{"id":43061,"date":"2026-07-04T17:01:57","date_gmt":"2026-07-04T14:01:57","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/?p=43061"},"modified":"2026-07-04T17:02:41","modified_gmt":"2026-07-04T14:02:41","slug":"debian-8-jessie-uzerinde-openvpn-sunucusu-nasil-kurulur","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/debian-8-jessie-uzerinde-openvpn-sunucusu-nasil-kurulur\/","title":{"rendered":"Debian 8 (Jessie) \u00dczerinde OpenVPN Sunucusu Nas\u0131l Kurulur?"},"content":{"rendered":"<h2>Debian 8 (Jessie) \u00dczerinde OpenVPN Sunucusu Nas\u0131l Kurulur?<\/h2>\n<p>G\u00fcn\u00fcm\u00fczde veri g\u00fcvenli\u011fi, gizlilik ve uzak a\u011flara g\u00fcvenli eri\u015fim ihtiyac\u0131 her zamankinden daha kritik bir hale gelmi\u015ftir. \u0130nternet \u00fczerindeki verilerimizin \u00fc\u00e7\u00fcnc\u00fc \u015fah\u0131slar, k\u00f6t\u00fc niyetli akt\u00f6rler veya servis sa\u011flay\u0131c\u0131lar taraf\u0131ndan izlenmesini engellemenin en etkili yollar\u0131ndan biri Sanal \u00d6zel A\u011f (VPN &#8211; Virtual Private Network) teknolojilerini kullanmakt\u0131r. OpenVPN, a\u00e7\u0131k kaynak kodlu yap\u0131s\u0131, y\u00fcksek g\u00fcvenlik standartlar\u0131, esnek yap\u0131land\u0131rma se\u00e7enekleri ve platformlar aras\u0131 geni\u015f deste\u011fi ile sekt\u00f6r standart\u0131 haline gelmi\u015f bir VPN protokol\u00fcd\u00fcr.<\/p>\n<p>Bu teknik makalede, Debian 8 (Jessie) i\u015fletim sistemi \u00fczerinde ad\u0131m ad\u0131m, s\u0131f\u0131rdan ve tamamen g\u00fcvenli bir OpenVPN sunucusunun nas\u0131l kurulaca\u011f\u0131n\u0131, sertifika otoritesinin (CA) nas\u0131l yap\u0131land\u0131r\u0131laca\u011f\u0131n\u0131, a\u011f y\u00f6nlendirmelerinin nas\u0131l aktif edilece\u011fini ve istemci (client) profillerinin nas\u0131l olu\u015fturulaca\u011f\u0131n\u0131 detayl\u0131 bir \u015fekilde ele alaca\u011f\u0131z. Debian 8, g\u00f6rece eski bir da\u011f\u0131t\u0131m olsa da end\u00fcstriyel sistemlerde ve legacy (miras) altyap\u0131larda halen aktif olarak kullan\u0131lmaktad\u0131r. Bu nedenle, bu sistem \u00fczerinde kararl\u0131 bir OpenVPN yap\u0131s\u0131 kurmak sistem y\u00f6neticileri i\u00e7in \u00f6nemli bir kazan\u0131md\u0131r.<\/p>\n<h3>OpenVPN Mimarisi ve Temel Kavramlar<\/h3>\n<p>Kuruluma ge\u00e7meden \u00f6nce, OpenVPN\u2019in arkas\u0131ndaki temel kriptografik ve a\u011f mimarisini anlamak, yap\u0131land\u0131rma s\u0131ras\u0131nda yapaca\u011f\u0131m\u0131z tercihlerin nedenini kavramam\u0131za yard\u0131mc\u0131 olacakt\u0131r. OpenVPN, iki temel \u00e7al\u0131\u015fma moduna sahiptir: <strong>TUN (T\u00fcnel)<\/strong> ve <strong>TAP (K\u00f6pr\u00fcleme)<\/strong>.<\/p>\n<ul>\n<li><strong>TUN (IP T\u00fcneli &#8211; Layer 3):<\/strong> Bu modda OpenVPN, sanal bir noktadan noktaya (point-to-point) IP t\u00fcneli olu\u015fturur. Veri paketleri IP seviyesinde y\u00f6nlendirilir. Daha az genel gider (overhead) olu\u015fturdu\u011fu, daha h\u0131zl\u0131 oldu\u011fu ve mobil cihazlar dahil neredeyse t\u00fcm platformlar taraf\u0131ndan desteklendi\u011fi i\u00e7in genel VPN ihtiya\u00e7lar\u0131nda TUN modu tercih edilir. Bu rehberde de TUN modunu kullanaca\u011f\u0131z.<\/li>\n<li><strong>TAP (A\u011f K\u00f6pr\u00fcs\u00fc &#8211; Layer 2):<\/strong> Bu modda ise sanal bir ethernet adapt\u00f6r\u00fc olu\u015fturulur ve veri paketleri Ethernet \u00e7er\u00e7evesi (frame) seviyesinde ta\u015f\u0131n\u0131r. Sanki istemci, sunucunun bulundu\u011fu yerel a\u011fa fiziksel bir kablo ile ba\u011flanm\u0131\u015f gibi davran\u0131r. NetBIOS yay\u0131nlar\u0131 veya multicast trafik gerektiren \u00f6zel durumlar d\u0131\u015f\u0131nda genellikle tercih edilmez.<\/li>\n<\/ul>\n<p>G\u00fcvenlik taraf\u0131nda ise OpenVPN, SSL\/TLS protokol\u00fcn\u00fc temel al\u0131r. Bu yap\u0131, asimetrik \u015fifreleme (kamusal ve \u00f6zel anahtar \u00e7iftleri) kullanarak istemci ile sunucu aras\u0131nda g\u00fcvenli bir el s\u0131k\u0131\u015fma (handshake) ger\u00e7ekle\u015ftirir. El s\u0131k\u0131\u015fma tamamland\u0131ktan sonra, veri trafi\u011finin h\u0131zl\u0131 bir \u015fekilde \u015fifrelenmesi i\u00e7in simetrik \u015fifreleme (\u00f6rne\u011fin AES-256-CBC veya AES-256-GCM) algoritmas\u0131na ge\u00e7ilir. Bu yap\u0131y\u0131 kurabilmek i\u00e7in kendi <strong>Sertifika Otoritemizi (CA &#8211; Certificate Authority)<\/strong> olu\u015fturmam\u0131z gerekmektedir.<\/p>\n<h2>Gereksinimler ve Haz\u0131rl\u0131k<\/h2>\n<p>Kuruluma ba\u015flamadan \u00f6nce a\u015fa\u011f\u0131daki gereksinimlerin kar\u015f\u0131land\u0131\u011f\u0131ndan emin olmal\u0131s\u0131n\u0131z:<\/p>\n<ul>\n<li>Temiz bir Debian 8 (Jessie) kurulumuna sahip, statik bir genel (public) IP adresine sahip sunucu (Sanal \u00d6zel Sunucu &#8211; VPS veya Fiziksel Sunucu).