{"id":31065,"date":"2025-10-05T08:41:14","date_gmt":"2025-10-05T05:41:14","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/?p=31065"},"modified":"2025-10-05T08:41:14","modified_gmt":"2025-10-05T05:41:14","slug":"debian-9-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/debian-9-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/","title":{"rendered":"Debian 9 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber"},"content":{"rendered":"

<\/p>\n

Debian 9 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber<\/h2>\n

OpenVPN, g\u00fcvenli ve \u015fifrelenmi\u015f bir ba\u011flant\u0131 olu\u015fturarak internet trafi\u011finizi koruman\u0131za olanak tan\u0131yan pop\u00fcler bir a\u00e7\u0131k kaynakl\u0131 Sanal \u00d6zel A\u011f (VPN) \u00e7\u00f6z\u00fcm\u00fcd\u00fcr. \u0130nternet servis sa\u011flay\u0131c\u0131n\u0131z\u0131n (\u0130SS) veya halka a\u00e7\u0131k Wi-Fi a\u011flar\u0131n\u0131n potansiyel g\u00f6zetiminden korunmak, co\u011frafi k\u0131s\u0131tlamal\u0131 i\u00e7eriklere eri\u015fmek veya uzak bir a\u011fa g\u00fcvenli bir \u015fekilde ba\u011flanmak i\u00e7in OpenVPN kullanabilirsiniz. Bu kapsaml\u0131 rehberde, Debian 9 i\u015fletim sistemi kurulu bir sunucu \u00fczerinde ad\u0131m ad\u0131m OpenVPN sunucusu kurulumunu ve yap\u0131land\u0131rmas\u0131n\u0131 ele alaca\u011f\u0131z.<\/p>\n

Giri\u015f: OpenVPN ve \u00d6nemi<\/h3>\n

G\u00fcn\u00fcm\u00fcz dijital \u00e7a\u011f\u0131nda \u00e7evrimi\u00e7i g\u00fcvenlik ve gizlilik her zamankinden daha kritik hale gelmi\u015ftir. \u0130nternet trafi\u011fimiz, \u0130SS’ler, devlet kurumlar\u0131 ve k\u00f6t\u00fc niyetli akt\u00f6rler taraf\u0131ndan izlenebilir, kaydedilebilir ve analiz edilebilir. \u0130\u015fte bu noktada VPN’ler devreye girer. VPN, internet ba\u011flant\u0131n\u0131z\u0131 \u015fifreleyerek ve trafi\u011finizi uzak bir sunucu \u00fczerinden y\u00f6nlendirerek \u00e7evrimi\u00e7i kimli\u011finizi ve verilerinizi korur.<\/p>\n

OpenVPN, esnekli\u011fi, g\u00fc\u00e7l\u00fc \u015fifreleme yetenekleri ve a\u00e7\u0131k kaynak kodlu yap\u0131s\u0131yla \u00f6ne \u00e7\u0131kan bir VPN protokol\u00fcd\u00fcr. Bu \u00f6zellikleri sayesinde hem bireysel kullan\u0131c\u0131lar hem de kurumsal ortamlar i\u00e7in tercih edilen bir \u00e7\u00f6z\u00fcmd\u00fcr. Debian 9 ise kararl\u0131l\u0131\u011f\u0131, g\u00fcvenilirli\u011fi ve geni\u015f paket depolar\u0131 sayesinde sunucu sistemleri i\u00e7in ideal bir platformdur. Bu rehberde, bu iki g\u00fc\u00e7l\u00fc arac\u0131 bir araya getirerek kendi g\u00fcvenli VPN sunucunuzu nas\u0131l kuraca\u011f\u0131n\u0131z\u0131 detayl\u0131 bir \u015fekilde a\u00e7\u0131klayaca\u011f\u0131z.<\/p>\n

\u00d6n Gereksinimler<\/h3>\n

Kuruluma ba\u015flamadan \u00f6nce a\u015fa\u011f\u0131daki \u00f6n gereksinimleri kar\u015f\u0131lad\u0131\u011f\u0131n\u0131zdan emin olun:<\/p>\n

* Debian 9 Sunucu:<\/strong> \u0130nternet eri\u015fimi olan, Debian 9 (Stretch) i\u015fletim sistemi kurulu bir sanal \u00f6zel sunucu (VPS) veya fiziksel sunucuya ihtiyac\u0131n\u0131z var. Sunucunuzun en az 512 MB RAM’e sahip olmas\u0131 \u00f6nerilir.
\n* Root Eri\u015fimi veya Sudo Yetkileri:<\/strong> Sunucuda komutlar\u0131 \u00e7al\u0131\u015ft\u0131rmak i\u00e7in root kullan\u0131c\u0131s\u0131 olarak oturum a\u00e7m\u0131\u015f olman\u0131z veya sudo<\/code> yetkilerine sahip bir kullan\u0131c\u0131 hesab\u0131n\u0131z\u0131n bulunmas\u0131 gerekmektedir.
\n* Statik Genel IP Adresi:<\/strong> OpenVPN sunucunuzun sabit bir genel IP adresine sahip olmas\u0131 \u015fartt\u0131r, b\u00f6ylece istemciler sunucuya her zaman ayn\u0131 adres \u00fczerinden ba\u011flanabilir.
\n* Temel Linux Komut Bilgisi:<\/strong> Temel Linux komut sat\u0131r\u0131 bilgisine (dizinlerde gezinme, dosya d\u00fczenleme vb.) sahip olman\u0131z kurulum s\u00fcrecini kolayla\u015ft\u0131racakt\u0131r.
