{"id":38175,"date":"2026-01-25T00:40:52","date_gmt":"2026-01-24T21:40:52","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/?p=38175"},"modified":"2026-01-25T00:40:52","modified_gmt":"2026-01-24T21:40:52","slug":"debian-11-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/debian-11-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/","title":{"rendered":"Debian 11 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber"},"content":{"rendered":"

<\/p>\n

Debian 11 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber<\/h2>\n

\u0130nternet \u00e7a\u011f\u0131nda gizlilik ve g\u00fcvenlik, bireyler ve i\u015fletmeler i\u00e7in hayati \u00f6nem ta\u015f\u0131maktad\u0131r. Her g\u00fcn kar\u015f\u0131la\u015ft\u0131\u011f\u0131m\u0131z siber tehditler, veri ihlalleri ve g\u00f6zetim faaliyetleri, g\u00fcvenli bir \u00e7evrimi\u00e7i ba\u011flant\u0131ya olan ihtiyac\u0131 art\u0131rmaktad\u0131r. \u0130\u015fte bu noktada Sanal \u00d6zel A\u011flar (VPN’ler) devreye girer. Bir VPN, internet ba\u011flant\u0131n\u0131z\u0131 \u015fifreleyerek ve IP adresinizi maskeleyerek \u00e7evrimi\u00e7i aktivitelerinizi g\u00fcvence alt\u0131na al\u0131r ve gizlili\u011finizi korur. Piyasada bir\u00e7ok VPN \u00e7\u00f6z\u00fcm\u00fc bulunsa da, a\u00e7\u0131k kaynak kodlu ve son derece esnek yap\u0131s\u0131yla OpenVPN, kendi VPN sunucunuzu kurmak isteyenler i\u00e7in pop\u00fcler ve g\u00fc\u00e7l\u00fc bir se\u00e7enektir.<\/p>\n

Bu makale, Debian 11 (kod ad\u0131 Bullseye) i\u015fletim sistemi \u00fczerinde kendi OpenVPN sunucunuzu ad\u0131m ad\u0131m nas\u0131l kuraca\u011f\u0131n\u0131z\u0131 detayl\u0131 bir \u015fekilde a\u00e7\u0131klayacakt\u0131r. Kendi OpenVPN sunucunuzu kurmak, hem maliyet a\u00e7\u0131s\u0131ndan avantaj sa\u011flayabilir hem de ba\u011flant\u0131n\u0131z \u00fczerinde tam kontrol sahibi olman\u0131z\u0131 m\u00fcmk\u00fcn k\u0131lar. \u0130ster co\u011frafi k\u0131s\u0131tlamalar\u0131 a\u015fmak, ister halka a\u00e7\u0131k Wi-Fi a\u011flar\u0131nda g\u00fcvenli\u011finizi sa\u011flamak, isterse de ev a\u011f\u0131n\u0131za uzaktan g\u00fcvenli bir \u015fekilde eri\u015fmek isteyin, bu rehber size yol g\u00f6sterecektir.<\/p>\n

OpenVPN Nedir ve Neden Kullanmal\u0131s\u0131n\u0131z?<\/h3>\n

OpenVPN, Secure Socket Layer (SSL) veya Transport Layer Security (TLS) protokollerini kullanarak g\u00fcvenli noktadan noktaya veya siteden siteye ba\u011flant\u0131lar kurmak i\u00e7in kullan\u0131lan a\u00e7\u0131k kaynakl\u0131 bir yaz\u0131l\u0131md\u0131r. \u00c7apraz platform deste\u011fi sayesinde Windows, macOS, Linux, Android ve iOS gibi bir\u00e7ok i\u015fletim sisteminde kullan\u0131labilir.<\/p>\n

Kendi OpenVPN sunucunuzu kurman\u0131n ba\u015fl\u0131ca nedenleri \u015funlard\u0131r:<\/p>\n

* Geli\u015fmi\u015f G\u00fcvenlik:<\/strong> \u0130nternet trafi\u011finizi g\u00fc\u00e7l\u00fc \u015fifreleme algoritmalar\u0131yla (AES-256 gibi) korur, b\u00f6ylece verilerinizin \u00fc\u00e7\u00fcnc\u00fc \u015fah\u0131slar taraf\u0131ndan izlenmesini veya ele ge\u00e7irilmesini engeller.
\n* Gizlilik:<\/strong> Ger\u00e7ek IP adresinizi gizleyerek \u00e7evrimi\u00e7i kimli\u011finizi korur ve internet servis sa\u011flay\u0131c\u0131n\u0131z\u0131n (\u0130SS) veya di\u011fer g\u00f6zetim organlar\u0131n\u0131n \u00e7evrimi\u00e7i aktivitelerinizi takip etmesini zorla\u015ft\u0131r\u0131r.
\n* Co\u011frafi K\u0131s\u0131tlamalar\u0131 A\u015fma:<\/strong> Sunucunuzun bulundu\u011fu \u00fclkenin IP adresini kullanarak, belirli b\u00f6lgelere \u00f6zg\u00fc i\u00e7eriklere veya hizmetlere eri\u015fmenizi sa\u011flar.
\n* Uzaktan G\u00fcvenli Eri\u015fim:<\/strong> \u015eirket a\u011f\u0131n\u0131za veya ev a\u011f\u0131n\u0131za uzaktan g\u00fcvenli bir \u015fekilde ba\u011flanarak, yerel a\u011f kaynaklar\u0131na eri\u015fim imkan\u0131 sunar.
\n* Halka A\u00e7\u0131k Wi-Fi G\u00fcvenli\u011fi:<\/strong> Halka a\u00e7\u0131k Wi-Fi a\u011flar\u0131 genellikle g\u00fcvensizdir ve verilerinizin kolayca \u00e7al\u0131nmas\u0131na neden olabilir. OpenVPN, bu a\u011flarda bile ba\u011flant\u0131n\u0131z\u0131 \u015fifreleyerek g\u00fcvende kalman\u0131z\u0131 sa\u011flar.
\n* Tam Kontrol:<\/strong> \u00dc\u00e7\u00fcnc\u00fc taraf bir VPN hizmeti yerine kendi sunucunuzu kurdu\u011funuzda, verilerinizin nas\u0131l i\u015flendi\u011fi ve sakland\u0131\u011f\u0131 konusunda tam kontrole sahip olursunuz.<\/p>\n

\u00d6n Gereksinimler<\/h3>\n

Kuruluma ba\u015flamadan \u00f6nce a\u015fa\u011f\u0131daki \u00f6n gereksinimleri kar\u015f\u0131lad\u0131\u011f\u0131n\u0131zdan emin olun:<\/p>\n