<\/li>\n<li>Sisteme eri\u015fim i\u00e7in <code>root<\/code> yetkileri veya <code>sudo<\/code> yetkisine sahip bir kullan\u0131c\u0131.<\/li>\n<li>\u0130stemci cihazlar\u0131n sunucuya eri\u015febilmesi i\u00e7in UDP 1194 portunun (veya se\u00e7ece\u011finiz \u00f6zel bir portun) g\u00fcvenlik duvar\u0131nda (firewall) a\u00e7\u0131k olmas\u0131.<\/li>\n<\/ul>\n<p>Debian 8 depolar\u0131n\u0131n g\u00fcncel kalmas\u0131 ve paketlerin sorunsuz kurulabilmesi i\u00e7in \u00f6ncelikle sistem paket listesini g\u00fcncelleyelim. A\u015fa\u011f\u0131daki komutlar\u0131 terminalinizde \u00e7al\u0131\u015ft\u0131r\u0131n:<\/p>\n<pre><code>apt-get update\napt-get upgrade -y<\/code><\/pre>\n<h2>Ad\u0131m 1: OpenVPN ve Easy-RSA Paketlerinin Kurulmas\u0131<\/h2>\n<p>Debian 8 \u00fczerinde OpenVPN kurmak olduk\u00e7a kolayd\u0131r, \u00e7\u00fcnk\u00fc gerekli t\u00fcm paketler resmi Debian depolar\u0131nda mevcuttur. OpenVPN \u015fifreleme anahtarlar\u0131n\u0131 ve sertifikalar\u0131n\u0131 y\u00f6netmek i\u00e7in <code>easy-rsa<\/code> ad\u0131 verilen yard\u0131mc\u0131 betik arac\u0131n\u0131 kullanaca\u011f\u0131z. Bu ara\u00e7, karma\u015f\u0131k OpenSSL komutlar\u0131n\u0131 basitle\u015ftirerek kendi CA yap\u0131m\u0131z\u0131 kurmam\u0131z\u0131 sa\u011flar.<\/p>\n<p>Gerekli paketleri kurmak i\u00e7in \u015fu komutu \u00e7al\u0131\u015ft\u0131r\u0131n:<\/p>\n<pre><code>apt-get install openvpn easy-rsa -y<\/code><\/pre>\n<p>Kurulum tamamland\u0131ktan sonra, g\u00fcvenlik amac\u0131yla sertifika \u00fcretim i\u015flemlerini do\u011frudan sistem dizinlerinde yapmak yerine, kendimize \u00f6zel bir \u00e7al\u0131\u015fma alan\u0131 olu\u015fturaca\u011f\u0131z. Easy-RSA \u015fablon dosyalar\u0131n\u0131 OpenVPN yap\u0131land\u0131rma dizinine kopyalayal\u0131m:<\/p>\n<pre><code>make-cadir \/etc\/openvpn\/easy-rsa<\/code><\/pre>\n<p>E\u011fer <code>make-cadir<\/code> komutu sisteminizde bulunmuyorsa, alternatif olarak manuel kopyalama i\u015flemini \u015fu \u015fekilde ger\u00e7ekle\u015ftirebilirsiniz:<\/p>\n<pre><code>mkdir -p \/etc\/openvpn\/easy-rsa\ncp -r \/usr\/share\/easy-rsa\/* \/etc\/openvpn\/easy-rsa\/<\/code><\/pre>\n<h2>Ad\u0131m 2: Sertifika Otoritesinin (CA) Yap\u0131land\u0131r\u0131lmas\u0131<\/h2>\n<p>Sertifika \u00fcretmeye ba\u015flamadan \u00f6nce, olu\u015fturulacak sertifikalar\u0131n kimlik bilgilerini (\u00fclke, \u015fehir, organizasyon vb.) tan\u0131mlayan de\u011fi\u015fkenleri d\u00fczenlemeliyiz. Bu bilgiler <code>\/etc\/openvpn\/easy-rsa\/vars<\/code> dosyas\u0131 i\u00e7inde saklan\u0131r.<\/p>\n<p>Favori metin edit\u00f6r\u00fcn\u00fczle (\u00f6rne\u011fin <code>nano<\/code>) bu dosyay\u0131 a\u00e7\u0131n:<\/p>\n<pre><code>nano \/etc\/openvpn\/easy-rsa\/vars<\/code><\/pre>\n<p>Dosyan\u0131n alt k\u0131s\u0131mlar\u0131na do\u011fru ilerleyin ve a\u015fa\u011f\u0131daki sat\u0131rlar\u0131 kendi ki\u015fisel veya kurumsal bilgilerinize g\u00f6re d\u00fczenleyin. Bu de\u011ferlerin bo\u015f kalmamas\u0131 ve varsay\u0131lan de\u011ferler yerine size \u00f6zel de\u011ferlerle de\u011fi\u015ftirilmesi g\u00fcvenlik ve tan\u0131mlanabilirlik a\u00e7\u0131s\u0131ndan \u00f6nemlidir:<\/p>\n<pre><code>export KEY_COUNTRY=\"TR\"\nexport KEY_PROVINCE=\"Istanbul\"\nexport KEY_CITY=\"Istanbul\"\nexport KEY_ORG=\"Sirketiniz\"\nexport KEY_EMAIL=\"admin@sirketiniz.com\"\nexport KEY_OU=\"BilgiIslem\"<\/code><\/pre>\n<p>Ayr\u0131ca, anahtar uzunlu\u011funu belirleyen parametreyi de kontrol edin. G\u00fcvenlik standartlar\u0131 gere\u011fi bu de\u011ferin en az 2048 bit olmas\u0131 gerekir. Debian 8 \u00fczerindeki Easy-RSA s\u00fcr\u00fcm\u00fcnde varsay\u0131lan olarak 2048 gelmektedir, ancak emin olmak i\u00e7in \u015fu sat\u0131r\u0131 kontrol edebilirsiniz:<\/p>\n<pre><code>export KEY_SIZE=2048<\/code><\/pre>\n<p>Dosyay\u0131 kaydedip kapat\u0131n (Nano kullan\u0131yorsan\u0131z <code>CTRL+O<\/code>, ard\u0131ndan <code>Enter<\/code> ve \u00e7\u0131k\u0131\u015f i\u00e7in <code>CTRL+X<\/code>).<\/p>\n<p>\u015eimdi, bu de\u011fi\u015fkenleri mevcut terminal oturumumuza y\u00fckleyelim ve temiz bir ba\u015flang\u0131\u00e7 yapmak i\u00e7in eski anahtarlar\u0131 temizleyelim:<\/p>\n<pre><code>cd \/etc\/openvpn\/easy-rsa\nsource .\/vars\n.\/clean-all<\/code><\/pre>\n<p><em>Not: <code>.\/clean-all<\/code> komutu, daha \u00f6nce olu\u015fturulmu\u015f t\u00fcm anahtarlar\u0131 ve sertifikalar\u0131 siler. Bu nedenle bu komutu yaln\u0131zca ilk kurulum s\u0131ras\u0131nda \u00e7al\u0131\u015ft\u0131rmal\u0131s\u0131n\u0131z.