\n* G\u00fcvenlik Duvar\u0131 Bilgisi:<\/strong> Sunucunuzda kurulu bir g\u00fcvenlik duvar\u0131 (\u00f6rn. UFW veya iptables) varsa, OpenVPN’in kullanaca\u011f\u0131 portlar\u0131n a\u00e7\u0131lmas\u0131 gerekecektir.<\/p>\n

Ad\u0131m 1: Sunucuyu G\u00fcncelleme ve Gerekli Paketleri Kurma<\/h3>\n

Herhangi bir kuruluma ba\u015flamadan \u00f6nce, sisteminizin g\u00fcncel oldu\u011fundan ve gerekli paketlerin y\u00fckl\u00fc oldu\u011fundan emin olmak iyi bir uygulamad\u0131r.<\/p>\n

SSH \u00fczerinden sunucunuza ba\u011flan\u0131n ve a\u015fa\u011f\u0131daki komutlar\u0131 \u00e7al\u0131\u015ft\u0131rarak paket listesini g\u00fcncelleyin ve y\u00fckl\u00fc paketleri y\u00fckseltin:<\/p>\n

sudo apt update\nsudo apt upgrade -y<\/code><\/pre>\n
Ard\u0131ndan, OpenVPN sunucusunu ve sertifika olu\u015fturmak i\u00e7in kullanaca\u011f\u0131m\u0131z Easy-RSA yard\u0131mc\u0131 program\u0131n\u0131 y\u00fckleyin:<\/p>\n
sudo apt install openvpn easy-rsa -y<\/code><\/pre>\n
Bu komutlar, OpenVPN sunucu yaz\u0131l\u0131m\u0131n\u0131 ve SSL\/TLS sertifikalar\u0131 ile anahtarlar\u0131 olu\u015fturmak i\u00e7in gerekli olan Easy-RSA paketini sisteminize kuracakt\u0131r.<\/p>\n
Ad\u0131m 2: Sertifika Yetkilisi (CA) ve Sunucu Sertifikalar\u0131n\u0131 Olu\u015fturma<\/h3>\n
OpenVPN, istemci ve sunucu aras\u0131ndaki ileti\u015fimi \u015fifrelemek ve kimlik do\u011frulamas\u0131 yapmak i\u00e7in SSL\/TLS sertifikalar\u0131n\u0131 kullan\u0131r. Bu sertifikalar\u0131 olu\u015fturmak i\u00e7in Easy-RSA arac\u0131n\u0131 kullanaca\u011f\u0131z.<\/p>\n
Easy-RSA Kullan\u0131m\u0131<\/h4>\n
\u0130lk olarak, Easy-RSA komut dosyalar\u0131n\u0131 OpenVPN yap\u0131land\u0131rma dizinine kopyalamam\u0131z gerekiyor. Bu, orijinal dosyalar\u0131 de\u011fi\u015ftirmeden kendi sertifika yetkilinizi (CA) olu\u015fturman\u0131z\u0131 sa\u011flar.<\/p>\n
sudo cp -r \/usr\/share\/easy-rsa\/ \/etc\/openvpn\/easy-rsa<\/code><\/pre>\n
\u015eimdi Easy-RSA dizinine ge\u00e7in:<\/p>\n
cd \/etc\/openvpn\/easy-rsa<\/code><\/pre>\n
Easy-RSA’n\u0131n PKI (Public Key Infrastructure) dizinini ba\u015flat\u0131n. Bu i\u015flem, sertifika yetkilisi i\u00e7in gerekli dizin yap\u0131s\u0131n\u0131 ve dosyalar\u0131 olu\u015fturacakt\u0131r.<\/p>\n
sudo .\/easyrsa init-pki<\/code><\/pre>\n
\u015eimdi kendi Sertifika Yetkilinizi (CA) olu\u015fturaca\u011f\u0131z. CA, di\u011fer t\u00fcm sertifikalar\u0131 imzalayacak olan ana sertifikad\u0131r.<\/p>\n
sudo .\/easyrsa build-ca nopass<\/code><\/pre>\n
nopass<\/code> se\u00e7ene\u011fi, CA anahtar\u0131n\u0131z i\u00e7in bir parola belirlemenizi istemez. G\u00fcvenlik a\u00e7\u0131s\u0131ndan bir parola belirlemek daha iyidir ancak sunucunun otomatik olarak yeniden ba\u015flat\u0131lmas\u0131 durumunda m\u00fcdahale gerektirmemesi i\u00e7in nopass<\/code> kullan\u0131labilir. E\u011fer parola belirlemek isterseniz nopass<\/code> se\u00e7ene\u011fini kald\u0131r\u0131n. Komut sizden CA i\u00e7in ortak bir ad (Common Name) girmenizi isteyecektir (\u00f6rn. MyOpenVPNCA<\/code>).<\/p>\n
Ard\u0131ndan, OpenVPN sunucusu i\u00e7in bir anahtar ve sertifika iste\u011fi olu\u015fturun:<\/p>\n
sudo .\/easyrsa gen-req server nopass<\/code><\/pre>\n
Burada da nopass<\/code> se\u00e7ene\u011fini kullanarak anahtar i\u00e7in parola belirlemeyi atlayabilirsiniz. Ortak ad olarak server<\/code> girmeniz \u00f6nerilir.<\/p>\n
\u015eimdi sunucu sertifika iste\u011fini CA’n\u0131zla imzalay\u0131n. Bu i\u015flem, CA’n\u0131n sunucu sertifikas\u0131n\u0131n g\u00fcvenilir oldu\u011funu onaylamas\u0131n\u0131 sa\u011flar.<\/p>\n
sudo .\/easyrsa sign-req server server<\/code><\/pre>\n
Sizden yes<\/code> yazarak i\u015flemi onaylaman\u0131z istenecektir.<\/p>\n
Diffie-Hellman parametrelerini olu\u015fturun. Bu parametreler, istemci ve sunucu aras\u0131nda g\u00fcvenli bir anahtar de\u011fi\u015fimi i\u00e7in kullan\u0131l\u0131r. Bu ad\u0131m biraz zaman alabilir (CPU g\u00fcc\u00fcne ba\u011fl\u0131 olarak birka\u00e7 dakika ila yar\u0131m saat veya daha fazla).<\/p>\n
sudo .\/easyrsa gen-dh<\/code><\/pre>\n
Son olarak, TLS kimlik do\u011frulamas\u0131 i\u00e7in bir HMAC imzas\u0131 (ta.key) olu\u015fturun. Bu anahtar, sunucuya g\u00f6nderilen her kontrol paketi i\u00e7in bir karma olu\u015fturarak DDoS sald\u0131r\u0131lar\u0131n\u0131 ve port taramas\u0131n\u0131 \u00f6nlemeye yard\u0131mc\u0131 olur. Ayr\u0131ca, \u015fifreleme ve kimlik do\u011frulama i\u00e7in ek bir g\u00fcvenlik katman\u0131 sa\u011flar.<\/p>\n
sudo openvpn --genkey --secret ta.key<\/code><\/pre>\n
Bu ad\u0131mlarla, OpenVPN sunucunuz i\u00e7in gerekli t\u00fcm sertifika ve anahtarlar\u0131 olu\u015fturmu\u015f oldunuz.<\/p>\n
Ad\u0131m 3: OpenVPN Sunucu Yap\u0131land\u0131rmas\u0131<\/h3>\n
Sertifikalar haz\u0131r oldu\u011funa g\u00f6re, OpenVPN sunucusunu yap\u0131land\u0131rmaya ge\u00e7ebiliriz.<\/p>\n
Yap\u0131land\u0131rma Dosyas\u0131n\u0131 Olu\u015fturma<\/h4>\n
OpenVPN sunucu yap\u0131land\u0131rma dosyas\u0131 \/etc\/openvpn\/server.conf<\/code> dizininde bulunur. Bu dosyay\u0131 olu\u015fturmak ve d\u00fczenlemek i\u00e7in bir metin d\u00fczenleyici kullan\u0131n (\u00f6rne\u011fin nano<\/code>):<\/p>\n
sudo nano \/etc\/openvpn\/server.conf<\/code><\/pre>\n
A\u015fa\u011f\u0131daki yap\u0131land\u0131rma parametrelerini dosyaya yap\u0131\u015ft\u0131r\u0131n. Bu yap\u0131land\u0131rma, \u00e7o\u011fu kullan\u0131m senaryosu i\u00e7in iyi bir ba\u015flang\u0131\u00e7 noktas\u0131d\u0131r.<\/p>\n
port 1194\nproto udp\ndev tun\n\nca ca.crt\ncert server.crt\nkey server.key\ndh dh.pem\ntls-auth ta.key 0 # Bu sat\u0131r sunucu taraf\u0131 i\u00e7in 0 olmal\u0131\n\ntopology subnet\nserver 10.8.0.0 255.255.255.0\nifconfig-pool-persist ipp.txt\n\npush \"redirect-gateway def1 bypass-dhcp\"\npush \"dhcp-option DNS 8.8.8.8\"\npush \"dhcp-option DNS 8.8.4.4\"\n\nkeepalive 10 120\n\ncipher AES-256-CBC\nauth SHA256\n\nuser nobody\ngroup nogroup\n\npersist-key\npersist-tun\n\nstatus \/var\/log\/openvpn\/openvpn-status.log\nlog-append \/var\/log\/openvpn\/openvpn.log\nverb 3\nexplicit-exit-notify 1<\/code><\/pre>\n
Bu parametrelerin her birini k\u0131saca a\u00e7\u0131klayal\u0131m:<\/p>\n
*   port 1194<\/code>: OpenVPN’in dinleyece\u011fi port numaras\u0131d\u0131r. Varsay\u0131lan olarak 1194’t\u00fcr.