* Debian 11 Sunucusu:<\/strong> \u0130nternet eri\u015fimi olan, temiz bir Debian 11 i\u015fletim sistemi kurulu sanal \u00f6zel sunucu (VPS) veya fiziksel bir sunucu. Bu sunucunun sabit bir genel IP adresine sahip olmas\u0131 gerekmektedir.
\n* Root Eri\u015fimi veya Sudo Yetkileri:<\/strong> Kurulum i\u00e7in root kullan\u0131c\u0131s\u0131 olarak oturum a\u00e7m\u0131\u015f olman\u0131z veya sudo<\/code> yetkilerine sahip bir kullan\u0131c\u0131 hesab\u0131n\u0131z\u0131n olmas\u0131 gerekir.
\n* Temel Linux Komut Bilgisi:<\/strong> Komut sat\u0131r\u0131 aray\u00fcz\u00fcn\u00fc (CLI) kullanarak temel Linux komutlar\u0131n\u0131 \u00e7al\u0131\u015ft\u0131rma bilgisi.
\n* G\u00fcvenlik Duvar\u0131 Bilgisi:<\/strong> Sunucunuzda kurulu olabilecek g\u00fcvenlik duvar\u0131n\u0131 (UFW veya iptables) yap\u0131land\u0131rma bilgisi.<\/p>\n

Ad\u0131m 1: Sistemi G\u00fcncelleme ve Gerekli Paketleri Kurma<\/h3>\n

Herhangi bir kuruluma ba\u015flamadan \u00f6nce sistem paket listesini g\u00fcncellemek ve kurulu paketleri y\u00fckseltmek iyi bir uygulamad\u0131r. Ayr\u0131ca OpenVPN sunucusu i\u00e7in gerekli olan openvpn<\/code> ve sertifika yetkilisi (CA) olu\u015fturmak i\u00e7in easy-rsa<\/code> paketlerini kuraca\u011f\u0131z.<\/p>\n

Bir terminal a\u00e7\u0131n ve a\u015fa\u011f\u0131daki komutlar\u0131 \u00e7al\u0131\u015ft\u0131r\u0131n:<\/p>\n

