|
|
- **Via**: `172.25.177.175` (IP ZeroTier del VPS)
|
|
5. Guardar cambios
|
|
|
|
## Paso 5: Configuración de Clientes
|
|
|
|
### 5.1 En PC Windows
|
|
|
|
```cmd
|
|
# Agregar ruta temporal (se pierde al reiniciar)
|
|
route add 0.0.0.0 mask 0.0.0.0 172.25.177.175 metric 1
|
|
|
|
# Para hacerlo permanente
|
|
route -p add 0.0.0.0 mask 0.0.0.0 172.25.177.175 metric 1
|
|
```
|
|
|
|
### 5.2 En Router MikroTik
|
|
|
|
```bash
|
|
/ip route add dst-address=0.0.0.0/0 gateway=172.25.177.175 distance=1
|
|
```
|
|
|
|
### 5.3 En Linux/Mac
|
|
|
|
```bash
|
|
# Temporal
|
|
sudo route add default gw 172.25.177.175
|
|
|
|
# Permanente (varía según distribución)
|
|
```
|
|
|
|
## Paso 6: Verificación y Pruebas
|
|
|
|
### 6.1 Verificar en el VPS
|
|
|
|
```bash
|
|
# Estado de ZeroTier
|
|
sudo zerotier-cli listnetworks
|
|
|
|
# Ver tráfico pasando
|
|
sudo tcpdump -i ztyxazlaou
|
|
|
|
# Verificar reglas iptables
|
|
sudo iptables -t nat -L
|
|
sudo iptables -L FORWARD
|
|
```
|
|
|
|
### 6.2 Probar desde Cliente
|
|
|
|
```bash
|
|
# Verificar conectividad al VPS
|
|
ping 172.25.177.175
|
|
|
|
# Verificar IP pública (debe mostrar IP del VPS)
|
|
curl ifconfig.me
|
|
# Debe devolver: 154.205.154.182 (IP pública del VPS)
|
|
```
|
|
|
|
## Paso 7: Solución de Problemas Comunes
|
|
|
|
### 7.1 Error de Hostname en sudo
|
|
|
|
```bash
|
|
# Editar hosts
|
|
sudo nano /etc/hosts
|
|
# Agregar: 127.0.0.1 nombre_del_host localhost
|
|
```
|
|
|
|
### 7.2 ZeroTier no conecta
|
|
|
|
```bash
|
|
# Reiniciar servicio
|
|
sudo systemctl restart zerotier-one
|
|
sudo systemctl status zerotier-one
|
|
```
|
|
|
|
### 7.3 Verificar Firewall
|
|
|
|
```bash
|
|
# Ubuntu con ufw
|
|
sudo ufw status
|
|
sudo ufw allow 9993/udp # Puerto ZeroTier
|
|
```
|
|
|
|
## Datos de tu Configuración Específica
|
|
|
|
- **Network ID**: `b6079f73c60af212`
|
|
- **Nombre de Red**: Casa Parma
|
|
- **IP VPS ZeroTier**: `172.25.177.175`
|
|
- **Interfaz ZeroTier**: `ztyxazlaou`
|
|
- **IP Pública VPS**: `154.205.154.182`
|
|
- **Interfaz Pública**: `eth1`
|
|
|
|
|
|
|
|
```bash
|
|
/ip firewall address-list add address=192.168.88.0/24 list=local-networks
|
|
/ip firewall address-list add address=192.168.1.0/24 list=local-networks
|
|
/ip firewall address-list add address=172.25.0.0/16 list=local-networks
|
|
|
|
/ip route add dst-address=0.0.0.0/0 gateway=172.25.177.175 routing-mark=via-vpn distance=1 comment="VPN-Smart-Route" disabled=yes
|
|
|
|
/ip firewall mangle add chain=prerouting src-address=192.168.88.0/24 dst-address-list=!local-networks action=mark-routing new-routing-mark=via-vpn comment="VPN-Public-Only" disabled=yes
|
|
```
|