\n*   proto udp<\/code>: \u0130leti\u015fim protokol\u00fcd\u00fcr. UDP (User Datagram Protocol) genellikle TCP’ye g\u00f6re daha h\u0131zl\u0131d\u0131r ve VPN i\u00e7in tercih edilir.
\n*   dev tun<\/code>: Sanal a\u011f aray\u00fcz\u00fc tipidir. Katman 3 IP t\u00fcnellemesi i\u00e7in tun<\/code> kullan\u0131l\u0131r.
\n*   ca ca.crt<\/code>: Sertifika yetkilisi (CA) sertifika dosyas\u0131n\u0131n yoludur.
\n*   cert server.crt<\/code>: Sunucu sertifika dosyas\u0131n\u0131n yoludur.
\n*   key server.key<\/code>: Sunucu \u00f6zel anahtar dosyas\u0131n\u0131n yoludur.
\n*   dh dh.pem<\/code>: Diffie-Hellman parametre dosyas\u0131n\u0131n yoludur.
\n*   tls-auth ta.key 0<\/code>: TLS kimlik do\u011frulama anahtar\u0131n\u0131n yoludur. 0<\/code> sunucu taraf\u0131 oldu\u011funu belirtir.
\n*   topology subnet<\/code>: \u0130stemcilere IP adresleri atamak i\u00e7in alt a\u011f topolojisi kullan\u0131r. Bu, modern OpenVPN s\u00fcr\u00fcmleri i\u00e7in \u00f6nerilir ve istemci yap\u0131land\u0131rmas\u0131n\u0131 basitle\u015ftirir.
\n*   server 10.8.0.0 255.255.255.0<\/code>: VPN istemcilerinin ba\u011flanaca\u011f\u0131 sanal a\u011f\u0131n IP aral\u0131\u011f\u0131 ve alt a\u011f maskesidir. Bu, ger\u00e7ek a\u011f\u0131n\u0131zla \u00e7ak\u0131\u015fmamal\u0131d\u0131r.
\n*   ifconfig-pool-persist ipp.txt<\/code>: Ba\u011flanan istemcilerin IP adreslerini kaydeder, b\u00f6ylece ayn\u0131 istemci her ba\u011fland\u0131\u011f\u0131nda ayn\u0131 IP adresini al\u0131r.
\n*   push \"redirect-gateway def1 bypass-dhcp\"<\/code>: \u0130stemcilere t\u00fcm internet trafi\u011fini VPN t\u00fcneli \u00fczerinden y\u00f6nlendirmelerini s\u00f6yler.
\n*   push \"dhcp-option DNS 8.8.8.8\"<\/code>: \u0130stemcilere Google’\u0131n DNS sunucular\u0131n\u0131 kullanmalar\u0131n\u0131 s\u00f6yler. Kendi DNS sunucular\u0131n\u0131z\u0131 veya farkl\u0131 bir DNS hizmetini (\u00f6rn. Cloudflare 1.1.1.1) kullanabilirsiniz.
\n*   keepalive 10 120<\/code>: Ba\u011flant\u0131n\u0131n canl\u0131 tutulmas\u0131 i\u00e7in g\u00f6nderilen kontrol paketlerinin s\u0131kl\u0131\u011f\u0131n\u0131 ve ba\u011flant\u0131n\u0131n kopuk say\u0131lmadan \u00f6nce beklenecek s\u00fcreyi belirler.
\n*   cipher AES-256-CBC<\/code>: Veri \u015fifrelemesi i\u00e7in kullan\u0131lacak algoritmad\u0131r. AES-256-CBC g\u00fc\u00e7l\u00fc bir \u015fifreleme sa\u011flar. AES-256-GCM de daha modern ve performansl\u0131 bir se\u00e7enektir, ancak istemci deste\u011fi de gerektirir.
\n*   auth SHA256<\/code>: Veri kimlik do\u011frulamas\u0131 i\u00e7in kullan\u0131lacak algoritmad\u0131r. SHA256 g\u00fc\u00e7l\u00fc bir karma algoritmas\u0131d\u0131r.
\n*   user nobody<\/code>, group nogroup<\/code>: G\u00fcvenlik amac\u0131yla OpenVPN’in ayr\u0131cal\u0131ks\u0131z bir kullan\u0131c\u0131 ve grup alt\u0131nda \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flar.
\n*   persist-key<\/code>, persist-tun<\/code>: Yeniden ba\u011flant\u0131 durumunda anahtarlar\u0131n ve tun cihaz\u0131n\u0131n yeniden y\u00fcklenmesini \u00f6nler, bu da ba\u011flant\u0131 kesintilerini azalt\u0131r.
\n*   status \/var\/log\/openvpn\/openvpn-status.log<\/code>: Ba\u011flant\u0131 durum bilgilerinin kaydedilece\u011fi dosya.
\n*   log-append \/var\/log\/openvpn\/openvpn.log<\/code>: Loglar\u0131n kaydedilece\u011fi dosya.
\n*   verb 3<\/code>: Log detay seviyesini ayarlar. 3<\/code> orta seviye detayd\u0131r, sorun giderme i\u00e7in art\u0131r\u0131labilir (4<\/code> veya 5<\/code>).