sudo apt update\nsudo apt upgrade -y\nsudo apt install openvpn easy-rsa -y<\/code><\/pre>\n
*   sudo apt update<\/code>: Paket listesini g\u00fcnceller.
\n*   sudo apt upgrade -y<\/code>: Kurulu paketleri y\u00fckseltir. -y<\/code> bayra\u011f\u0131, t\u00fcm sorulara otomatik olarak “evet” yan\u0131t\u0131 verilmesini sa\u011flar.
\n*   sudo apt install openvpn easy-rsa -y<\/code>: OpenVPN sunucusunu ve sertifika olu\u015fturma ara\u00e7lar\u0131n\u0131 kurar.<\/p>\n
Ad\u0131m 2: Kolay CA (Certificate Authority) Olu\u015fturma<\/h3>\n
OpenVPN, istemci ve sunucu aras\u0131ndaki ileti\u015fimin g\u00fcvenli\u011fini sa\u011flamak i\u00e7in X.509 sertifikalar\u0131n\u0131 kullan\u0131r. Bu sertifikalar, bir Sertifika Yetkilisi (CA) taraf\u0131ndan imzalan\u0131r. easy-rsa<\/code> arac\u0131, bu CA’y\u0131 ve OpenVPN i\u00e7in gerekli olan di\u011fer t\u00fcm sertifikalar\u0131 ve anahtarlar\u0131 olu\u015fturmay\u0131 kolayla\u015ft\u0131r\u0131r.<\/p>\n
\u0130lk olarak, easy-rsa<\/code> betiklerini OpenVPN yap\u0131land\u0131rma dizinine kopyalay\u0131n ve \u00e7al\u0131\u015fma dizinini de\u011fi\u015ftirin:<\/p>\n
sudo cp -r \/usr\/share\/easy-rsa\/ \/etc\/openvpn\/\nsudo chown -R root:root \/etc\/openvpn\/easy-rsa\nsudo chmod -R 700 \/etc\/openvpn\/easy-rsa\ncd \/etc\/openvpn\/easy-rsa<\/code><\/pre>\n
\u015eimdi PKI (Public Key Infrastructure) ortam\u0131n\u0131 ba\u015flataca\u011f\u0131z:<\/p>\n
.\/easyrsa init-pki<\/code><\/pre>\n
Bu komut, sertifikalar\u0131 ve anahtarlar\u0131 depolamak i\u00e7in gerekli dizin yap\u0131s\u0131n\u0131 olu\u015fturur.<\/p>\n
Ard\u0131ndan, CA’y\u0131 olu\u015fturaca\u011f\u0131z. CA’n\u0131n olu\u015fturulmas\u0131 s\u0131ras\u0131nda sizden bir “Common Name” (Ortak Ad) girmeniz istenecektir. Bu genellikle \u015firket ad\u0131n\u0131z veya sunucunuzun ad\u0131 olabilir. \u00d6rne\u011fin, “MyOpenVPN CA” gibi.<\/p>\n
.\/easyrsa build-ca nopass<\/code><\/pre>\n
*   nopass<\/code> bayra\u011f\u0131, CA anahtar\u0131 i\u00e7in bir parola belirlemenizi atlar. Daha fazla g\u00fcvenlik i\u00e7in bir parola belirleyebilirsiniz, ancak her yeniden ba\u015flatmada parolay\u0131 girmeniz gerekir.<\/p>\n
\u015eimdi sunucu i\u00e7in bir sertifika iste\u011fi ve \u00f6zel anahtar olu\u015fturaca\u011f\u0131z. “server” ad\u0131n\u0131 kullanaca\u011f\u0131z. Yine bir parola belirlemek istemiyorsan\u0131z nopass<\/code> kullan\u0131n.<\/p>\n
.\/easyrsa gen-req server nopass<\/code><\/pre>\n
Ard\u0131ndan, sunucu sertifika iste\u011fini CA ile imzalayaca\u011f\u0131z. Bu, sunucunun kimli\u011fini CA taraf\u0131ndan do\u011frulanm\u0131\u015f hale getirir. Onaylamak i\u00e7in yes<\/code> yazman\u0131z istenecektir.<\/p>\n
.\/easyrsa sign-req server server<\/code><\/pre>\n
Son olarak, Diffie-Hellman (DH) parametrelerini olu\u015fturaca\u011f\u0131z. Bu parametreler, istemciler ve sunucu aras\u0131nda g\u00fcvenli bir anahtar de\u011fi\u015fimi i\u00e7in kullan\u0131l\u0131r. Bu i\u015flem biraz zaman alabilir (birka\u00e7 dakika s\u00fcrebilir).<\/p>\n
.\/easyrsa gen-dh<\/code><\/pre>\n
OpenVPN’in TLS kimlik do\u011frulamas\u0131 i\u00e7in bir ta.key<\/code> dosyas\u0131 da olu\u015fturmam\u0131z gerekiyor. Bu anahtar, sunucu ve istemci aras\u0131ndaki TLS ba\u011flant\u0131s\u0131n\u0131 daha da g\u00fc\u00e7lendirir ve DoS sald\u0131r\u0131lar\u0131na kar\u015f\u0131 koruma sa\u011flar.<\/p>\n
openvpn --genkey --secret ta.key<\/code><\/pre>\n
Bu ad\u0131mda, OpenVPN sunucusu i\u00e7in gerekli t\u00fcm sertifika ve anahtar dosyalar\u0131n\u0131 olu\u015fturmu\u015f olduk.<\/p>\n
Ad\u0131m 3: OpenVPN Sunucu Yap\u0131land\u0131rmas\u0131<\/h3>\n
Olu\u015fturdu\u011fumuz sertifikalar\u0131 ve anahtarlar\u0131 OpenVPN’in kullanaca\u011f\u0131 dizine kopyalamam\u0131z gerekiyor.<\/p>\n
sudo cp pki\/ca.crt pki\/issued\/server.crt pki\/private\/server.key pki\/dh.pem \/etc\/openvpn\/\nsudo cp ta.key \/etc\/openvpn\/<\/code><\/pre>\n
\u015eimdi OpenVPN sunucusu i\u00e7in bir yap\u0131land\u0131rma dosyas\u0131 olu\u015fturaca\u011f\u0131z: \/etc\/openvpn\/server.conf<\/code>. Bu dosya, sunucunun nas\u0131l \u00e7al\u0131\u015faca\u011f\u0131n\u0131 tan\u0131mlar.<\/p>\n
sudo nano \/etc\/openvpn\/server.conf<\/code><\/pre>\n
A\u015fa\u011f\u0131daki i\u00e7eri\u011fi server.conf<\/code> dosyas\u0131na yap\u0131\u015ft\u0131r\u0131n. Bu, \u00e7o\u011fu kullan\u0131m durumu i\u00e7in iyi bir ba\u015flang\u0131\u00e7 yap\u0131land\u0131rmas\u0131d\u0131r. A\u00e7\u0131klamalar, her sat\u0131r\u0131n ne i\u015fe yarad\u0131\u011f\u0131n\u0131 anlaman\u0131za yard\u0131mc\u0131 olacakt\u0131r.<\/p>\n
# Sunucunun dinleyece\u011fi port ve protokol\nport 1194\nproto udp\n\n
VPN t\u00fcnel cihaz\u0131 t\u00fcr\u00fc<\/h2>\ndev tun\n\n
Sertifika ve anahtar dosyalar\u0131n\u0131n yollar\u0131<\/h2>\nca ca.crt\ncert server.crt\nkey server.key\ndh dh.pem\n\n
TLS kimlik do\u011frulama anahtar\u0131<\/h2>\ntls-auth ta.key 0 # '0' sunucu taraf\u0131 i\u00e7in\n\n
VPN istemcilerine atanacak IP adresi aral\u0131\u011f\u0131<\/h2>\nserver 10.8.0.0 255.255.255.0\n\n
\u0130stemci IP adreslerini kal\u0131c\u0131 hale getir<\/h2>\nifconfig-pool-persist ipp.txt\n\n
\u0130stemcilere varsay\u0131lan a\u011f ge\u00e7idi olarak VPN'i kullanmalar\u0131n\u0131 bildir<\/h2>\npush \"redirect-gateway def1 bypass-dhcp\"\n\n
\u0130stemcilere DNS sunucusu atama (Google DNS \u00f6rnek olarak)<\/h2>\npush \"dhcp-option DNS 8.8.8.8\"\npush \"dhcp-option DNS 8.8.4.4\"\n
\u0130ste\u011fe ba\u011fl\u0131: Cloudflare DNS<\/h2>\n
push \"dhcp-option DNS 1.1.1.1\"<\/h2>\n