<\/em><\/p>\n<h2>Ad\u0131m 3: CA, Sunucu Sertifikas\u0131 ve Anahtarlar\u0131n\u0131n \u00dcretilmesi<\/h2>\n<p>Bu a\u015famada, OpenVPN sunucusunun ve istemcilerinin g\u00fcvenli\u011fini sa\u011flayacak olan kriptografik bile\u015fenleri \u00fcretece\u011fiz.<\/p>\n<h3>1. Sertifika Otoritesinin (CA) Olu\u015fturulmas\u0131<\/h3>\n<p>CA, hem sunucunun hem de istemcilerin kimliklerini do\u011frulamak i\u00e7in imzalayaca\u011f\u0131 ana sertifikad\u0131r. A\u015fa\u011f\u0131daki komutu \u00e7al\u0131\u015ft\u0131rarak CA anahtar\u0131n\u0131 ve sertifikas\u0131n\u0131 \u00fcretin:<\/p>\n<pre><code>.\/build-ca<\/code><\/pre>\n<p>Komut \u00e7al\u0131\u015ft\u0131r\u0131ld\u0131\u011f\u0131nda size daha \u00f6nce <code>vars<\/code> dosyas\u0131nda tan\u0131mlad\u0131\u011f\u0131n\u0131z de\u011ferleri onaylaman\u0131z i\u00e7in sorular soracakt\u0131r. De\u011ferler do\u011fru oldu\u011fu i\u00e7in her soruda <code>Enter<\/code> tu\u015funa basarak h\u0131zl\u0131ca ilerleyebilirsiniz. Sadece &#8220;Common Name&#8221; k\u0131sm\u0131nda &#8220;Sirket-CA&#8221; gibi tan\u0131mlay\u0131c\u0131 bir isim girebilirsiniz.<\/p>\n<h3>2. Sunucu Sertifikas\u0131 ve \u00d6zel Anahtar\u0131n\u0131n \u00dcretilmesi<\/h3>\n<p>\u015eimdi OpenVPN sunucusunun kendisi i\u00e7in kullanaca\u011f\u0131 sertifikay\u0131 ve \u00f6zel anahtar\u0131 \u00fcretece\u011fiz. Sunucu ad\u0131 olarak &#8220;server&#8221; ismini kullanaca\u011f\u0131z:<\/p>\n<pre><code>.\/build-key-server server<\/code><\/pre>\n<p>Yine kar\u015f\u0131n\u0131za \u00e7\u0131kan sorular\u0131 <code>Enter<\/code> ile onaylayarak ge\u00e7in. S\u00fcrecin sonunda size iki \u00f6nemli soru sorulacakt\u0131r:<\/p>\n<ul>\n<li>&#8220;Sign the certificate? [y\/n]&#8221; (Sertifika imzalans\u0131n m\u0131?) -> <code>y<\/code> yaz\u0131p onaylay\u0131n.<\/li>\n<li>&#8220;1 out of 1 certificate requests certified, commit? [y\/n]&#8221; (De\u011fi\u015fiklikler kaydedilsin mi?) -> <code>y<\/code> yaz\u0131p onaylay\u0131n.<\/li>\n<\/ul>\n<h3>3. Diffie-Hellman Parametrelerinin Olu\u015fturulmas\u0131<\/h3>\n<p>Diffie-Hellman anahtar de\u011fi\u015fimi, istemci ve sunucunun g\u00fcvensiz bir kanal \u00fczerinden g\u00fcvenli bir \u015fekilde \u015fifreleme anahtarlar\u0131 \u00fczerinde anla\u015fmas\u0131n\u0131 sa\u011flayan bir algoritmad\u0131r. 2048 bitlik DH parametrelerini \u00fcretmek i\u00e7in \u015fu komutu \u00e7al\u0131\u015ft\u0131r\u0131n:<\/p>\n<pre><code>.\/build-dh<\/code><\/pre>\n<p>Bu i\u015flem sunucunuzun i\u015flemci g\u00fcc\u00fcne ba\u011fl\u0131 olarak birka\u00e7 dakika s\u00fcrebilir. Tamamland\u0131\u011f\u0131nda <code>\/etc\/openvpn\/easy-rsa\/keys\/dh2048.pem<\/code> dosyas\u0131 olu\u015fturulacakt\u0131r.<\/p>\n<h3>4. HMAC \u0130mzas\u0131n\u0131n (TLS-Auth) Olu\u015fturulmas\u0131<\/h3>\n<p>OpenVPN a\u011f\u0131n\u0131 port taramalar\u0131na, DoS (Denial of Service) sald\u0131r\u0131lar\u0131na ve yetkisiz ba\u011flant\u0131 ba\u015flatma giri\u015fimlerine kar\u015f\u0131 korumak i\u00e7in ek bir g\u00fcvenlik katman\u0131 olan TLS-Auth \u00f6zelli\u011fini aktif edece\u011fiz. Bu \u00f6zellik, sunucunun yaln\u0131zca bu \u00f6zel \u00f6n payla\u015f\u0131ml\u0131 anahtara sahip istemcilerden gelen el s\u0131k\u0131\u015fma paketlerini kabul etmesini sa\u011flar. Anahtar\u0131 \u00fcretmek i\u00e7in:<\/p>\n<pre><code>openvpn --genkey --secret keys\/ta.key<\/code><\/pre>\n<h2>Ad\u0131m 4: Sertifikalar\u0131n OpenVPN Dizinine Ta\u015f\u0131nmas\u0131<\/h2>\n<p>\u00dcretti\u011fimiz t\u00fcm bu hassas anahtar ve sertifika dosyalar\u0131n\u0131 OpenVPN&#8217;in ana \u00e7al\u0131\u015fma dizinine kopyalamam\u0131z gerekir. B\u00f6ylece OpenVPN servis ba\u015flat\u0131ld\u0131\u011f\u0131nda bu dosyalara do\u011frudan eri\u015febilir:<\/p>\n<pre><code>cd \/etc\/openvpn\/easy-rsa\/keys\ncp ca.crt server.crt server.key dh2048.pem ta.key \/etc\/openvpn\/<\/code><\/pre>\n<p>Bu dosyalar\u0131n g\u00fcvenli\u011fi kritik \u00f6nem ta\u015f\u0131r. \u00d6zellikle <code>server.key<\/code> dosyas\u0131n\u0131n yetkisiz kullan\u0131c\u0131lar taraf\u0131ndan okunmas\u0131n\u0131 engellemek i\u00e7in dosya izinlerini s\u0131k\u0131la\u015ft\u0131ral\u0131m:<\/p>\n<pre><code>chmod 600 \/etc\/openvpn\/server.key<\/code><\/pre>\n<h2>Ad\u0131m 5: OpenVPN Sunucusunun Yap\u0131land\u0131r\u0131lmas\u0131<\/h2>\n<p>Sertifikalar\u0131m\u0131z haz\u0131r oldu\u011funa g\u00f6re, OpenVPN sunucusunun nas\u0131l davranaca\u011f\u0131n\u0131 belirleyen ana yap\u0131land\u0131rma dosyas\u0131n\u0131 olu\u015fturabiliriz. Debian 8 \u00fczerinde OpenVPN paketiyle birlikte \u00f6rnek bir yap\u0131land\u0131rma dosyas\u0131 gelir. Bu dosyay\u0131 kopyalay\u0131p \u00fczerinde d\u00fczenleme yapabiliriz:<\/p>\n<pre><code>gunzip -c \/usr\/share\/doc\/openvpn\/examples\/sample-config-files\/server.conf.gz > \/etc\/openvpn\/server.conf<\/code><\/pre>\n<p>\u015eimdi bu yap\u0131land\u0131rma dosyas\u0131n\u0131 d\u00fczenleyelim:<\/p>\n<pre><code>nano \/etc\/openvpn\/server.conf<\/code><\/pre>\n<p>Dosya i\u00e7erisindeki mevcut sat\u0131rlar\u0131 inceleyin ve a\u015fa\u011f\u0131daki yap\u0131land\u0131rmaya uygun \u015fekilde g\u00fcncelleyin veya dosya i\u00e7eri\u011fini tamamen silerek a\u015fa\u011f\u0131daki optimize edilmi\u015f \u015fablonu yap\u0131\u015ft\u0131r\u0131n:<\/p>\n<pre><code># Sunucunun dinleyece\u011fi port ve protokol\nport 1194\nproto udp\ndev tun\n\n<h2>Sertifika ve Anahtar Yollar\u0131<\/h2>\nca ca.crt\ncert server.crt\nkey server.key\ndh dh2048.pem\n\n<h2>VPN A\u011f Yap\u0131land\u0131rmas\u0131 (\u0130stemcilere da\u011f\u0131t\u0131lacak IP aral\u0131\u011f\u0131)<\/h2>\nserver 10.8.0.0 255.255.255.0\n\n<h2>\u0130stemci IP adreslerinin kal\u0131c\u0131 olmas\u0131 i\u00e7in veritaban\u0131<\/h2>\nifconfig-pool-persist ipp.txt\n\n<h2>T\u00fcm istemci trafi\u011fini VPN \u00fczerinden y\u00f6nlendir (Default Gateway)<\/h2>\npush \"redirect-gateway def1 bypass-dhcp\"\n\n<h2>G\u00fcvenilir DNS Sunucular\u0131 (Google DNS veya OpenDNS)<\/h2>\npush \"dhcp-option DNS 8.8.8.8\"\npush \"dhcp-option DNS 8.8.4.4\"\n\n<h2>Ba\u011flant\u0131 kararl\u0131l\u0131\u011f\u0131 kontrol\u00fc (Her 10 saniyede bir ping at, 120 saniye yan\u0131t al\u0131namazsa ba\u011flant\u0131y\u0131 kes)<\/h2>\nkeepalive 10 120\n\n<h2>Ek G\u00fcvenlik ve \u015eifreleme Ayarlar\u0131<\/h2>\ntls-auth ta.key 0 # 0 de\u011feri sunucu i\u00e7in, 1 de\u011feri istemci i\u00e7indir\ncipher AES-256-CBC\ncomp-lzo\n\n<h2>Yetki S\u0131n\u0131rland\u0131rma (G\u00fcvenlik i\u00e7in servisi k\u0131s\u0131tl\u0131 yetkili kullan\u0131c\u0131 ile \u00e7al\u0131\u015ft\u0131r)<\/h2>\nuser nobody\ngroup nogroup\n\n<h2>Ba\u011flant\u0131 kesintilerinde anahtarlar\u0131 ve t\u00fcneli koru<\/h2>\npersist-key\npersist-tun\n\n<h2>G\u00fcnl\u00fckleme ve Durum Bilgisi<\/h2>\nstatus openvpn-status.log\nlog-append  \/var\/log\/openvpn.log\nverb 3<\/code><\/pre>\n<p>Dosyay\u0131 kaydedip kapat\u0131n. Buradaki <code>user nobody<\/code> ve <code>group nogroup<\/code> sat\u0131rlar\u0131 son derece \u00f6nemlidir. OpenVPN ba\u015flat\u0131ld\u0131ktan sonra root yetkilerinden vazge\u00e7erek i\u015fletim sisteminde hi\u00e7bir yetkisi olmayan &#8220;nobody&#8221; kullan\u0131c\u0131s\u0131n\u0131n haklar\u0131yla \u00e7al\u0131\u015fmaya devam eder. Bu sayede OpenVPN \u00fczerinde gelecekte bulunabilecek olas\u0131 bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131, sald\u0131rgan\u0131n t\u00fcm sunucuyu ele ge\u00e7irmesine engel olur.<\/p>\n<h2>Ad\u0131m 6: A\u011f Y\u00f6nlendirmesi ve IP Forwarding Yap\u0131land\u0131rmas\u0131<\/h2>\n<p>\u0130stemciler OpenVPN sunucusuna ba\u011fland\u0131klar\u0131nda, yaln\u0131zca sunucuya eri\u015fmekle kalmay\u0131p, sunucu \u00fczerinden internete \u00e7\u0131kabilmelidirler. Bunun i\u00e7in Debian 8 \u00fczerinde \u00e7ekirdek (kernel) seviyesinde IP paket y\u00f6nlendirmesini (IP Forwarding) aktif etmeli ve g\u00fcvenlik duvar\u0131nda NAT (Network Address Translation) kurallar\u0131 tan\u0131mlamal\u0131y\u0131z.<\/p>\n<h3>1. IP Forwarding Aktifle\u015ftirme<\/h3>\n<p>Ge\u00e7ici olarak aktif etmek i\u00e7in \u015fu komutu kullanabilirsiniz:<\/p>\n<pre><code>echo 1 > \/proc\/sys\/net\/ipv4\/ip_forward<\/code><\/pre>\n<p>Ancak bu ayar sunucu yeniden ba\u015flat\u0131ld\u0131\u011f\u0131nda kaybolacakt\u0131r. Kal\u0131c\u0131 hale getirmek i\u00e7in <code>\/etc\/sysctl.conf<\/code> dosyas\u0131n\u0131 d\u00fczenlemeliyiz:<\/p>\n<pre><code>nano \/etc\/sysctl.conf<\/code><\/pre>\n<p>A\u015fa\u011f\u0131daki sat\u0131r\u0131 bulun ve ba\u015f\u0131ndaki <code>#<\/code> i\u015faretini kald\u0131rarak aktif edin (e\u011fer yoksa dosyan\u0131n en alt\u0131na ekleyin):<\/p>\n<pre><code>net.ipv4.ip_forward=1<\/code><\/pre>\n<p>Dosyay\u0131 kaydedip kapat\u0131n. De\u011fi\u015fikliklerin hemen uygulanmas\u0131 i\u00e7in \u015fu komutu \u00e7al\u0131\u015ft\u0131r\u0131n:<\/p>\n<pre><code>sysctl -p<\/code><\/pre>\n<h3>2. iptables ile NAT (Masquerade) Yap\u0131land\u0131rmas\u0131<\/h3>\n<p>VPN istemcilerinden gelen paketlerin d\u0131\u015f d\u00fcnyaya sunucunun IP adresiyle \u00e7\u0131kabilmesi i\u00e7in <code>iptables<\/code> \u00fczerinde bir NAT kural\u0131 tan\u0131mlamal\u0131y\u0131z. \u00d6ncelikle sunucunuzun internete ba\u011fl\u0131 olan birincil a\u011f aray\u00fcz\u00fcn\u00fcn (interface) ad\u0131n\u0131 \u00f6\u011frenin:<\/p>\n<pre><code>ip route show | grep default<\/code><\/pre>\n<p>\u00c7\u0131kt\u0131da <code>dev eth0<\/code> veya <code>dev ens3<\/code> gibi bir ifade g\u00f6receksiniz. Bu rehberde d\u0131\u015f a\u011f aray\u00fcz\u00fcn\u00fcn <code>eth0<\/code> oldu\u011funu varsayarak devam edece\u011fiz. Kendi aray\u00fcz ad\u0131n\u0131za g\u00f6re komutu d\u00fczenleyin:<\/p>\n<pre><code>iptables -t nat -A POSTROUTING -s 10.8.0.0\/24 -o eth0 -j MASQUERADE<\/code><\/pre>\n<p>Bu kural\u0131n da sunucu yeniden ba\u015flat\u0131ld\u0131\u011f\u0131nda kaybolmamas\u0131 i\u00e7in <code>iptables-persistent<\/code> paketini kurabiliriz:<\/p>\n<pre><code>apt-get install iptables-persistent -y<\/code><\/pre>\n<p>Kurulum s\u0131ras\u0131nda mevcut kurallar\u0131 kaydetmek isteyip istemedi\u011finiz sorulacakt\u0131r. &#8220;Yes&#8221; se\u00e7ene\u011fini se\u00e7erek kurallar\u0131 kaydedin. E\u011fer daha sonra kurallar\u0131 g\u00fcncellemeniz gerekirse, \u015fu komutla mevcut kurallar\u0131 kal\u0131c\u0131 hale getirebilirsiniz:<\/p>\n<pre><code>iptables-save > \/etc\/iptables\/rules.v4<\/code><\/pre>\n<h2>Ad\u0131m 7: OpenVPN Servisinin Ba\u015flat\u0131lmas\u0131<\/h2>\n<p>T\u00fcm yap\u0131land\u0131rmalar tamamland\u0131. Art\u0131k OpenVPN servisini ba\u015flatabilir ve sistem a\u00e7\u0131l\u0131\u015f\u0131nda otomatik olarak \u00e7al\u0131\u015fmas\u0131 i\u00e7in etkinle\u015ftirebiliriz. Debian 8, systemd servis y\u00f6neticisini kullan\u0131r.<\/p>\n<pre><code>systemctl start openvpn@server\nsystemctl enable openvpn@server<\/code><\/pre>\n<p>Servisin durumunu kontrol etmek ve sorunsuz \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan emin olmak i\u00e7in:<\/p>\n<pre><code>systemctl status openvpn@server<\/code><\/pre>\n<p>E\u011fer \u00e7\u0131kt\u0131da <code>active (running)<\/code> ifadesini g\u00f6r\u00fcyorsan\u0131z, sunucunuz ba\u015far\u0131yla kurulmu\u015f ve istemci ba\u011flant\u0131lar\u0131n\u0131 kabul etmeye haz\u0131r hale gelmi\u015f demektir. Olas\u0131 hatalar\u0131 incelemek i\u00e7in <code>\/var\/log\/openvpn.log<\/code> dosyas\u0131n\u0131 takip edebilirsiniz:<\/p>\n<pre><code>tail -f \/var\/log\/openvpn.log<\/code><\/pre>\n<h2>Ad\u0131m 8: \u0130stemci (Client) Sertifikas\u0131 ve Profilinin Olu\u015fturulmas\u0131<\/h2>\n<p>VPN sunucusuna ba\u011flanacak her bir cihaz i\u00e7in benzersiz bir sertifika ve \u00f6zel anahtar \u00e7ifti olu\u015fturulmal\u0131d\u0131r. G\u00fcvenlik nedeniyle, birden fazla cihaz\u0131n ayn\u0131 sertifikay\u0131 payla\u015fmas\u0131 \u00f6nerilmez.<\/p>\n<h3>1. \u0130stemci Anahtarlar\u0131n\u0131n \u00dcretilmesi<\/h3>\n<p>\u0130lk istemcimiz i\u00e7in &#8220;istemci1&#8221; ad\u0131n\u0131 kullanal\u0131m. Tekrar Easy-RSA dizinine gidip gerekli anahtarlar\u0131 \u00fcretiyoruz:<\/p>\n<pre><code>cd \/etc\/openvpn\/easy-rsa\nsource .\/vars\n.\/build-key istemci1<\/code><\/pre>\n<p>Sorulan sorular\u0131 onaylay\u0131n ve sertifikay\u0131 imzalay\u0131p kaydedin. Bu i\u015flem sonucunda <code>\/etc\/openvpn\/easy-rsa\/keys\/<\/code> dizininde <code>istemci1.crt<\/code> ve <code>istemci1.key<\/code> dosyalar\u0131 olu\u015facakt\u0131r.<\/p>\n<h3>2. Birle\u015fik \u0130stemci Yap\u0131land\u0131rma Dosyas\u0131 (.ovpn) Olu\u015fturma<\/h3>\n<p>Modern OpenVPN istemcileri (Windows, macOS, Android, iOS, Linux), t\u00fcm sertifikalar\u0131n ve anahtarlar\u0131n tek bir dosya i\u00e7erisinde g\u00f6m\u00fcl\u00fc oldu\u011fu birle\u015fik <code>.ovpn<\/code> format\u0131n\u0131 destekler. Bu, profillerin cihazlara aktar\u0131lmas\u0131n\u0131 son derece kolayla\u015ft\u0131r\u0131r.<\/p>\n<p>\u0130stemci profillerini h\u0131zl\u0131ca \u00fcretmek i\u00e7in bir \u015fablon dosya olu\u015fturaca\u011f\u0131z. \u00d6ncelikle profil dosyalar\u0131n\u0131 depolayaca\u011f\u0131m\u0131z bir dizin olu\u015ftural\u0131m:<\/p>\n<pre><code>mkdir -p \/etc\/openvpn\/client-configs\/files<\/code><\/pre>\n<p>\u015eimdi bir temel yap\u0131land\u0131rma \u015fablonu (<code>base.conf<\/code>) olu\u015ftural\u0131m:<\/p>\n<pre><code>nano \/etc\/openvpn\/client-configs\/base.conf<\/code><\/pre>\n<p>A\u015fa\u011f\u0131daki i\u00e7eri\u011fi dosyaya yap\u0131\u015ft\u0131r\u0131n. <code>SUNUCU_IP_ADRESI<\/code> k\u0131sm\u0131n\u0131 kendi sunucunuzun genel IP adresiyle de\u011fi\u015ftirmeyi unutmay\u0131n:<\/p>\n<pre><code>client\ndev tun\nproto udp\nremote SUNUCU_IP_ADRESI 1194\nresolv-retry infinite\nnobind\npersist-key\npersist-tun\nremote-cert-tls server\ncipher AES-256-CBC\ncomp-lzo\nkey-direction 1\nverb 3<\/code><\/pre>\n<p>Dosyay\u0131 kaydedip kapat\u0131n.