\n*   explicit-exit-notify 1<\/code>: \u0130stemcinin sunucuya ba\u011flant\u0131y\u0131 sonland\u0131rd\u0131\u011f\u0131n\u0131 bildirmesini sa\u011flar.<\/p>\n
Dosyay\u0131 kaydedin ve kapat\u0131n (nano’da Ctrl+O<\/code>, Enter<\/code>, Ctrl+X<\/code>).<\/p>\n
Gerekli Dosyalar\u0131 Kopyalama<\/h4>\n
\u015eimdi Easy-RSA ile olu\u015fturdu\u011fumuz sertifika ve anahtar dosyalar\u0131n\u0131 OpenVPN yap\u0131land\u0131rma dizinine kopyalamam\u0131z gerekiyor:<\/p>\n
sudo cp \/etc\/openvpn\/easy-rsa\/pki\/ca.crt \/etc\/openvpn\/\nsudo cp \/etc\/openvpn\/easy-rsa\/pki\/issued\/server.crt \/etc\/openvpn\/\nsudo cp \/etc\/openvpn\/easy-rsa\/pki\/private\/server.key \/etc\/openvpn\/\nsudo cp \/etc\/openvpn\/easy-rsa\/pki\/dh.pem \/etc\/openvpn\/\nsudo cp \/etc\/openvpn\/easy-rsa\/ta.key \/etc\/openvpn\/<\/code><\/pre>\n
Bu dosyalar\u0131n do\u011fru dizinde olmas\u0131, OpenVPN sunucusunun ba\u015flamas\u0131 i\u00e7in kritik \u00f6neme sahiptir.<\/p>\n
Ad\u0131m 4: A\u011f Y\u00f6nlendirmeyi Etkinle\u015ftirme<\/h3>\n
OpenVPN sunucusunun istemcilerden gelen trafi\u011fi internete y\u00f6nlendirebilmesi i\u00e7in IP y\u00f6nlendirme (IP forwarding) \u00f6zelli\u011finin etkinle\u015ftirilmesi gerekmektedir.<\/p>\n
\/etc\/sysctl.conf<\/code> dosyas\u0131n\u0131 a\u00e7\u0131n:<\/p>\n
sudo nano \/etc\/sysctl.conf<\/code><\/pre>\n
Dosya i\u00e7inde net.ipv4.ip_forward=1<\/code> sat\u0131r\u0131n\u0131 bulun ve ba\u015f\u0131ndaki #<\/code> i\u015faretini kald\u0131rarak yorum sat\u0131r\u0131 olmaktan \u00e7\u0131kar\u0131n. E\u011fer yoksa, dosyan\u0131n sonuna ekleyebilirsiniz.<\/p>\n
net.ipv4.ip_forward=1<\/code><\/pre>\n
Dosyay\u0131 kaydedin ve kapat\u0131n. De\u011fi\u015fiklikleri hemen uygulamak i\u00e7in a\u015fa\u011f\u0131daki komutu \u00e7al\u0131\u015ft\u0131r\u0131n:<\/p>\n
sudo sysctl -p<\/code><\/pre>\n
Bu komut, \u00e7ekirdek parametrelerini yeniden y\u00fckler ve IP y\u00f6nlendirmeyi etkinle\u015ftirir.<\/p>\n
Ad\u0131m 5: G\u00fcvenlik Duvar\u0131n\u0131 Yap\u0131land\u0131rma<\/h3>\n
G\u00fcvenlik duvar\u0131, sunucunuzu yetkisiz eri\u015fimden korumak i\u00e7in \u00f6nemlidir. OpenVPN’in \u00e7al\u0131\u015fabilmesi i\u00e7in belirli portlar\u0131n a\u00e7\u0131lmas\u0131 ve VPN trafi\u011finin y\u00f6nlendirilmesi i\u00e7in NAT (Network Address Translation) kurallar\u0131n\u0131n eklenmesi gerekmektedir. Debian sistemlerde yayg\u0131n olarak UFW (Uncomplicated Firewall) veya iptables kullan\u0131l\u0131r.<\/p>\n
UFW Kullan\u0131m\u0131<\/h4>\n
E\u011fer sunucunuzda UFW y\u00fckl\u00fc ve etkinse, a\u015fa\u011f\u0131daki ad\u0131mlar\u0131 izleyin:<\/p>\n
SSH ba\u011flant\u0131n\u0131z\u0131n kesilmemesi i\u00e7in \u00f6ncelikle SSH portunu (varsay\u0131lan 22) a\u00e7\u0131n:<\/p>\n
sudo ufw allow OpenSSH<\/code><\/pre>\n
Ard\u0131ndan, OpenVPN’in kulland\u0131\u011f\u0131 portu (varsay\u0131lan 1194\/udp) a\u00e7\u0131n:<\/p>\n
sudo ufw allow 1194\/udp<\/code><\/pre>\n
UFW’nin varsay\u0131lan y\u00f6nlendirme politikas\u0131n\u0131 de\u011fi\u015ftirmemiz gerekiyor. \/etc\/default\/ufw<\/code> dosyas\u0131n\u0131 a\u00e7\u0131n:<\/p>\n
sudo nano \/etc\/default\/ufw<\/code><\/pre>\n
DEFAULT_FORWARD_POLICY=\"DROP\"<\/code> sat\u0131r\u0131n\u0131 bulun ve DEFAULT_FORWARD_POLICY=\"ACCEPT\"<\/code> olarak de\u011fi\u015ftirin.<\/p>\n
\u015eimdi NAT kurallar\u0131n\u0131 eklememiz gerekiyor. \/etc\/ufw\/before.rules<\/code> dosyas\u0131n\u0131 a\u00e7\u0131n:<\/p>\n
sudo nano \/etc\/ufw\/before.rules<\/code><\/pre>\n
Dosyan\u0131n en ba\u015f\u0131na (yani *filter<\/code> sat\u0131r\u0131ndan \u00f6nce) a\u015fa\u011f\u0131daki NAT kurallar\u0131n\u0131 ekleyin:<\/p>\n
# NAT table rules\n*nat\n:POSTROUTING ACCEPT [0:0]\n-A POSTROUTING -s 10.8.0.0\/24 -o eth0 -j MASQUERADE\nCOMMIT\n\n
End NAT table rules<\/code><\/pre>\n<\/h2>\n
\u00d6NEML\u0130:<\/strong> -o eth0<\/code> k\u0131sm\u0131ndaki eth0<\/code> de\u011ferini sunucunuzun internete \u00e7\u0131kan ana a\u011f aray\u00fcz\u00fc ile de\u011fi\u015ftirmeniz gerekebilir. Bu aray\u00fcz\u00fc ip a<\/code> komutunu \u00e7al\u0131\u015ft\u0131rarak bulabilirsiniz (genellikle eth0<\/code> veya ens3<\/code>, enp0s3<\/code> gibi bir isimdir). 10.8.0.0\/24<\/code> ise OpenVPN a\u011f\u0131n\u0131z\u0131n IP aral\u0131\u011f\u0131d\u0131r, server.conf<\/code> dosyas\u0131nda belirledi\u011finizle ayn\u0131 olmal\u0131d\u0131r.<\/p>\n
Dosyay\u0131 kaydedin ve kapat\u0131n. De\u011fi\u015fikliklerin etkili olmas\u0131 i\u00e7in UFW’yi devre d\u0131\u015f\u0131 b\u0131rak\u0131p tekrar etkinle\u015ftirin:<\/p>\n
sudo ufw disable\nsudo ufw enable<\/code><\/pre>\n
Size Command may disrupt existing ssh connections. Proceed with operation (y|n)?<\/code> diye sorarsa y<\/code> yaz\u0131p onaylay\u0131n.<\/p>\n
IPTables Kullan\u0131m\u0131<\/h4>\n
E\u011fer UFW kullanm\u0131yorsan\u0131z veya iptables’\u0131 tercih ediyorsan\u0131z, a\u015fa\u011f\u0131daki kurallar\u0131 uygulaman\u0131z gerekir. Bu kurallar kal\u0131c\u0131 de\u011fildir, sunucu yeniden ba\u015flat\u0131ld\u0131\u011f\u0131nda kaybolurlar. Kal\u0131c\u0131 hale getirmek i\u00e7in iptables-persistent<\/code> gibi bir paket kullanman\u0131z \u00f6nerilir.<\/p>\n