push \"dhcp-option DNS 1.0.0.1\"<\/h2>\n\n
Ba\u011flant\u0131y\u0131 canl\u0131 tutmak i\u00e7in keepalive ayarlar\u0131 (10 saniyede bir ping, 120 saniye sonra ba\u011flant\u0131 kesilir)<\/h2>\nkeepalive 10 120\n\n
\u015eifreleme algoritmalar\u0131<\/h2>\ncipher AES-256-GCM # Modern ve g\u00fcvenli \u015fifreleme\nauth SHA256 # Kimlik do\u011frulama algoritmas\u0131\n\n
Veri s\u0131k\u0131\u015ft\u0131rma (lz4-v2 \u00f6nerilir, eski istemciler i\u00e7in lzo kullan\u0131labilir)<\/h2>\ncompress lz4-v2\npush \"compress lz4-v2\"\n\n
\u0130stemcilerin kendi aralar\u0131nda ileti\u015fim kurmas\u0131na izin ver<\/h2>\n
client-to-client<\/h2>\n\n
Yeniden ba\u015flatmalarda anahtarlar\u0131 ve t\u00fcneli koru<\/h2>\npersist-key\npersist-tun\n\n
Sunucu durumunu log dosyas\u0131na yaz<\/h2>\nstatus \/var\/log\/openvpn-status.log\n\n
Log detay seviyesi (3 \u00f6nerilir, daha detayl\u0131 log i\u00e7in 4 veya 5)<\/h2>\nverb 3\n\n
\u0130stemci ba\u011flant\u0131s\u0131n\u0131n kesildi\u011fini sunucuya bildir<\/h2>\nexplicit-exit-notify 1\n\n
Log dosyas\u0131<\/h2>\nlog \/var\/log\/openvpn.log\nlog-append \/var\/log\/openvpn.log\n\n
OpenVPN'in ayr\u0131cal\u0131ks\u0131z bir kullan\u0131c\u0131 ve grup ile \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flar<\/h2>\nuser nobody\ngroup nogroup<\/code><\/pre>\n
Dosyay\u0131 kaydedin ve kapat\u0131n (CTRL+O, Enter, CTRL+X).<\/p>\n
\u00d6nemli Notlar:<\/strong><\/p>\n
*   proto udp<\/code>: Genellikle daha h\u0131zl\u0131 oldu\u011fu i\u00e7in UDP tercih edilir. Ancak baz\u0131 a\u011flar UDP trafi\u011fini engelleyebilir, bu durumda proto tcp<\/code> kullanabilirsiniz.
\n*   server 10.8.0.0 255.255.255.0<\/code>: Bu, VPN istemcilerine atanacak IP adres aral\u0131\u011f\u0131d\u0131r. \u00c7o\u011fu durumda bu varsay\u0131lan de\u011fer yeterlidir.
\n*   push \"redirect-gateway def1 bypass-dhcp\"<\/code>: Bu, t\u00fcm istemci trafi\u011finin VPN t\u00fcneli \u00fczerinden ge\u00e7mesini sa\u011flar.
\n*   push \"dhcp-option DNS ...\"<\/code>: \u0130stemcilerin kullanaca\u011f\u0131 DNS sunucular\u0131n\u0131 belirtir. Google DNS (8.8.8.8, 8.8.4.4) veya Cloudflare DNS (1.1.1.1, 1.0.0.1) gibi g\u00fcvenilir ve h\u0131zl\u0131 DNS sunucular\u0131 kullanabilirsiniz.
\n*   cipher AES-256-GCM<\/code> ve auth SHA256<\/code>: Bunlar modern ve g\u00fc\u00e7l\u00fc \u015fifreleme ve kimlik do\u011frulama algoritmalar\u0131d\u0131r. \u0130stemci yap\u0131land\u0131rman\u0131zda da ayn\u0131lar\u0131n\u0131 kullanman\u0131z gerekecektir.
\n*   compress lz4-v2<\/code>: Bu, LZ4 s\u0131k\u0131\u015ft\u0131rman\u0131n ikinci s\u00fcr\u00fcm\u00fcd\u00fcr ve genellikle lzo<\/code>‘dan daha iyi performans sunar. \u0130stemcinizin de LZ4v2’yi destekledi\u011finden emin olun. Desteklemiyorsa veya sorun ya\u015f\u0131yorsan\u0131z compress lzo<\/code> kullanabilir veya s\u0131k\u0131\u015ft\u0131rmay\u0131 tamamen kapatmak i\u00e7in bu sat\u0131rlar\u0131 silebilirsiniz.<\/p>\n
Ad\u0131m 4: IP Y\u00f6nlendirmeyi Etkinle\u015ftirme<\/h3>\n
OpenVPN sunucusu, istemcilerden gelen trafi\u011fi internete y\u00f6nlendirmek (NAT) i\u00e7in IP y\u00f6nlendirme (IP forwarding) \u00f6zelli\u011fine ihtiya\u00e7 duyar. Bu \u00f6zelli\u011fi etkinle\u015ftirmek i\u00e7in \/etc\/sysctl.conf<\/code> dosyas\u0131n\u0131 d\u00fczenlememiz gerekir.<\/p>\n
sudo nano \/etc\/sysctl.conf<\/code><\/pre>\n
Dosyan\u0131n i\u00e7inde net.ipv4.ip_forward<\/code> sat\u0131r\u0131n\u0131 bulun ve yorum sat\u0131r\u0131 #<\/code> i\u015faretini kald\u0131rarak de\u011ferini 1<\/code> olarak ayarlay\u0131n:<\/p>\n
net.ipv4.ip_forward = 1<\/code><\/pre>\n
Dosyay\u0131 kaydedin ve kapat\u0131n. De\u011fi\u015fikliklerin hemen uygulanmas\u0131 i\u00e7in a\u015fa\u011f\u0131daki komutu \u00e7al\u0131\u015ft\u0131r\u0131n:<\/p>\n
sudo sysctl -p<\/code><\/pre>\n
Ad\u0131m 5: G\u00fcvenlik Duvar\u0131n\u0131 Yap\u0131land\u0131rma (UFW veya iptables)<\/h3>\n
OpenVPN sunucusunun d\u00fczg\u00fcn \u00e7al\u0131\u015fabilmesi i\u00e7in g\u00fcvenlik duvar\u0131 kurallar\u0131n\u0131 yap\u0131land\u0131rman\u0131z gerekir. Bu, OpenVPN trafi\u011fine izin vermeli ve istemcilerin internete eri\u015febilmesi i\u00e7in a\u011f adresi \u00e7evirisi (NAT) yapmal\u0131d\u0131r. Debian sistemlerinde genellikle UFW (Uncomplicated Firewall) veya iptables kullan\u0131l\u0131r. UFW, iptables’\u0131n daha kullan\u0131c\u0131 dostu bir aray\u00fcz\u00fcd\u00fcr.<\/p>\n
UFW Kullanarak G\u00fcvenlik Duvar\u0131 Yap\u0131land\u0131rmas\u0131 (\u00d6nerilen)<\/h4>\n
UFW kurulu de\u011filse kurun:<\/p>\n
sudo apt install ufw -y<\/code><\/pre>\n
Ard\u0131ndan, SSH ve OpenVPN trafi\u011fine izin verin:<\/p>\n
sudo ufw allow ssh\nsudo ufw allow 1194\/udp # OpenVPN i\u00e7in belirledi\u011finiz port ve protokol<\/code><\/pre>\n
Varsay\u0131lan iletme politikas\u0131n\u0131 ACCEPT<\/code> olarak ayarlay\u0131n:<\/p>\n
sudo nano \/etc\/default\/ufw<\/code><\/pre>\n
DEFAULT_FORWARD_POLICY=\"DROP\"<\/code> sat\u0131r\u0131n\u0131 bulun ve DEFAULT_FORWARD_POLICY=\"ACCEPT\"<\/code> olarak de\u011fi\u015ftirin.<\/p>\n
\u015eimdi NAT kurallar\u0131n\u0131 eklemek i\u00e7in \/etc\/ufw\/before.rules<\/code> dosyas\u0131n\u0131 d\u00fczenlememiz gerekiyor. Bu dosya, UFW’nin varsay\u0131lan kurallar\u0131ndan \u00f6nce uygulanan kurallar\u0131 i\u00e7erir.<\/p>\n
sudo nano \/etc\/ufw\/before.rules<\/code><\/pre>\n
Dosyan\u0131n en ba\u015f\u0131na, # Don't delete these required lines, otherwise ufw will stop working<\/code> sat\u0131r\u0131ndan \u00f6nce<\/em> a\u015fa\u011f\u0131daki sat\u0131rlar\u0131 ekleyin:<\/p>\n
