Beberapa hari ini saya ingin membuat sebuah tutorial sederhana mengenai cara pembuatan OpenVZ VPS dengan memakai Dedicated Server dari Online.net. Online.net memberikan penawaran Dedicated Server dengan harga murah, yang mungkin cukup untuk keperluan pribadi. Contohnya, kali ini saya membuat tutorial ini pada Dedibox SC Gen2 dari Online.net dengan spesifikasi berikut :
- Ram 2 GB
- Disk Space 500 GB
- 1 X Nano U2250 @ 1.6GHz
- Unmetered 150Mbits/s
- 1 IPv4 and /48 block IPv6 ( IPv6 tidak terpakai, karena ada kesulitan dalam konfigurasinya )
- € 9.99/month atau sekitar Rp. 150.000
Pertama, kita install Dedibox SC Gen2 kita dengan pilihan Virtualization Proxmox VE2. Silakan disesuaikan setingan partisinya, kemudian dimasukkan username dan password yang diinginkan, lalu ikuti proses instalasi sampai selesai. Kadang bisa memerlukan waktu sampai satu jam, agar proses benar-benar selesai. Dan nanti kita bisa lihat URL untuk konfigurasi Proxmox kita.
Konfigurasi file resolv.conf
Silakan merubah file /etc/resolv.conf dengan baris berikut :
|
1 2 3 4 |
nameserver 8.8.8.8 nameserver 8.8.4.4 nameserver 2001:4860:4860::8888 nameserver 2001:4860:4860::8844 |
Konfigurasi file sysctl.conf
Silakan merubah file /etc/sysctl.conf dengan contoh berikut :
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 |
# # /etc/sysctl.conf - Configuration file for setting system variables # See /etc/sysctl.d/ for additonal system variables # See sysctl.conf (5) for information. # #kernel.domainname = example.com # Uncomment the following to stop low-level messages on console #kernel.printk = 3 4 1 3 ##############################################################3 # Functions previously found in netbase # # Uncomment the next two lines to enable Spoof protection (reverse-path filter) # Turn on Source Address Verification in all interfaces to # prevent some spoofing attacks #net.ipv4.conf.default.rp_filter=1 #net.ipv4.conf.all.rp_filter=1 # Uncomment the next line to enable TCP/IP SYN cookies # See http://lwn.net/Articles/277146/ # Note: This may impact IPv6 TCP sessions too #net.ipv4.tcp_syncookies=1 # Uncomment the next line to enable packet forwarding for IPv4 #net.ipv4.ip_forward=1 # Uncomment the next line to enable packet forwarding for IPv6 # Enabling this option disables Stateless Address Autoconfiguration # based on Router Advertisements for this host # net.ipv6.conf.all.forwarding=1 ################################################################### # Additional settings - these settings can improve the network # security of the host and prevent against some network attacks # including spoofing attacks and man in the middle attacks through # redirection. Some network environments, however, require that these # settings are disabled so review and enable them as needed. # # Do not accept ICMP redirects (prevent MITM attacks) #net.ipv4.conf.all.accept_redirects = 0 net.ipv6.conf.all.accept_redirects = 1 # _or_ # Accept ICMP redirects only for gateways listed in our default # gateway list (enabled by default) # net.ipv4.conf.all.secure_redirects = 1 # # Do not send ICMP redirects (we are not a router) #net.ipv4.conf.all.send_redirects = 0 # # Do not accept IP source route packets (we are not a router) #net.ipv4.conf.all.accept_source_route = 0 net.ipv6.conf.all.accept_source_route = 1 # # Log Martian Packets #net.ipv4.conf.all.log_martians = 1 # net.ipv4.conf.all.rp_filter=1 net.ipv4.icmp_echo_ignore_broadcasts=1 net.ipv4.conf.default.forwarding=1 net.ipv4.conf.default.proxy_arp = 0 net.ipv4.ip_forward=1 kernel.sysrq = 1 net.ipv4.conf.default.send_redirects = 1 net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.eth0.proxy_arp=1 net.ipv6.conf.eth0.autoconf = 0 net.ipv6.conf.eth0.accept_ra = 0 net.ipv6.conf.all.accept_redirects = 0 net.ipv6.conf.all.forwarding = 1 net.ipv6.conf.all.proxy_ndp = 1 net.ipv6.bindv6only = 1 |
Konfigurasi file vz.conf
Silakan merubah file /vz/vz.conf dan rubah baris NEIGHBOUR_DEVS=all seperti berikut :
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 |