# Gelen OpenVPN trafi\u011fine izin ver\nsudo iptables -A INPUT -i tun+ -j ACCEPT\nsudo iptables -A FORWARD -i tun+ -j ACCEPT\nsudo iptables -A FORWARD -o tun+ -j ACCEPT\n\n
VPN trafi\u011finin ana a\u011f aray\u00fcz\u00fc \u00fczerinden \u00e7\u0131kmas\u0131na izin ver<\/h2>\n
eth0 yerine kendi ana a\u011f aray\u00fcz\u00fcn\u00fcz\u00fc kullan\u0131n<\/h2>\nsudo iptables -A FORWARD -i tun+ -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT\nsudo iptables -A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT\n\n
NAT kural\u0131 (VPN trafi\u011fini internete y\u00f6nlendirmek i\u00e7in)<\/h2>\n
eth0 yerine kendi ana a\u011f aray\u00fcz\u00fcn\u00fcz\u00fc kullan\u0131n<\/h2>\nsudo iptables -t nat -A POSTROUTING -s 10.8.0.0\/24 -o eth0 -j MASQUERADE\n\n
OpenVPN portunu a\u00e7<\/h2>\nsudo iptables -A INPUT -p udp --dport 1194 -j ACCEPT<\/code><\/pre>\n
Kurallar\u0131 kal\u0131c\u0131 hale getirmek i\u00e7in:<\/p>\n
sudo apt install iptables-persistent -y\nsudo netfilter-persistent save<\/code><\/pre>\n
Bu komutlar, mevcut iptables kurallar\u0131n\u0131 kaydedecek ve sunucu yeniden ba\u015flat\u0131ld\u0131\u011f\u0131nda otomatik olarak y\u00fcklenmelerini sa\u011flayacakt\u0131r.<\/p>\n
Ad\u0131m 6: OpenVPN Hizmetini Ba\u015flatma ve Etkinle\u015ftirme<\/h3>\n
T\u00fcm yap\u0131land\u0131rmalar tamamland\u0131ktan sonra OpenVPN hizmetini ba\u015flatabilir ve sistem ba\u015flang\u0131c\u0131nda otomatik olarak ba\u015flamas\u0131 i\u00e7in etkinle\u015ftirebiliriz.<\/p>\n
sudo systemctl start openvpn@server\nsudo systemctl enable openvpn@server<\/code><\/pre>\n
Hizmetin durumunu kontrol etmek ve herhangi bir hata olup olmad\u0131\u011f\u0131n\u0131 g\u00f6rmek i\u00e7in:<\/p>\n
sudo systemctl status openvpn@server<\/code><\/pre>\n
E\u011fer her \u015fey yolundaysa, \u00e7\u0131kt\u0131da Active: active (running)<\/code> ifadesini g\u00f6rmelisiniz. Herhangi bir hata durumunda, log dosyalar\u0131n\u0131 kontrol edin (\/var\/log\/openvpn\/openvpn.log<\/code> veya journalctl -u openvpn@server.service<\/code>).<\/p>\n
Ad\u0131m 7: \u0130stemci Yap\u0131land\u0131rmas\u0131 ve Sertifikalar\u0131 Olu\u015fturma<\/h3>\n
OpenVPN sunucunuz art\u0131k \u00e7al\u0131\u015f\u0131yor. \u015eimdi istemcilerin ba\u011flanabilmesi i\u00e7in istemci sertifikalar\u0131 olu\u015fturmam\u0131z ve bir istemci yap\u0131land\u0131rma dosyas\u0131 haz\u0131rlamam\u0131z gerekiyor.<\/p>\n
\u0130stemci Sertifikas\u0131 Olu\u015fturma<\/h4>\n
Her istemci i\u00e7in ayr\u0131 bir sertifika ve anahtar \u00e7ifti olu\u015fturmak en iyi g\u00fcvenlik uygulamas\u0131d\u0131r. Bu, belirli bir istemcinin eri\u015fimini iptal etmeniz gerekti\u011finde di\u011fer istemcilerin etkilenmemesini sa\u011flar.<\/p>\n
Easy-RSA dizinine geri d\u00f6n\u00fcn:<\/p>\n
cd \/etc\/openvpn\/easy-rsa<\/code><\/pre>\n
Yeni bir istemci i\u00e7in anahtar ve sertifika iste\u011fi olu\u015fturun (\u00f6rne\u011fin client1<\/code> ad\u0131nda):<\/p>\n
sudo .\/easyrsa gen-req client1 nopass<\/code><\/pre>\n
\u0130stemci iste\u011fini CA’n\u0131zla imzalay\u0131n:<\/p>\n
sudo .\/easyrsa sign-req client client1<\/code><\/pre>\n
yes<\/code> yazarak onaylay\u0131n.<\/p>\n
\u0130stemci Yap\u0131land\u0131rma Dosyas\u0131 Olu\u015fturma<\/h4>\n
\u0130stemcilerinize da\u011f\u0131taca\u011f\u0131n\u0131z tek bir .ovpn<\/code> dosyas\u0131 olu\u015fturmak i\u00e7in, t\u00fcm gerekli sertifika ve anahtarlar\u0131 i\u00e7eren bir betik kullanaca\u011f\u0131z.<\/p>\n
\u0130lk olarak, istemci yap\u0131land\u0131rma dosyalar\u0131n\u0131 depolamak i\u00e7in bir dizin olu\u015fturun:<\/p>\n
mkdir -p ~\/client-configs\/files<\/code><\/pre>\n
\u015eimdi temel bir istemci yap\u0131land\u0131rma dosyas\u0131 olu\u015ftural\u0131m. Bu dosya, t\u00fcm istemciler i\u00e7in ortak ayarlar\u0131 i\u00e7erecektir.<\/p>\n
nano ~\/client-configs\/base.conf<\/code><\/pre>\n
A\u015fa\u011f\u0131daki i\u00e7eri\u011fi dosyaya yap\u0131\u015ft\u0131r\u0131n:<\/p>\n
client\ndev tun\nproto udp\nremote YOUR_SERVER_IP 1194 # BURAYI SUNUCUNUZUN GENEL IP ADRES\u0130 \u0130LE DE\u011e\u0130\u015eT\u0130R\u0130N\nresolv-retry infinite\nnobind\npersist-key\npersist-tun\nremote-cert-tls server\ntls-auth ta.key 1 # Bu sat\u0131r istemci taraf\u0131 i\u00e7in 1 olmal\u0131\ncipher AES-256-CBC\nauth SHA256\nverb 3<\/code><\/pre>\n
\u00d6NEML\u0130:<\/strong> remote YOUR_SERVER_IP 1194<\/code> sat\u0131r\u0131ndaki YOUR_SERVER_IP<\/code> k\u0131sm\u0131n\u0131 sunucunuzun ger\u00e7ek genel IP adresiyle de\u011fi\u015ftirmeniz gerekmektedir. E\u011fer bir alan ad\u0131 kullan\u0131yorsan\u0131z (\u00f6rn. vpn.example.com<\/code>), IP adresi yerine alan ad\u0131n\u0131z\u0131 yazabilirsiniz.<\/p>\n
Dosyay\u0131 kaydedin ve kapat\u0131n.<\/p>\n
\u0130stemci Yap\u0131land\u0131rma Dosyas\u0131n\u0131 Birle\u015ftirme<\/h4>\n