# START OPENVPN RULES\n
NAT table rules<\/h2>\n*nat\n:POSTROUTING ACCEPT [0:0]\n-A POSTROUTING -s 10.8.0.0\/24 -o eth0 -j MASQUERADE\nCOMMIT\n
END OPENVPN RULES<\/code><\/pre>\n<\/h2>\n
\u00d6nemli:<\/strong> -o eth0<\/code> k\u0131sm\u0131ndaki eth0<\/code> yerine sunucunuzun genel a\u011f aray\u00fcz\u00fcn\u00fcn ad\u0131n\u0131 yazmal\u0131s\u0131n\u0131z. Bu genellikle eth0<\/code>, ens3<\/code>, enp0s3<\/code>, vnet0<\/code> veya venet0<\/code> olabilir. Do\u011fru aray\u00fcz ad\u0131n\u0131 bulmak i\u00e7in ip a<\/code> komutunu kullanabilirsiniz. Genellikle genel IP adresinizin atand\u0131\u011f\u0131 aray\u00fczd\u00fcr.<\/p>\n
Dosyay\u0131 kaydedin ve kapat\u0131n. \u015eimdi UFW’yi etkinle\u015ftirin ve durumunu kontrol edin:<\/p>\n
sudo ufw enable\nsudo ufw status verbose<\/code><\/pre>\n
UFW’yi etkinle\u015ftirdi\u011finizde SSH ba\u011flant\u0131n\u0131z\u0131n kesilmesi ihtimaline kar\u015f\u0131 dikkatli olun. E\u011fer ba\u011flant\u0131 kesilirse, sunucunuzun konsoluna eri\u015fiminiz oldu\u011fundan emin olun.<\/p>\n
iptables Kullanarak G\u00fcvenlik Duvar\u0131 Yap\u0131land\u0131rmas\u0131 (UFW kullan\u0131lm\u0131yorsa)<\/h4>\n
E\u011fer UFW kullanm\u0131yorsan\u0131z, iptables kurallar\u0131n\u0131 do\u011frudan ayarlaman\u0131z gerekir.<\/p>\n
# OpenVPN portuna gelen UDP trafi\u011fine izin ver\nsudo iptables -A INPUT -i eth0 -p udp --dport 1194 -j ACCEPT\n\n
VPN t\u00fcneli \u00fczerinden y\u00f6nlendirilen trafi\u011fe izin ver<\/h2>\nsudo iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT\nsudo iptables -A FORWARD -s 10.8.0.0\/24 -j ACCEPT\n\n
NAT (Masquerade) kural\u0131<\/h2>\nsudo iptables -t nat -A POSTROUTING -s 10.8.0.0\/24 -o eth0 -j MASQUERADE<\/code><\/pre>\n
Yine:<\/strong> -i eth0<\/code> ve -o eth0<\/code> k\u0131s\u0131mlar\u0131n\u0131 sunucunuzun genel a\u011f aray\u00fcz\u00fc ile de\u011fi\u015ftirmelisiniz.<\/p>\n
Bu iptables kurallar\u0131, sunucu yeniden ba\u015flat\u0131ld\u0131\u011f\u0131nda kaybolacakt\u0131r. Kal\u0131c\u0131 hale getirmek i\u00e7in netfilter-persistent<\/code> paketini kullanabilirsiniz:<\/p>\n
sudo apt install netfilter-persistent -y\nsudo netfilter-persistent save<\/code><\/pre>\n
Ad\u0131m 6: OpenVPN Sunucusunu Ba\u015flatma ve Etkinle\u015ftirme<\/h3>\n
T\u00fcm yap\u0131land\u0131rmalar tamamland\u0131ktan sonra OpenVPN sunucusunu ba\u015flatabilir ve sistem ba\u015flang\u0131c\u0131nda otomatik olarak ba\u015flamas\u0131 i\u00e7in etkinle\u015ftirebiliriz.<\/p>\n
sudo systemctl start openvpn@server\nsudo systemctl enable openvpn@server<\/code><\/pre>\n
Sunucunun durumunu kontrol ederek herhangi bir hata olup olmad\u0131\u011f\u0131n\u0131 g\u00f6rebilirsiniz:<\/p>\n
sudo systemctl status openvpn@server<\/code><\/pre>\n
Durum “active (running)” olarak g\u00f6r\u00fcn\u00fcyorsa, OpenVPN sunucunuz ba\u015far\u0131yla \u00e7al\u0131\u015f\u0131yor demektir. Herhangi bir hata varsa, log dosyalar\u0131n\u0131 kontrol edin:<\/p>\n
sudo journalctl -u openvpn@server -f\n
veya<\/h2>\nsudo tail -f \/var\/log\/openvpn.log<\/code><\/pre>\n
Ad\u0131m 7: \u0130stemci Yap\u0131land\u0131rmas\u0131 Olu\u015fturma<\/h3>\n
\u0130stemcilerin OpenVPN sunucusuna ba\u011flanabilmesi i\u00e7in kendi sertifikalar\u0131na, anahtarlar\u0131na ve bir yap\u0131land\u0131rma dosyas\u0131na (.ovpn<\/code> uzant\u0131l\u0131) ihtiya\u00e7lar\u0131 vard\u0131r. Her istemci i\u00e7in ayr\u0131 bir sertifika\/anahtar \u00e7ifti olu\u015fturmak, g\u00fcvenlik a\u00e7\u0131s\u0131ndan en iyi uygulamad\u0131r.<\/p>\n
\u0130lk olarak, istemci yap\u0131land\u0131rma dosyalar\u0131n\u0131 depolamak i\u00e7in bir dizin olu\u015ftural\u0131m:<\/p>\n
mkdir -p ~\/client-configs\/files\nchmod 700 ~\/client-configs<\/code><\/pre>\n
\u015eimdi easy-rsa<\/code> dizinine geri d\u00f6nelim:<\/p>\n
cd \/etc\/openvpn\/easy-rsa<\/code><\/pre>\n
Bir istemci i\u00e7in sertifika iste\u011fi ve \u00f6zel anahtar olu\u015ftural\u0131m. \u00d6rnek olarak client1<\/code> ad\u0131n\u0131 kullanaca\u011f\u0131z:<\/p>\n
.\/easyrsa gen-req client1 nopass<\/code><\/pre>\n
Ard\u0131ndan, istemci sertifikas\u0131n\u0131 CA ile imzalay\u0131n. Onaylamak i\u00e7in yes<\/code> yaz\u0131n.<\/p>\n
.\/easyrsa sign-req client client1<\/code><\/pre>\n
\u015eimdi gerekli t\u00fcm dosyalar\u0131 olu\u015fturdu\u011fumuz istemci yap\u0131land\u0131rma dizinine kopyalayal\u0131m:<\/p>\n
sudo cp pki\/ca.crt ~\/client-configs\/files\/\nsudo cp pki\/issued\/client1.crt ~\/client-configs\/files\/\nsudo cp pki\/private\/client1.key ~\/client-configs\/files\/\nsudo cp \/etc\/openvpn\/ta.key ~\/client-configs\/files\/<\/code><\/pre>\n
\u015eimdi istemci i\u00e7in temel bir .ovpn<\/code> yap\u0131land\u0131rma dosyas\u0131 olu\u015ftural\u0131m. Bu dosyay\u0131 ~\/client-configs\/base.conf<\/code> olarak kaydedece\u011fiz:<\/p>\n
nano ~\/client-configs\/base.conf<\/code><\/pre>\n
A\u015fa\u011f\u0131daki i\u00e7eri\u011fi dosyaya yap\u0131\u015ft\u0131r\u0131n:<\/p>\n
client\ndev tun\nproto udp # Sunucunuzda kulland\u0131\u011f\u0131n\u0131z protokolle e\u015fle\u015fmeli\nremote YOUR_SERVER_IP 1194 # Sunucunuzun genel IP adresi ve portu\nresolv-retry infinite\nnobind\npersist-key\npersist-tun\nremote-cert-tls server\nauth SHA256 # Sunucunuzda kulland\u0131\u011f\u0131n\u0131z kimlik do\u011frulama algoritmas\u0131\ncipher AES-256-GCM # Sunucunuzda kulland\u0131\u011f\u0131n\u0131z \u015fifreleme algoritmas\u0131\nverb 3\ncompress lz4-v2 # Sunucunuzda kulland\u0131\u011f\u0131n\u0131z s\u0131k\u0131\u015ft\u0131rma algoritmas\u0131<\/code><\/pre>\n