<\/p>\n<h3>3. Profil Olu\u015fturma Beti\u011fi (Script) Yaz\u0131lmas\u0131<\/h3>\n<p>Sertifikalar\u0131 ve temel yap\u0131land\u0131rmay\u0131 otomatik olarak birle\u015ftirip tek bir <code>.ovpn<\/code> dosyas\u0131 \u00fcretecek pratik bir bash beti\u011fi yazal\u0131m. Bu betik, yeni istemciler ekledi\u011fimizde i\u015fimizi b\u00fcy\u00fck \u00f6l\u00e7\u00fcde kolayla\u015ft\u0131racakt\u0131r:<\/p>\n<pre><code>nano \/etc\/openvpn\/client-configs\/make_config.sh<\/code><\/pre>\n<p>A\u015fa\u011f\u0131daki kodlar\u0131 betik dosyas\u0131na yap\u0131\u015ft\u0131r\u0131n:<\/p>\n<pre><code>#!\/bin\/bash\n\n<h2>Parametreler<\/h2>\nKEY_DIR=\/etc\/openvpn\/easy-rsa\/keys\nOUTPUT_DIR=\/etc\/openvpn\/client-configs\/files\nBASE_CONFIG=\/etc\/openvpn\/client-configs\/base.conf\n\ncat ${BASE_CONFIG} \\\n    &lt;(echo -e '&lt;ca&gt;') \\\n    ${KEY_DIR}\/ca.crt \\\n    &lt;(echo -e '&lt;\/ca&gt;\\n&lt;cert&gt;') \\\n    ${KEY_DIR}\/$1.crt \\\n    &lt;(echo -e '&lt;\/cert&gt;\\n&lt;key&gt;') \\\n    ${KEY_DIR}\/$1.key \\\n    &lt;(echo -e '&lt;\/key&gt;\\n&lt;tls-auth&gt;') \\\n    \/etc\/openvpn\/ta.key \\\n    &lt;(echo -e '&lt;\/tls-auth&gt;') \\\n    &gt; ${OUTPUT_DIR}\/$1.ovpn<\/code><\/pre>\n<p>Beti\u011fe \u00e7al\u0131\u015ft\u0131rma yetkisi verelim:<\/p>\n<pre><code>chmod +x \/etc\/openvpn\/client-configs\/make_config.sh<\/code><\/pre>\n<p>\u015eimdi bu beti\u011fi kullanarak &#8220;istemci1&#8221; i\u00e7in tek par\u00e7a <code>.ovpn<\/code> dosyam\u0131z\u0131 saniyeler i\u00e7inde \u00fcretebiliriz:<\/p>\n<pre><code>cd \/etc\/openvpn\/client-configs\n.\/make_config.sh istemci1<\/code><\/pre>\n<p>Bu komut, <code>\/etc\/openvpn\/client-configs\/files\/istemci1.ovpn<\/code> dosyas\u0131n\u0131 olu\u015fturacakt\u0131r. Bu dosyay\u0131 g\u00fcvenli bir y\u00f6ntemle (\u00f6rne\u011fin SFTP veya SCP kullanarak) istemci cihaz\u0131n\u0131za (bilgisayar\u0131n\u0131z veya ak\u0131ll\u0131 telefonunuz) indirmeniz gerekir.<\/p>\n<p><strong>G\u00fcvenlik Uyar\u0131s\u0131:<\/strong> \u0130stemciye ait \u00f6zel anahtar (<code>istemci1.key<\/code>) \u015fifrelenmemi\u015f olarak dosya i\u00e7erisine g\u00f6m\u00fclm\u00fc\u015ft\u00fcr. Bu nedenle \u00fcretilen <code>.ovpn<\/code> dosyas\u0131n\u0131n \u00fc\u00e7\u00fcnc\u00fc \u015fah\u0131slar\u0131n eline ge\u00e7memesi kritik \u00f6nem ta\u015f\u0131r. Dosyay\u0131 e-posta veya g\u00fcvensiz mesajla\u015fma uygulamalar\u0131 \u00fczerinden g\u00f6ndermekten ka\u00e7\u0131n\u0131n.<\/p>\n<h2>Ad\u0131m 9: \u0130stemci Ba\u011flant\u0131s\u0131n\u0131n Kurulmas\u0131 ve Test Edilmesi<\/h2>\n<p>\u00dcretti\u011finiz <code>istemci1.ovpn<\/code> dosyas\u0131n\u0131 bilgisayar\u0131n\u0131za indirdikten sonra ba\u011flant\u0131y\u0131 test edebilirsiniz:<\/p>\n<ul>\n<li><strong>Windows:<\/strong> Resmi OpenVPN Community Client uygulamas\u0131n\u0131 indirin. Olu\u015fturdu\u011funuz <code>.ovpn<\/code> dosyas\u0131n\u0131 <code>C:\\Program Files\\OpenVPN\\config<\/code> dizinine kopyalay\u0131n. Sa\u011f alttaki OpenVPN simgesine sa\u011f t\u0131klay\u0131p &#8220;Ba\u011flan&#8221; se\u00e7ene\u011fini se\u00e7in.<\/li>\n<li><strong>macOS:<\/strong> Tunnelblick veya resmi OpenVPN Connect uygulamas\u0131n\u0131 kullanarak <code>.ovpn<\/code> dosyas\u0131n\u0131 s\u00fcr\u00fckleyip b\u0131rakarak i\u00e7e aktar\u0131n ve ba\u011flant\u0131y\u0131 ba\u015flat\u0131n.<\/li>\n<li><strong>Linux:<\/strong> Terminal \u00fczerinden \u015fu komutla do\u011frudan ba\u011flanabilirsiniz:\n<pre><code>openvpn --config istemci1.ovpn<\/code><\/pre>\n<\/li>\n<li><strong>Android &#038; iOS:<\/strong> Resmi &#8220;OpenVPN Connect&#8221; uygulamas\u0131n\u0131 uygulama ma\u011fazas\u0131ndan indirin. <code>.ovpn<\/code> dosyas\u0131n\u0131 telefonunuza aktar\u0131p uygulama i\u00e7erisinden &#8220;Import Profile&#8221; se\u00e7ene\u011fiyle y\u00fckleyin.<\/li>\n<\/ul>\n<p>Ba\u011flant\u0131 ba\u015far\u0131yla kurulduktan sonra, internete \u00e7\u0131k\u0131\u015f IP adresinizi do\u011frulamak i\u00e7in taray\u0131c\u0131n\u0131zdan herhangi bir IP sorgulama sitesine (\u00f6rne\u011fin <code>ifconfig.me<\/code> veya <code>whatsmyip.org<\/code>) girin. G\u00f6rd\u00fc\u011f\u00fcn\u00fcz IP adresi, OpenVPN sunucunuzun genel IP adresi olmal\u0131d\u0131r. Bu, t\u00fcm trafi\u011finizin sunucu \u00fczerinden g\u00fcvenli bir \u015fekilde t\u00fcnellendi\u011fini g\u00f6sterir.<\/p>\n<h2>Geli\u015fmi\u015f G\u00fcvenlik ve S\u0131k\u0131la\u015ft\u0131rma (Hardening) \u00d6nerileri<\/h2>\n<p>OpenVPN sunucunuzun g\u00fcvenli\u011fini en \u00fcst d\u00fczeye \u00e7\u0131karmak i\u00e7in a\u015fa\u011f\u0131daki ek \u00f6nlemleri alman\u0131z \u00f6nerilir:<\/p>\n<h3>1. Sertifika \u0130ptal Listesi (CRL &#8211; Certificate Revocation List)<\/h3>\n<p>E\u011fer bir istemcinin cihaz\u0131 \u00e7al\u0131n\u0131rsa veya bir kullan\u0131c\u0131n\u0131n eri\u015fimini engellemek isterseniz, o istemcinin sertifikas\u0131n\u0131 iptal etmeniz gerekir. Bunun i\u00e7in Easy-RSA alt\u0131ndaki <code>revoke-full<\/code> beti\u011fi kullan\u0131l\u0131r:<\/p>\n<pre><code>cd \/etc\/openvpn\/easy-rsa\nsource .