\u015eimdi, sertifikalar\u0131 ve anahtarlar\u0131 temel yap\u0131land\u0131rma dosyas\u0131na ekleyerek tek bir .ovpn<\/code> dosyas\u0131 olu\u015fturacak bir betik haz\u0131rlayal\u0131m.<\/p>\n
nano ~\/client-configs\/make_config.sh<\/code><\/pre>\n
A\u015fa\u011f\u0131daki betik i\u00e7eri\u011fini dosyaya yap\u0131\u015ft\u0131r\u0131n:<\/p>\n
#!\/bin\/bash\n\n
Bu betik, bir OpenVPN istemcisi i\u00e7in tek bir .ovpn yap\u0131land\u0131rma dosyas\u0131 olu\u015fturur.<\/h2>\n\nKEY_DIR=\/etc\/openvpn\/easy-rsa\/pki\nOUTPUT_DIR=~\/client-configs\/files\nBASE_CONFIG=~\/client-configs\/base.conf\n\nif [ -z \"$1\" ]; then\n    echo \"Kullan\u0131m: $0 \"\n    exit 1\nfi\n\nCLIENT=$1\n\n
\u0130stemcinin sertifikalar\u0131 ve anahtarlar\u0131 i\u00e7in gerekli dosyalar\u0131n varl\u0131\u011f\u0131n\u0131 kontrol et<\/h2>\nif [ ! -f \"${KEY_DIR}\/issued\/${CLIENT}.crt\" ]; then\n    echo \"Hata: \u0130stemci sertifikas\u0131 '${KEY_DIR}\/issued\/${CLIENT}.crt' bulunamad\u0131.\"\n    echo \"L\u00fctfen 'sudo .\/easyrsa gen-req ${CLIENT} nopass' ve 'sudo .\/easyrsa sign-req client ${CLIENT}' komutlar\u0131n\u0131 \u00e7al\u0131\u015ft\u0131rarak sertifikay\u0131 olu\u015fturun.\"\n    exit 1\nfi\n\nif [ ! -f \"${KEY_DIR}\/private\/${CLIENT}.key\" ]; then\n    echo \"Hata: \u0130stemci anahtar\u0131 '${KEY_DIR}\/private\/${CLIENT}.key' bulunamad\u0131.\"\n    echo \"L\u00fctfen 'sudo .\/easyrsa gen-req ${CLIENT} nopass' komutunu \u00e7al\u0131\u015ft\u0131rarak anahtar\u0131 olu\u015fturun.\"\n    exit 1\nfi\n\n
ca.crt ve ta.key dosyalar\u0131n\u0131n varl\u0131\u011f\u0131n\u0131 kontrol et<\/h2>\nif [ ! -f \"${KEY_DIR}\/ca.crt\" ]; then\n    echo \"Hata: CA sertifikas\u0131 '${KEY_DIR}\/ca.crt' bulunamad\u0131.\"\n    exit 1\nfi\n\nif [ ! -f \"\/etc\/openvpn\/ta.key\" ]; then\n    echo \"Hata: TLS auth anahtar\u0131 '\/etc\/openvpn\/ta.key' bulunamad\u0131.\"\n    exit 1\nfi\n\n
T\u00fcm par\u00e7alar\u0131 birle\u015ftirerek .ovpn dosyas\u0131n\u0131 olu\u015ftur<\/h2>\ncat ${BASE_CONFIG} \\\n    <(echo -e '') \\\n    ${KEY_DIR}\/ca.crt \\\n    <(echo -e '<\/ca>\\n') \\\n    ${KEY_DIR}\/issued\/${CLIENT}.crt \\\n    <(echo -e '<\/cert>\\n') \\\n    ${KEY_DIR}\/private\/${CLIENT}.key \\\n    <(echo -e '<\/key>\\n') \\\n    \/etc\/openvpn\/ta.key \\\n    <(echo -e '<\/tls-auth>') \\\n    > ${OUTPUT_DIR}\/${CLIENT}.ovpn\n\necho \"\u0130stemci yap\u0131land\u0131rma dosyas\u0131 olu\u015fturuldu: ${OUTPUT_DIR}\/${CLIENT}.ovpn\"\necho \"Bu dosyay\u0131 istemcinize g\u00fcvenli bir \u015fekilde aktar\u0131n.\"<\/code><\/pre>\n
Dosyay\u0131 kaydedin ve kapat\u0131n. Ard\u0131ndan beti\u011fi \u00e7al\u0131\u015ft\u0131r\u0131labilir yap\u0131n:<\/p>\n
chmod +x ~\/client-configs\/make_config.sh<\/code><\/pre>\n
\u015eimdi bu beti\u011fi kullanarak client1<\/code> i\u00e7in .ovpn<\/code> dosyas\u0131n\u0131 olu\u015fturun:<\/p>\n
~\/client-configs\/make_config.sh client1<\/code><\/pre>\n
Bu komut, ~\/client-configs\/files\/client1.ovpn<\/code> yolunda t\u00fcm gerekli sertifika ve anahtarlar\u0131 i\u00e7eren tek bir yap\u0131land\u0131rma dosyas\u0131 olu\u015fturacakt\u0131r.<\/p>\n
\u0130stemci Dosyalar\u0131n\u0131 \u0130ndirme<\/h4>\n
Olu\u015fturdu\u011funuz .ovpn<\/code> dosyas\u0131n\u0131 yerel bilgisayar\u0131n\u0131za indirmeniz gerekmektedir. Bunu yapmak i\u00e7in scp<\/code> (Secure Copy Protocol) veya sftp<\/code> gibi g\u00fcvenli bir dosya aktar\u0131m arac\u0131 kullanabilirsiniz.<\/p>\n
\u00d6rne\u011fin, yerel makinenizin terminalinden (sunucudan de\u011fil):<\/p>\n
scp user@your_server_ip:~\/client-configs\/files\/client1.ovpn .<\/code><\/pre>\n
user<\/code> yerine sunucudaki kullan\u0131c\u0131 ad\u0131n\u0131z\u0131, your_server_ip<\/code> yerine sunucunuzun IP adresini yaz\u0131n. Nokta (.<\/code>) ise dosyay\u0131 mevcut dizine indirecektir.<\/p>\n
Ad\u0131m 8: OpenVPN \u0130stemcisini Yap\u0131land\u0131rma<\/h3>\n
.ovpn<\/code> dosyas\u0131n\u0131 yerel makinenize indirdikten sonra, OpenVPN istemcinizi yap\u0131land\u0131rman\u0131z gerekir.<\/p>\n
*   Windows:<\/strong> OpenVPN GUI uygulamas\u0131n\u0131 indirip kurun. .ovpn<\/code> dosyas\u0131n\u0131 C:\\Program Files\\OpenVPN\\config<\/code> dizinine kopyalay\u0131n. Uygulamay\u0131 \u00e7al\u0131\u015ft\u0131r\u0131n, sistem tepsisindeki simgesine sa\u011f t\u0131klay\u0131n ve “Connect” se\u00e7ene\u011fini se\u00e7in.
\n*   macOS:<\/strong> Tunnelblick veya OpenVPN Connect uygulamas\u0131n\u0131 kullanabilirsiniz. .ovpn<\/code> dosyas\u0131n\u0131 uygulamaya s\u00fcr\u00fckleyip b\u0131rakarak kolayca i\u00e7e aktarabilirsiniz.
\n*   Linux:<\/strong> NetworkManager entegrasyonu (OpenVPN eklentisi ile) veya OpenVPN komut sat\u0131r\u0131 istemcisini kullanabilirsiniz. NetworkManager’da VPN ba\u011flant\u0131s\u0131 ekle se\u00e7ene\u011fini kullanarak .ovpn<\/code> dosyas\u0131n\u0131 i\u00e7e aktarabilirsiniz. Komut sat\u0131r\u0131 i\u00e7in sudo openvpn --config client1.ovpn<\/code> komutunu kullanabilirsiniz.