\u00d6nemli:<\/strong> YOUR_SERVER_IP<\/code> yerine OpenVPN sunucunuzun genel IP adresini veya alan ad\u0131n\u0131 yazmal\u0131s\u0131n\u0131z.<\/p>\n
Dosyay\u0131 kaydedin ve kapat\u0131n.<\/p>\n
Son olarak, bu temel yap\u0131land\u0131rma dosyas\u0131n\u0131 ve olu\u015fturdu\u011fumuz sertifika\/anahtar dosyalar\u0131n\u0131 tek bir .ovpn<\/code> dosyas\u0131 halinde birle\u015ftirece\u011fiz. Bu tek dosya, istemcinin ba\u011flant\u0131 kurmas\u0131 i\u00e7in yeterli olacakt\u0131r.<\/p>\n
cd ~\/client-configs\/files\nsudo bash -c 'cat base.conf \\\n    <(echo -e \"\") \\\n    ca.crt \\\n    <(echo -e \"<\/ca>\\n\") \\\n    client1.crt \\\n    <(echo -e \"<\/cert>\\n\") \\\n    client1.key \\\n    <(echo -e \"<\/key>\\n\") \\\n    ta.key \\\n    <(echo -e \"<\/tls-auth>\") \\\n    > client1.ovpn'<\/code><\/pre>\n
Bu komut, base.conf<\/code> dosyas\u0131n\u0131n i\u00e7eri\u011fini, ard\u0131ndan ca.crt<\/code>, client1.crt<\/code>, client1.key<\/code> ve ta.key<\/code> dosyalar\u0131n\u0131n i\u00e7eri\u011fini uygun OpenVPN etiketleriyle birle\u015ftirerek client1.ovpn<\/code> adl\u0131 tek bir dosya olu\u015fturur.<\/p>\n
\u015eimdi client1.ovpn<\/code> dosyas\u0131 ~\/client-configs\/files\/<\/code> dizininde haz\u0131r.<\/p>\n
Ad\u0131m 8: \u0130stemci Yap\u0131land\u0131rma Dosyas\u0131n\u0131 \u0130ndirme ve Ba\u011flanma<\/h3>\n
Olu\u015fturdu\u011funuz client1.ovpn<\/code> dosyas\u0131n\u0131 yerel bilgisayar\u0131n\u0131za veya mobil cihaz\u0131n\u0131za indirmeniz gerekmektedir. Bunu yapmak i\u00e7in scp<\/code> (Secure Copy Protocol) veya sftp<\/code> gibi g\u00fcvenli bir dosya transfer arac\u0131 kullanabilirsiniz.<\/p>\n
\u00d6rnek olarak SCP kullan\u0131m\u0131 (yerel makinenizden):<\/strong><\/p>\n
scp user@your_server_ip:~\/client-configs\/files\/client1.ovpn \/path\/to\/local\/directory\/<\/code><\/pre>\n
*   user<\/code>: Sunucunuzdaki kullan\u0131c\u0131 ad\u0131n\u0131z.
\n*   your_server_ip<\/code>: OpenVPN sunucunuzun genel IP adresi.
\n*   \/path\/to\/local\/directory\/<\/code>: .ovpn<\/code> dosyas\u0131n\u0131 kaydetmek istedi\u011finiz yerel dizin.<\/p>\n
Dosyay\u0131 indirdikten sonra, OpenVPN istemcisini kurman\u0131z ve .ovpn<\/code> dosyas\u0131n\u0131 i\u00e7e aktarman\u0131z gerekir:<\/p>\n
*   Windows:<\/strong> OpenVPN GUI istemcisini indirin ve kurun. .ovpn<\/code> dosyas\u0131n\u0131 C:\\Program Files\\OpenVPN\\config<\/code> dizinine kopyalay\u0131n ve istemciyi ba\u015flat\u0131n.
\n*   macOS:<\/strong> Tunnelblick veya OpenVPN Connect uygulamas\u0131n\u0131 kullan\u0131n. .ovpn<\/code> dosyas\u0131n\u0131 i\u00e7e aktar\u0131n.
\n*   Linux:<\/strong> openvpn<\/code> paketini kurun ve komut sat\u0131r\u0131ndan sudo openvpn --config client1.ovpn<\/code> komutunu kullanarak ba\u011flan\u0131n veya NetworkManager entegrasyonunu kullan\u0131n.
\n*   Android\/iOS:<\/strong> OpenVPN Connect uygulamas\u0131n\u0131 uygulama ma\u011fazas\u0131ndan indirin ve .ovpn<\/code> dosyas\u0131n\u0131 uygulama arac\u0131l\u0131\u011f\u0131yla i\u00e7e aktar\u0131n (genellikle e-posta, bulut depolama veya do\u011frudan dosya payla\u015f\u0131m\u0131 ile).<\/p>\n
Ba\u011fland\u0131ktan sonra, IP adresinizi kontrol etmek i\u00e7in bir web sitesini (\u00f6rne\u011fin, “what is my ip” diye arama yaparak) ziyaret edebilir ve OpenVPN sunucunuzun IP adresini g\u00f6rd\u00fc\u011f\u00fcn\u00fczden emin olabilirsiniz. Bu, ba\u011flant\u0131n\u0131z\u0131n ba\u015far\u0131l\u0131 oldu\u011funu g\u00f6sterir.<\/p>\n
Ek \u0130stemciler Ekleme<\/h3>\n
Yeni bir istemci eklemek isterseniz, Ad\u0131m 7’deki istemci sertifikas\u0131 olu\u015fturma ve .ovpn<\/code> dosyas\u0131n\u0131 birle\u015ftirme ad\u0131mlar\u0131n\u0131 tekrarlaman\u0131z yeterlidir. Her yeni istemci i\u00e7in benzersiz bir ad (\u00f6rne\u011fin, client2<\/code>, client3<\/code>) kulland\u0131\u011f\u0131n\u0131zdan emin olun.<\/p>\n
\u00d6rne\u011fin, client2<\/code> i\u00e7in:<\/p>\n
cd \/etc\/openvpn\/easy-rsa\n.\/easyrsa gen-req client2 nopass\n.\/easyrsa sign-req client client2\n\nsudo cp pki\/issued\/client2.crt ~\/client-configs\/files\/\nsudo cp pki\/private\/client2.key ~\/client-configs\/files\/\n\ncd ~\/client-configs\/files\nsudo bash -c 'cat base.conf \\\n    <(echo -e \"\") \\\n    ca.crt \\\n    <(echo -e \"<\/ca>\\n\") \\\n    client2.crt \\\n    <(echo -e \"<\/cert>\\n\") \\\n    client2.key \\\n    <(echo -e \"<\/key>\\n\") \\\n    ta.key \\\n    <(echo -e \"<\/tls-auth>\") \\\n    > client2.ovpn'<\/code><\/pre>\n
Ard\u0131ndan client2.ovpn<\/code> dosyas\u0131n\u0131 indirin ve kullan\u0131n.<\/p>\n
\u0130stemci Sertifikas\u0131n\u0131 \u0130ptal Etme (Revoke)<\/h3>\n
Bir istemcinin VPN eri\u015fimini iptal etmek isterseniz (\u00f6rne\u011fin, bir cihaz kayboldu veya bir kullan\u0131c\u0131n\u0131n eri\u015fimi sonland\u0131r\u0131ld\u0131), sertifikas\u0131n\u0131 iptal edebilirsiniz.<\/p>\n
cd \/etc\/openvpn\/easy-rsa\n.\/easyrsa revoke client1<\/code><\/pre>\n
Onaylamak i\u00e7in yes<\/code> yaz\u0131n. Ard\u0131ndan, sertifika iptal listesini (CRL) yeniden olu\u015fturman\u0131z gerekir:<\/p>\n
.\/easyrsa gen-crl<\/code><\/pre>\n
Yeni crl.pem<\/code> dosyas\u0131n\u0131 OpenVPN yap\u0131land\u0131rma dizinine kopyalay\u0131n:<\/p>\n
sudo cp pki\/crl.pem \/etc\/openvpn\/<\/code><\/pre>\n
Ve server.conf<\/code> dosyas\u0131na a\u015fa\u011f\u0131daki sat\u0131r\u0131 ekleyerek sunucunun CRL’yi kullanmas\u0131n\u0131 sa\u011flay\u0131n:<\/p>\n