## Global parameters VIRTUOZZO=yes LOCKDIR=/var/lib/vz/lock DUMPDIR=/var/lib/vz/dump VE0CPUUNITS=1000 ## Logging parameters LOGGING=yes LOGFILE=/var/log/vzctl.log LOG_LEVEL=0 VERBOSE=0 ## Disk quota parameters DISK_QUOTA=yes VZFASTBOOT=no # Disable module loading. If set, vz initscript does not load any modules. #MODULES_DISABLED=yes # The name of the device whose IP address will be used as source IP for CT. # By default automatically assigned. #VE_ROUTE_SRC_DEV="eth0" # Controls which interfaces to send ARP requests and modify ARP tables on. NEIGHBOUR_DEVS=all ## Fail if there is another machine in the network with the same IP ERROR_ON_ARPFAIL="no" ## Template parameters TEMPLATE=/var/lib/vz/template ## Defaults for containers VE_ROOT=/var/lib/vz/root/$VEID VE_PRIVATE=/var/lib/vz/private/$VEID ## Filesystem layout for new CTs: either simfs (default) or ploop #VE_LAYOUT=ploop ## Load vzwdog module VZWDOG="no" ## IPv4 iptables kernel modules to be enabled in CTs by default IPTABLES="ipt_REJECT ipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp" ## IPv4 iptables kernel modules to be loaded by init.d/vz script IPTABLES_MODULES="$IPTABLES ipt_REJECT ipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp" ## Enable IPv6 IPV6="yes" ## IPv6 ip6tables kernel modules IP6TABLES="ip6_tables ip6table_filter ip6table_mangle ip6t_REJECT" |
Konfigurasi network
Karena saya memakai Tunnel IPv6 dari HE, maka jika belum memiliki account di Tunnelbroker.net, silakan mendaftar terlebih dahulu.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 |
# This file describes the network interfaces available on your system # and how to activate them. For more information, see interfaces(5). # The loopback network interface auto lo iface lo inet loopback # The primary network interface auto vmbr0 iface vmbr0 inet static address xxx.xxx.xxx.xxx netmask 255.255.255.0 network 195.154.15.0 broadcast 195.154.15.255 gateway 195.154.15.1 bridge_ports eth0 bridge_stp off bridge_fd 0 auto he-ipv6 iface he-ipv6 inet6 v4tunnel endpoint 216.66.84.42 address 2001:470:1f12:254::2 netmask 64 up /sbin/ip -6 route add default dev he-ipv6 up /sbin/ip -6 addr add 2001:470:1f13:254::/64 dev vmbr0 # Set proxy agar semua koneksi IPv6 dari vps dilewatkan ke network card post-up ip -6 neigh add proxy 2001:470:1f13:254::100 dev vmbr0 post-up ip -6 neigh add proxy 2001:470:1f13:254::101 dev vmbr0 post-up ip -6 neigh add proxy 2001:470:1f13:254::102 dev vmbr0 post-up ip -6 neigh add proxy 2001:470:1f13:254::103 dev vmbr0 |
Penjelasan bagian he-ipv6 :
- Endpoint : silakan diisi sesuai Server IPv4 Address yang tertera di Tunnelbroker
- Address : silakan diisi dengan Client IPv6 Address yang tertera di Tunnelbroker, tanpa memakai /64
- Netmask : silakan diisi dengan 64
- Pada dua baris dibawahnya, silakan mempergunakan alamat Routed /64 dari Tunnelbroker
- Selanjutnya kita mempergunakan proxy, agar IPv6 yang kita berikan ke Container dilewatkan melalui network card
Periapan Module yang diperlukan
Silakan menambahkan baris module yang diperlukan di /etc/modules.conf dengan baris berikut :
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 |
# modprobe tun modprobe dm_crypt modprobe ppp-compress-18 modprobe ppp_mppe modprobe ppp_deflate modprobe ppp_async modprobe pppoatm modprobe ppp_generic modprobe nf_nat_ftp modprobe nf_conntrack_ftp modprobe nf_nat modprobe nf_conntrack_ipv4 modprobe nf_conntrack modprobe nat modprobe ip_tables modprobe ip_conntrack modprobe ip_conntrack_ftp modprobe iptables_module modprobe ipt_helper modprobe ipt_REDIRECT modprobe ipt_TCPMSS modprobe ipt_LOG modprobe ipt_TOS modprobe iptable_nat modprobe ipt_length modprobe ipt_tcpmss modprobe iptable_mangle modprobe ipt_tos modprobe iptable_filter modprobe ipt_ttl modprobe ipt_SAME modprobe ipt_REJECT modprobe ipt_owner modprobe ipt_MASQUERADE modprobe ipt_multiport/xt_multiport modprobe ipt_state/xt_state modprobe ipt_limit/xt_limit modprobe ipt_recent modprobe xt_connlimit modprobe ipt_owner/xt_owner modprobe iptable_nat/ipt_DNAT modprobe iptable_nat/ipt_REDIRECT |
Selanjutnya, silakan restart Dedicated Servernya, dan buatlah Container pertama Anda 🙂
Untuk seting DNS, silakan diisi seperti berikut :
|
1 |
8.8.8.8 8.8.4.4 2001:4860:4860::8888 2001:4860:4860::8844 |
Karena Dedibox SC Gen2 hanya memiliki 1 IPv4 secara default, maka agar kita bisa mengakses masing-masing Container/OpenVZ VPS yang kita buat, kita memerlukan portforwarding.