\/vars\n.\/revoke-full istemci1<\/code><\/pre>\n<p>Bu i\u015flem, <code>keys<\/code> dizini alt\u0131nda <code>crl.pem<\/code> ad\u0131nda bir dosya olu\u015fturur. Bu dosyay\u0131 OpenVPN sunucusuna tan\u0131tmak i\u00e7in <code>\/etc\/openvpn\/server.conf<\/code> dosyas\u0131na \u015fu sat\u0131r\u0131 ekleyin:<\/p>\n<pre><code>crl-verify \/etc\/openvpn\/easy-rsa\/keys\/crl.pem<\/code><\/pre>\n<p>Ard\u0131ndan OpenVPN servisini yeniden ba\u015flat\u0131n. Art\u0131k iptal edilen sertifikaya sahip cihazlar sunucuya ba\u011flanamayacakt\u0131r.<\/p>\n<h3>2. \u015eifreleme Algoritmalar\u0131n\u0131 G\u00fc\u00e7lendirme<\/h3>\n<p>E\u011fer hem sunucu hem de istemci taraf\u0131nda modern OpenVPN s\u00fcr\u00fcmleri kullan\u0131l\u0131yorsa, daha g\u00fcvenli ve donan\u0131msal h\u0131zland\u0131rma deste\u011fi sunan GCM (Galois\/Counter Mode) \u015fifreleme bloklar\u0131n\u0131 tercih edebilirsiniz. Bunun i\u00e7in yap\u0131land\u0131rma dosyan\u0131zdaki <code>cipher AES-256-CBC<\/code> sat\u0131r\u0131n\u0131 \u015fu \u015fekilde g\u00fcncelleyebilirsiniz:<\/p>\n<pre><code>cipher AES-256-GCM<\/code><\/pre>\n<h3>3. DNS S\u0131z\u0131nt\u0131lar\u0131n\u0131 Engelleme<\/h3>\n<p>\u0130stemcilerin DNS sorgular\u0131n\u0131n yerel a\u011flar\u0131ndaki DNS sunucular\u0131na s\u0131zmas\u0131n\u0131 engellemek i\u00e7in istemci yap\u0131land\u0131rma dosyas\u0131na (<code>base.conf<\/code>) \u015fu sat\u0131rlar eklenebilir:<\/p>\n<pre><code>block-outside-dns<\/code><\/pre>\n<p>Bu komut, Windows istemcilerinde VPN d\u0131\u015f\u0131ndaki t\u00fcm a\u011f aray\u00fczlerinin DNS sorgusu yapmas\u0131n\u0131 engeller ve tamamen t\u00fcnel i\u00e7erisindeki g\u00fcvenli DNS sunucular\u0131n\u0131 kullanmaya zorlar.<\/p>\n<h2>Sonu\u00e7<\/h2>\n<p>Bu makalede, Debian 8 (Jessie) i\u015fletim sistemi \u00fczerinde kararl\u0131, g\u00fcvenli ve y\u00fcksek performansl\u0131 bir OpenVPN sunucusunun kurulumunu t\u00fcm teknik detaylar\u0131yla ger\u00e7ekle\u015ftirdik. Kendi Sertifika Otoritemizi (CA) kurarak tamamen ba\u011f\u0131ms\u0131z bir kimlik do\u011frulama altyap\u0131s\u0131 olu\u015fturduk. Ayr\u0131ca, a\u011f y\u00f6nlendirmelerini yap\u0131land\u0131rarak istemcilerin t\u00fcm internet trafi\u011fini sunucu \u00fczerinden \u015fifreli bir \u015fekilde ge\u00e7irmesini sa\u011flad\u0131k.<\/p>\n<p>OpenVPN, esnek yap\u0131s\u0131 sayesinde kurumsal a\u011flardan bireysel gizlilik ihtiya\u00e7lar\u0131na kadar \u00e7ok geni\u015f bir yelpazede g\u00fcvenle kullan\u0131labilir. Kurulum sonras\u0131nda sertifikalar\u0131n\u0131z\u0131 d\u00fczenli olarak y\u00f6netmek, sistem g\u00fcncellemelerini aksatmamak ve sunucu g\u00fcnl\u00fcklerini (logs) periyodik olarak kontrol etmek a\u011f g\u00fcvenli\u011finizin s\u00fcrd\u00fcr\u00fclebilirli\u011fi a\u00e7\u0131s\u0131ndan b\u00fcy\u00fck \u00f6nem ta\u015f\u0131maktad\u0131r.<\/p>\n<div class=\"github-example-link\"><strong>\u00d6rnek kod:<\/strong> <a href=\"https:\/\/github.com\/fatihsoysalcom\/generate-openvpn-server-client-configs\" target=\"_blank\" rel=\"noopener noreferrer\">github.com\/fatihsoysalcom\/generate-openvpn-server-client-configs<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"G\u00fcn\u00fcm\u00fczde veri g\u00fcvenli\u011fi, gizlilik ve uzak a\u011flara g\u00fcvenli eri\u015fim ihtiyac\u0131 her zamankinden daha kritik bir hale gelmi\u015ftir.","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[241],"tags":[],"class_list":{"0":"post-43061","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-linux","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v20.5 (Yoast SEO v25.3.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Debian 8 (Jessie) \u00dczerinde OpenVPN Sunucusu Nas\u0131l Kurulur? - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/debian-8-jessie-uzerinde-openvpn-sunucusu-nasil-kurulur\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Debian 8 (Jessie) \u00dczerinde OpenVPN Sunucusu Nas\u0131l Kurulur?\" \/>\n<meta property=\"og:description\" content=\"G\u00fcn\u00fcm\u00fczde veri g\u00fcvenli\u011fi, gizlilik ve uzak a\u011flara g\u00fcvenli eri\u015fim ihtiyac\u0131 her zamankinden daha kritik bir hale gelmi\u015ftir.