sudo nano \/etc\/openvpn\/server.conf<\/code><\/pre>\n
Dosyan\u0131n herhangi bir yerine (genellikle tls-auth<\/code> sat\u0131r\u0131n\u0131n alt\u0131na) ekleyin:<\/p>\n
crl-verify crl.pem<\/code><\/pre>\n
Dosyay\u0131 kaydedin ve kapat\u0131n. Son olarak, OpenVPN sunucusunu yeniden ba\u015flat\u0131n ki yeni CRL’yi y\u00fcklesin:<\/p>\n
sudo systemctl restart openvpn@server<\/code><\/pre>\n
Art\u0131k client1<\/code> sertifikas\u0131yla ba\u011flant\u0131 kurmaya \u00e7al\u0131\u015fan herhangi bir istemciye eri\u015fim reddedilecektir.<\/p>\n
Sorun Giderme ve \u0130pu\u00e7lar\u0131<\/h3>\n
OpenVPN kurulumu s\u0131ras\u0131nda veya sonras\u0131nda kar\u015f\u0131la\u015fabilece\u011finiz baz\u0131 yayg\u0131n sorunlar ve \u00e7\u00f6z\u00fcmleri:<\/p>\n
*   Ba\u011flant\u0131 Kurulam\u0131yor:<\/strong>
\n    *   G\u00fcvenlik Duvar\u0131:<\/strong> Sunucunuzdaki g\u00fcvenlik duvar\u0131n\u0131n (UFW\/iptables) OpenVPN portunu (varsay\u0131lan 1194\/udp) engellemedi\u011finden emin olun. NAT kurallar\u0131n\u0131n do\u011fru yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131n\u0131 kontrol edin.
\n    *   IP Y\u00f6nlendirme:<\/strong> net.ipv4.ip_forward = 1<\/code> ayar\u0131n\u0131n etkin oldu\u011fundan ve sudo sysctl -p<\/code> ile uyguland\u0131\u011f\u0131ndan emin olun.
\n    *   Loglar:<\/strong> OpenVPN sunucu loglar\u0131n\u0131 kontrol edin (journalctl -u openvpn@server -f<\/code> veya tail -f \/var\/log\/openvpn.log<\/code>). Hata mesajlar\u0131 sorunun kayna\u011f\u0131n\u0131 g\u00f6sterebilir.
\n    *   \u0130stemci Yap\u0131land\u0131rmas\u0131:<\/strong> client.ovpn<\/code> dosyas\u0131ndaki remote YOUR_SERVER_IP<\/code> k\u0131sm\u0131n\u0131n do\u011fru sunucu IP adresini i\u00e7erdi\u011finden ve proto<\/code>, cipher<\/code>, auth<\/code>, compress<\/code> ayarlar\u0131n\u0131n sunucu yap\u0131land\u0131rmas\u0131yla e\u015fle\u015fti\u011finden emin olun.
\n    *   Protokol:<\/strong> Bazen UDP trafi\u011fi a\u011fda engellenebilir. Sunucu ve istemci yap\u0131land\u0131rmalar\u0131nda proto udp<\/code> yerine proto tcp<\/code> denemeyi d\u00fc\u015f\u00fcnebilirsiniz.
\n    *   Sertifika ve Anahtarlar:<\/strong> Sertifika ve anahtar dosyalar\u0131n\u0131n do\u011fru yerlerde oldu\u011fundan ve izinlerinin do\u011fru ayarland\u0131\u011f\u0131ndan emin olun.<\/p>\n
*   Ba\u011flan\u0131yor ama \u0130nternet Eri\u015fimi Yok:<\/strong>
\n    *   NAT Kural\u0131:<\/strong> G\u00fcvenlik duvar\u0131n\u0131zdaki NAT (MASQUERADE) kural\u0131n\u0131n do\u011fru aray\u00fcz ve IP aral\u0131\u011f\u0131 ile yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131ndan emin olun (-o eth0<\/code> k\u0131sm\u0131n\u0131 kontrol edin).
\n    *   DNS:<\/strong> \u0130stemciye do\u011fru DNS sunucular\u0131n\u0131n (push \"dhcp-option DNS ...\"<\/code>) iletildi\u011finden emin olun. Ba\u011flant\u0131 kurduktan sonra istemcinizde DNS \u00e7\u00f6z\u00fcmlemesi yap\u0131p yapmad\u0131\u011f\u0131n\u0131 kontrol edin.
\n    *   redirect-gateway<\/code>:<\/strong> push \"redirect-gateway def1 bypass-dhcp\"<\/code> sat\u0131r\u0131n\u0131n server.conf<\/code> dosyas\u0131nda oldu\u011fundan emin olun.<\/p>\n
*   Performans Sorunlar\u0131:<\/strong>
\n    *   \u015eifreleme:<\/strong> cipher<\/code> ve auth<\/code> algoritmalar\u0131n\u0131 \u00e7ok y\u00fcksek ayarlamak (\u00f6rne\u011fin, AES-256-GCM yerine daha eski, daha az g\u00fcvenli ama daha az kaynak t\u00fcketen bir algoritma kullanmak) performans\u0131 art\u0131rabilir, ancak g\u00fcvenlikten \u00f6d\u00fcn verir. Genellikle modern CPU’lar AES-256-GCM’yi donan\u0131msal olarak h\u0131zland\u0131rabilir.
\n    *   S\u0131k\u0131\u015ft\u0131rma:<\/strong> compress lz4-v2<\/code> veya compress lzo<\/code> kullanmak bant geni\u015fli\u011fini d\u00fc\u015f\u00fcrebilir ancak CPU y\u00fck\u00fcn\u00fc art\u0131rabilir. E\u011fer CPU k\u0131s\u0131tl\u0131ysa veya zaten h\u0131zl\u0131 bir ba\u011flant\u0131n\u0131z varsa s\u0131k\u0131\u015ft\u0131rmay\u0131 kapatmay\u0131 deneyebilirsiniz.<\/p>\n
*   G\u00fcvenlik \u0130pu\u00e7lar\u0131:<\/strong>
\n    *   G\u00fcncel Tutun:<\/strong> OpenVPN yaz\u0131l\u0131m\u0131n\u0131 ve i\u015fletim sisteminizi d\u00fczenli olarak g\u00fcncelleyin.
\n    *   G\u00fc\u00e7l\u00fc \u015eifreler:<\/strong> Sertifika ve anahtarlar\u0131n\u0131z\u0131 olu\u015ftururken nopass<\/code> kullanmak yerine parola kullanmay\u0131 d\u00fc\u015f\u00fcnebilirsiniz (ancak bu, sunucu yeniden ba\u015flat\u0131ld\u0131\u011f\u0131nda manuel m\u00fcdahale gerektirecektir).
\n    *   Her \u0130stemciye Ayr\u0131 Sertifika:<\/strong> Her istemci i\u00e7in ayr\u0131 bir sertifika\/anahtar \u00e7ifti olu\u015fturmak, bir istemci anahtar\u0131n\u0131n ele ge\u00e7irilmesi durumunda di\u011ferlerinin etkilenmemesini sa\u011flar.
\n    *   duplicate-cn<\/code> Kullanmay\u0131n:<\/strong> server.conf<\/code> i\u00e7inde duplicate-cn<\/code> se\u00e7ene\u011fini kullanmaktan ka\u00e7\u0131n\u0131n. Bu, ayn\u0131 sertifikay\u0131 birden fazla istemcinin kullanmas\u0131na izin verir ve g\u00fcvenlik riskleri ta\u015f\u0131r.<\/p>\n
Sonu\u00e7<\/h3>\n
Debian 11 \u00fczerinde kendi OpenVPN sunucunuzu kurmak, ba\u015flang\u0131\u00e7ta karma\u015f\u0131k g\u00f6r\u00fcnebilir, ancak bu ad\u0131m ad\u0131m rehberle s\u00fcreci ba\u015far\u0131yla tamamlam\u0131\u015f olmal\u0131s\u0131n\u0131z. Art\u0131k kendi g\u00fcvenli VPN ba\u011flant\u0131n\u0131za sahipsiniz ve internet trafi\u011finizi \u015fifreleyerek gizlili\u011finizi ve g\u00fcvenli\u011finizi art\u0131rabilirsiniz.<\/p>\n