\n*   Mobil Cihazlar (Android\/iOS):<\/strong> Resmi OpenVPN Connect uygulamas\u0131n\u0131 uygulama ma\u011fazan\u0131zdan indirin. .ovpn<\/code> dosyas\u0131n\u0131 cihaz\u0131n\u0131za aktar\u0131n (e-posta, bulut depolama vb.) ve uygulama i\u00e7inden i\u00e7e aktarma se\u00e7ene\u011fini kullan\u0131n.<\/p>\n
Ba\u011flant\u0131 kurulduktan sonra, IP adresinizi kontrol ederek VPN \u00fczerinden ba\u011fland\u0131\u011f\u0131n\u0131zdan emin olabilirsiniz (\u00f6rn. Google’da “what is my ip” aramas\u0131 yaparak). Sunucunuzun IP adresini g\u00f6rmelisiniz.<\/p>\n
Geli\u015fmi\u015f Konfig\u00fcrasyon ve G\u00fcvenlik \u0130pu\u00e7lar\u0131<\/h3>\n
OpenVPN kurulumunuzu daha da g\u00fcvenli ve y\u00f6netilebilir hale getirmek i\u00e7in baz\u0131 geli\u015fmi\u015f konfig\u00fcrasyonlar\u0131 ve ipu\u00e7lar\u0131n\u0131 d\u00fc\u015f\u00fcnebilirsiniz:<\/p>\n
Sertifika \u0130ptali (CRL)<\/h4>\n
Bir istemci anahtar\u0131 \u00e7al\u0131n\u0131rsa veya bir kullan\u0131c\u0131n\u0131n VPN eri\u015fimini iptal etmeniz gerekirse, o istemcinin sertifikas\u0131n\u0131 iptal edebilirsiniz.<\/p>\n
1.  Easy-RSA dizinine gidin: cd \/etc\/openvpn\/easy-rsa<\/code>
\n2.  \u0130stemci sertifikas\u0131n\u0131 iptal edin (\u00f6rne\u011fin client1<\/code>): sudo .\/easyrsa revoke client1<\/code> (yes<\/code> ile onaylay\u0131n)
\n3.  Sertifika \u0130ptal Listesi (CRL) olu\u015fturun: sudo .\/easyrsa gen-crl<\/code>
\n4.  Olu\u015fturulan crl.pem<\/code> dosyas\u0131n\u0131 OpenVPN yap\u0131land\u0131rma dizinine kopyalay\u0131n: sudo cp \/etc\/openvpn\/easy-rsa\/pki\/crl.pem \/etc\/openvpn\/<\/code>
\n5.  server.conf<\/code> dosyas\u0131n\u0131 d\u00fczenleyin: sudo nano \/etc\/openvpn\/server.conf<\/code>
\n6.  Dosyaya a\u015fa\u011f\u0131daki sat\u0131r\u0131 ekleyin: crl-verify crl.pem<\/code>
\n7.  OpenVPN hizmetini yeniden ba\u015flat\u0131n: sudo systemctl restart openvpn@server<\/code><\/p>\n
Bu i\u015flemden sonra, iptal edilen sertifikaya sahip istemci VPN’e ba\u011flanamayacakt\u0131r.<\/p>\n
Loglama ve \u0130zleme<\/h4>\n
server.conf<\/code> dosyas\u0131ndaki verb<\/code> parametresi loglama seviyesini belirler. Sorun giderme i\u00e7in verb 4<\/code> veya 5<\/code> kullanmak faydal\u0131 olabilir, ancak normal kullan\u0131mda verb 3<\/code> yeterlidir. Log dosyalar\u0131n\u0131 d\u00fczenli olarak kontrol etmek (\/var\/log\/openvpn\/openvpn.log<\/code>), olas\u0131 sorunlar\u0131 erken tespit etmenizi sa\u011flar.<\/p>\n
Performans Optimizasyonu<\/h4>\n
Y\u00fcksek bant geni\u015fli\u011fine sahip ba\u011flant\u0131lar i\u00e7in server.conf<\/code> dosyas\u0131na a\u015fa\u011f\u0131daki sat\u0131rlar\u0131 ekleyerek performans\u0131 art\u0131rabilirsiniz:<\/p>\n
sndbuf 393216\nrcvbuf 393216\nfast-io<\/code><\/pre>\n
Bu ayarlar, arabellek boyutlar\u0131n\u0131 art\u0131r\u0131r ve G\/\u00c7 i\u015flemlerini h\u0131zland\u0131r\u0131r.<\/p>\n
\u00c7oklu \u0130stemciler ve Y\u00f6netim<\/h4>\n
Her yeni istemci i\u00e7in Ad\u0131m 7’deki gen-req<\/code> ve sign-req<\/code> ad\u0131mlar\u0131n\u0131 tekrarlayarak ve make_config.sh<\/code> beti\u011fini farkl\u0131 bir istemci ad\u0131yla \u00e7al\u0131\u015ft\u0131rarak kolayca yeni .ovpn<\/code> dosyalar\u0131 olu\u015fturabilirsiniz. \u00d6rne\u011fin:<\/p>\n
sudo .\/easyrsa gen-req client2 nopass\nsudo .\/easyrsa sign-req client client2\n~\/client-configs\/make_config.sh client2<\/code><\/pre>\n
DNS S\u0131z\u0131nt\u0131s\u0131 Korumas\u0131<\/h4>\n
Yukar\u0131daki yap\u0131land\u0131rmada Google DNS sunucular\u0131n\u0131 kulland\u0131k (push \"dhcp-option DNS 8.8.8.8\"<\/code>). \u0130stemcilerinizin DNS sorgular\u0131n\u0131n VPN t\u00fcnelinden ge\u00e7mesini sa\u011flamak i\u00e7in bu \u00f6nemlidir. Kendi DNS sunucular\u0131n\u0131z\u0131 veya ba\u015fka gizlilik odakl\u0131 DNS sunucular\u0131n\u0131 (\u00f6rn. Cloudflare 1.1.1.1, Quad9 9.9.9.9) kullanmay\u0131 d\u00fc\u015f\u00fcnebilirsiniz.<\/p>\n
TCP vs UDP<\/h4>\n
Varsay\u0131lan olarak UDP protokol\u00fcn\u00fc kulland\u0131k (proto udp<\/code>). UDP genellikle daha h\u0131zl\u0131d\u0131r ancak baz\u0131 k\u0131s\u0131tlay\u0131c\u0131 a\u011flarda (\u00f6rn. otel Wi-Fi’leri) engellenebilir. E\u011fer ba\u011flant\u0131 sorunlar\u0131 ya\u015f\u0131yorsan\u0131z, proto tcp<\/code> olarak de\u011fi\u015ftirebilir ve OpenVPN’in 443 gibi farkl\u0131 bir portta \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flayarak daha fazla a\u011fda bypass etmeyi deneyebilirsiniz. Ancak TCP \u00fczerinden TCP t\u00fcnellemesi performans\u0131 d\u00fc\u015f\u00fcrebilir.<\/p>\n
G\u00fcvenlik Duvar\u0131 Kurallar\u0131<\/h4>\n
Sunucunuzdaki g\u00fcvenlik duvar\u0131 kurallar\u0131n\u0131n sadece OpenVPN i\u00e7in gerekli olan portu (varsay\u0131lan 1194\/udp) ve SSH portunu a\u00e7t\u0131\u011f\u0131ndan emin olun. Gereksiz portlar\u0131 a\u00e7\u0131k b\u0131rakmak g\u00fcvenlik riskleri olu\u015fturur.<\/p>\n
Sorun Giderme<\/h3>\n
Kurulum s\u0131ras\u0131nda veya sonras\u0131nda sorunlarla kar\u015f\u0131la\u015f\u0131rsan\u0131z, a\u015fa\u011f\u0131daki ad\u0131mlar\u0131 izleyebilirsiniz:<\/p>\n
*   OpenVPN Loglar\u0131n\u0131 Kontrol Edin:<\/strong> Sunucu taraf\u0131ndaki en \u00f6nemli sorun giderme arac\u0131 log dosyalar\u0131d\u0131r.<\/p>\n
sudo journalctl -u openvpn@server.service<\/code><\/pre>\n
    veya<\/p>\n
sudo tail -f \/var\/log\/openvpn\/openvpn.log<\/code><\/pre>\n
    Bu loglarda “ERROR” veya “WARNING” mesajlar\u0131n\u0131 aray\u0131n.