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/debian-8-jessie-uzerinde-openvpn-sunucusu-nasil-kurulur\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-04T14:01:57+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-04T14:02:41+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"17 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/debian-8-jessie-uzerinde-openvpn-sunucusu-nasil-kurulur\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/debian-8-jessie-uzerinde-openvpn-sunucusu-nasil-kurulur\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Debian 8 (Jessie) \u00dczerinde OpenVPN Sunucusu Nas\u0131l Kurulur?\",\"datePublished\":\"2026-07-04T14:01:57+00:00\",\"dateModified\":\"2026-07-04T14:02:41+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/debian-8-jessie-uzerinde-openvpn-sunucusu-nasil-kurulur\/\"},\"wordCount\":2771,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Linux\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/debian-8-jessie-uzerinde-openvpn-sunucusu-nasil-kurulur\/#respond\"]}],\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/debian-8-jessie-uzerinde-openvpn-sunucusu-nasil-kurulur\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/debian-8-jessie-uzerinde-openvpn-sunucusu-nasil-kurulur\/\",\"name\":\"Debian 8 (Jessie) \u00dczerinde OpenVPN Sunucusu Nas\u0131l Kurulur? - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2026-07-04T14:01:57+00:00\",\"dateModified\":\"2026-07-04T14:02:41+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/debian-8-jessie-uzerinde-openvpn-sunucusu-nasil-kurulur\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/debian-8-jessie-uzerinde-openvpn-sunucusu-nasil-kurulur\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/debian-8-jessie-uzerinde-openvpn-sunucusu-nasil-kurulur\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Debian 8 (Jessie) \u00dczerinde OpenVPN Sunucusu Nas\u0131l Kurulur?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Debian 8 (Jessie) \u00dczerinde OpenVPN Sunucusu Nas\u0131l Kurulur? - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/debian-8-jessie-uzerinde-openvpn-sunucusu-nasil-kurulur\/","og_locale":"tr_TR","og_type":"article","og_title":"Debian 8 (Jessie) \u00dczerinde OpenVPN Sunucusu Nas\u0131l Kurulur?","og_description":"G\u00fcn\u00fcm\u00fczde veri g\u00fcvenli\u011fi, gizlilik ve uzak a\u011flara g\u00fcvenli eri\u015fim ihtiyac\u0131 her zamankinden daha kritik bir hale gelmi\u015ftir.","og_url":"https:\/\/fatihsoysal.com\/blog\/debian-8-jessie-uzerinde-openvpn-sunucusu-nasil-kurulur\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2026-07-04T14:01:57+00:00","article_modified_time":"2026-07-04T14:02:41+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"17 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/debian-8-jessie-uzerinde-openvpn-sunucusu-nasil-kurulur\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/debian-8-jessie-uzerinde-openvpn-sunucusu-nasil-kurulur\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Debian 8 (Jessie) \u00dczerinde OpenVPN Sunucusu Nas\u0131l Kurulur?","datePublished":"2026-07-04T14:01:57+00:00","dateModified":"2026-07-04T14:02:41+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/debian-8-jessie-uzerinde-openvpn-sunucusu-nasil-kurulur\/"},"wordCount":2771,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Linux"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/debian-8-jessie-uzerinde-openvpn-sunucusu-nasil-kurulur\/#respond"]}],"copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/debian-8-jessie-uzerinde-openvpn-sunucusu-nasil-kurulur\/","url":"https:\/\/fatihsoysal.com\/blog\/debian-8-jessie-uzerinde-openvpn-sunucusu-nasil-kurulur\/","name":"Debian 8 (Jessie) \u00dczerinde OpenVPN Sunucusu Nas\u0131l Kurulur? - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2026-07-04T14:01:57+00:00","dateModified":"2026-07-04T14:02:41+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/debian-8-jessie-uzerinde-openvpn-sunucusu-nasil-kurulur\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/debian-8-jessie-uzerinde-openvpn-sunucusu-nasil-kurulur\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/debian-8-jessie-uzerinde-openvpn-sunucusu-nasil-kurulur\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Debian 8 (Jessie) \u00dczerinde OpenVPN Sunucusu Nas\u0131l Kurulur?"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/43061","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=43061"}],"version-history":[{"count":2,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/43061\/revisions"}],"predecessor-version":[{"id":43063,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/43061\/revisions\/43063"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=43061"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=43061"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=43061"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}