Kendi VPN sunucunuz, \u00fc\u00e7\u00fcnc\u00fc taraf VPN sa\u011flay\u0131c\u0131lar\u0131na olan ba\u011f\u0131ml\u0131l\u0131\u011f\u0131n\u0131z\u0131 ortadan kald\u0131r\u0131r ve verileriniz \u00fczerinde tam kontrol sahibi olman\u0131z\u0131 sa\u011flar. Bu, \u00f6zellikle hassas verilerle \u00e7al\u0131\u015fan veya \u00e7evrimi\u00e7i gizlili\u011fine \u00f6nem veren kullan\u0131c\u0131lar i\u00e7in b\u00fcy\u00fck bir avantajd\u0131r. Unutmay\u0131n, siber g\u00fcvenlik s\u00fcrekli bir s\u00fcre\u00e7tir; sunucunuzu ve OpenVPN yaz\u0131l\u0131m\u0131n\u0131z\u0131 d\u00fczenli olarak g\u00fcncel tutmak, g\u00fcvenli\u011finizi koruman\u0131n anahtar\u0131d\u0131r. G\u00fcvenli internet deneyimleriniz olsun!<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Debian 11 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber\n\u0130nternet \u00e7a\u011f\u0131nda gizlilik ve g\u00fcvenlik, bireyler ve i\u015fletmeler i\u00e7in hayati","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[241],"tags":[],"class_list":{"0":"post-38175","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-linux","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nDebian 11 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/debian-11-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Debian 11 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber\" \/>\n<meta property=\"og:description\" content=\"Debian 11 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber \u0130nternet \u00e7a\u011f\u0131nda gizlilik ve g\u00fcvenlik, bireyler ve i\u015fletmeler i\u00e7in hayati\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/debian-11-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2026-01-24T21:40:52+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"19 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/debian-11-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/debian-11-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Debian 11 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber\",\"datePublished\":\"2026-01-24T21:40:52+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/debian-11-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/\"},\"wordCount\":2926,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Linux\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/debian-11-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/#respond\"]}],\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/debian-11-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/debian-11-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/\",\"name\":\"Debian 11 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2026-01-24T21:40:52+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/debian-11-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/debian-11-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/debian-11-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Debian 11 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Debian 11 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/debian-11-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/","og_locale":"tr_TR","og_type":"article","og_title":"Debian 11 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber","og_description":"Debian 11 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber \u0130nternet \u00e7a\u011f\u0131nda gizlilik ve g\u00fcvenlik, bireyler ve i\u015fletmeler i\u00e7in hayati","og_url":"https:\/\/fatihsoysal.com\/blog\/debian-11-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2026-01-24T21:40:52+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"19 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/debian-11-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/debian-11-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Debian 11 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber","datePublished":"2026-01-24T21:40:52+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/debian-11-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/"},"wordCount":2926,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Linux"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/debian-11-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/#respond"]}],"copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/debian-11-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/","url":"https:\/\/fatihsoysal.com\/blog\/debian-11-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/","name":"Debian 11 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2026-01-24T21:40:52+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/debian-11-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/debian-11-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/debian-11-uzerinde-openvpn-sunucusu-kurulumu-kapsamli-bir-rehber\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Debian 11 \u00dczerinde OpenVPN Sunucusu Kurulumu: Kapsaml\u0131 Bir Rehber"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/38175","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=38175"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/38175\/revisions"}],"predecessor-version":[{"id":38176,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/38175\/revisions\/38176"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=38175"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=38175"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=38175"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}