Misalnya vm100 kita memiliki IPv4 192.168.1.100, maka berikut adalah contoh agar ketika kita ingin connect ke SSH melalui Port Host akan dilewatkan ke port 22 di Container :
|
1 |
iptables -t nat -A PREROUTING -i vmbr0 -p tcp -m tcp --dport 10022 -j DNAT --to-destination 192.168.1.100:22 |
Silakan menyesuaikan keperluan port foward dengan yang diinginkan.
Saat ini, Container tidak memiliki akses ke internet sehingga perlu dilakukan portforward dari vm ke network card host :
|
1 |
iptables -t nat -A POSTROUTING -o vmbr0 -j SNAT --to ip.address.dedicated |
Silakan disesuaikan antara vmbr atau eth0 yang mau dipakai.
Menyimpan iptables :
|
1 2 |
iptables-save > /etc/iptables.conf nano /etc/network/if-pre-up.d/iptables |
Berikut adalah isi dari /etc/network/if-pre-up.d/iptables :
|
1 2 |
#!/bin/sh iptables-restore < /etc/iptables.conf |
Seting chmodnya :
|
1 |
chmod +x /etc/network/if-pre-up.d/iptables |
Menambahkan IPv6 ke Container
|
1 2 3 |
vzctl stop 100 vzctl set 100 --ipadd 2001:470:1f12:254::2 --save Disini container memiliki ID 100, silakan disesuaikan dengan ID Container Anda |
Selanjutnya silakan login ke Container/OpenVZ vpsnya dan dicoba koneksi internet dari dalam Container/VPS 🙂
Jika berhasil, maka Anda tinggal membuat Container lain dan menambahkan IPv6 secara manual
Setting Tun/Tap
Sebelum melakukan perintah berikut, silakan distop Containernya :
|
1 |
vzctl stop VEID |
Seting tun/tap di Containernya :
|
1 2 3 4 5 6 7 8 9 |
CTID=101 vzctl set $CTID --devnodes net/tun:rw --save vzctl set $CTID --devices c:10:200:rw --save Matikan Container terlebih dahulu vzctl set $CTID --capability net_admin:on --save Nyalakan Container vzctl exec $CTID mkdir -p /dev/net vzctl exec $CTID mknod /dev/net/tun c 10 200 vzctl exec $CTID chmod 600 /dev/net/tun |
Setelah itu, silakan direstart containernya, dan berikut adalah contoh file konfigurasi untuk server openvpn atau /etc/openvpn/openvpn.conf :
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 |
local 192.xxx.xxx.xxx <-- ip lokal dari container port 1194 proto udp dev tun tun-mtu 1500 tun-mtu-extra 32 mssfix 1450 ca ca.crt cert server.crt key server.key dh dh1024.pem plugin /etc/openvpn/openvpn-auth-pam.so /etc/pam.d/login client-cert-not-required username-as-common-name server 10.8.0.0 255.255.255.0 push "redirect-gateway def1" push "dhcp-option DNS 208.67.222.222" push "dhcp-option DNS 4.2.2.1" keepalive 5 30 comp-lzo persist-key persist-tun status 1194.log verb 3 |
Berikut adalah contoh file konfigurasi untuk Client atau client.ovpn :
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
client dev tun proto udp #- protocol remote 195.154.xxx.xxx 10094 <-- ip ini adalah ip dari host, dan portnya adalah port yang diforward ke port vpn container resolv-retry infinite nobind tun-mtu 1500 tun-mtu-extra 32 mssfix 1450 persist-key persist-tun ca ca.crt auth-user-pass comp-lzo verb 3 |
Berikut adalah contoh port fowarding di Host :
|
1 |
iptables -t nat -A PREROUTING -i vmbr0 -p udp -m udp --dport 10094 -j DNAT --to-destination 192.168.1.100:1194 |
Berikut adalah setingan iptables di Container :
|
1 |
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to 192.168.1.100 |
Jadi singkatnya, permintaan koneksi vpn dari komputer atau client ke container akan dilewatkan dari port 10094 Host ke port 1194 Container.
Berikut adalah contoh sederhana benchmark vps yang dibuat di Dedibox SC Gen 2 :
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
# wget freevps.us/downloads/bench.sh -O - -o /dev/null|bash CPU model : VIA Nano processor U2250 (1.6GHz Capable) Number of cores : 1 CPU frequency : 1596.053 MHz Total amount of ram : 128 MB Total amount of swap : 128 MB System uptime : 1:45, Download speed from CacheFly: 31.5MB/s Download speed from Coloat, Atlanta GA: 12.9MB/s Download speed from Softlayer, Dallas, TX: 10.7MB/s Download speed from Linode, Tokyo, JP: 4.78MB/s Download speed from i3d.net, NL: Download speed from Leaseweb, Haarlem, NL: 17.6MB/s Download speed from Softlayer, Singapore: 361KB/s Download speed from Softlayer, Seattle, WA: 8.32MB/s Download speed from Softlayer, San Jose, CA: 343KB/s Download speed from Softlayer, Washington, DC: 15.2MB/s I/O speed : 60.1 MB/s |
Berikut adalah contoh speedtestnya :
Semoga berhasil dan tutorialnya bermanfaat ya 🙂