\n*   G\u00fcvenlik Duvar\u0131 Kurallar\u0131n\u0131 Kontrol Edin:<\/strong> OpenVPN portunun (1194\/udp) a\u00e7\u0131k oldu\u011fundan ve NAT kurallar\u0131n\u0131n do\u011fru yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131ndan emin olun.<\/p>\n
sudo ufw status verbose\n    sudo iptables -t nat -L -v -n<\/code><\/pre>\n
*   IP Y\u00f6nlendirmeyi Kontrol Edin:<\/strong> IP y\u00f6nlendirmenin etkin oldu\u011fundan emin olun.<\/p>\n
cat \/proc\/sys\/net\/ipv4\/ip_forward<\/code><\/pre>\n
    Bu komut 1<\/code> d\u00f6nd\u00fcrmelidir.
\n*   Sertifika ve Anahtar Dosyalar\u0131n\u0131 Kontrol Edin:<\/strong> T\u00fcm sertifika ve anahtar dosyalar\u0131n\u0131n (ca.crt<\/code>, server.crt<\/code>, server.key<\/code>, dh.pem<\/code>, ta.key<\/code>) \/etc\/openvpn\/<\/code> dizininde oldu\u011fundan ve do\u011fru izinlere sahip oldu\u011fundan emin olun.
\n*   \u0130stemci Yap\u0131land\u0131rmas\u0131n\u0131 Kontrol Edin:<\/strong> \u0130stemci .ovpn<\/code> dosyas\u0131ndaki sunucu IP adresinin veya alan ad\u0131n\u0131n do\u011fru oldu\u011fundan, t\u00fcm sertifika ve anahtarlar\u0131n do\u011fru \u015fekilde g\u00f6m\u00fcld\u00fc\u011f\u00fcnden emin olun.
\n*   A\u011f Aray\u00fcz\u00fcn\u00fc Kontrol Edin:<\/strong> Sunucuda ip a<\/code> komutunu \u00e7al\u0131\u015ft\u0131rarak tun0<\/code> gibi bir OpenVPN aray\u00fcz\u00fcn\u00fcn olu\u015fup olu\u015fmad\u0131\u011f\u0131n\u0131 kontrol edin.
\n*   Ping Testi:<\/strong> \u0130stemci ba\u011fland\u0131ktan sonra, VPN a\u011f\u0131 \u00fczerindeki sunucu IP’sine (\u00f6rn. 10.8.0.1<\/code>) ping atarak ba\u011flant\u0131y\u0131 test edin.<\/p>\n
Sonu\u00e7<\/h3>\n
Bu rehberde, Debian 9 i\u015fletim sistemi \u00fczerinde kendi OpenVPN sunucunuzu kurmak i\u00e7in gerekli t\u00fcm ad\u0131mlar\u0131 detayl\u0131 bir \u015fekilde ele ald\u0131k. Kendi VPN sunucunuzu kurarak internet trafi\u011finiz \u00fczerinde tam kontrole sahip olabilir, \u00e7evrimi\u00e7i gizlili\u011finizi art\u0131rabilir ve g\u00fcvenli bir \u015fekilde internete eri\u015febilirsiniz. Kurulum s\u00fcreci ilk ba\u015fta karma\u015f\u0131k g\u00f6r\u00fcnebilir, ancak ad\u0131m ad\u0131m ilerleyerek ve her bir bile\u015fenin amac\u0131n\u0131 anlayarak ba\u015far\u0131l\u0131 bir \u015fekilde kendi g\u00fcvenli VPN \u00e7\u00f6z\u00fcm\u00fcn\u00fcz\u00fc olu\u015fturabilirsiniz. Unutmay\u0131n, g\u00fcvenli bir VPN deneyimi i\u00e7in sunucunuzu ve OpenVPN yaz\u0131l\u0131m\u0131n\u0131 d\u00fczenli olarak g\u00fcncel tutmak \u00f6nemlidir.<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Debian 9 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber\nOpenVPN, g\u00fcvenli ve \u015fifrelenmi\u015f bir ba\u011flant\u0131 olu\u015fturarak internet trafi\u011fini","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[241],"tags":[],"class_list":{"0":"post-31065","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-linux","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nDebian 9 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/debian-9-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Debian 9 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber\" \/>\n<meta property=\"og:description\" content=\"Debian 9 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber OpenVPN, g\u00fcvenli ve \u015fifrelenmi\u015f bir ba\u011flant\u0131 olu\u015fturarak internet trafi\u011fini\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/debian-9-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-10-05T05:41:14+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"21 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/debian-9-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/debian-9-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Debian 9 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber\",\"datePublished\":\"2025-10-05T05:41:14+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/debian-9-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/\"},\"wordCount\":3128,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Linux\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/debian-9-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/debian-9-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/debian-9-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/\",\"name\":\"Debian 9 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-10-05T05:41:14+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/debian-9-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/debian-9-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/debian-9-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Debian 9 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Debian 9 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/debian-9-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/","og_locale":"tr_TR","og_type":"article","og_title":"Debian 9 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber","og_description":"Debian 9 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber OpenVPN, g\u00fcvenli ve \u015fifrelenmi\u015f bir ba\u011flant\u0131 olu\u015fturarak internet trafi\u011fini","og_url":"https:\/\/fatihsoysal.com\/blog\/debian-9-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-10-05T05:41:14+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"21 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/debian-9-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/debian-9-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Debian 9 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber","datePublished":"2025-10-05T05:41:14+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/debian-9-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/"},"wordCount":3128,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Linux"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/debian-9-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/debian-9-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/","url":"https:\/\/fatihsoysal.com\/blog\/debian-9-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/","name":"Debian 9 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-10-05T05:41:14+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/debian-9-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/debian-9-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/debian-9-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Debian 9 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/31065","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=31065"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/31065\/revisions"}],"predecessor-version":[{"id":31066,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/31065\/revisions\/31066"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=31065"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=31065"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=31065"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}