OpenVPN bağlantısı üzerinden yönlendirme yok

OpenVPN'imi (Raspian Pi B'de Raspian 4.9.24-v7 + ile) çalıştıramıyorum. Bağlantı kurabilirim, cihazın IP'sini yerel alt ağa ping atayabilirim (192.168.201.246), ancak bu alt ağda başka hiçbir ping alayamıyorum veya İnternet'te başka bir ana bilgisayara da erişemiyorum, DNS'ye bile. OpenVPN 2.3.4 kullanıyorum.

Benim server.conf benziyor (hassas veriler '%' ile değiştirildi):

port %%%%%
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 120
tls-auth ta.key 0 # This file is secret
key-direction 0
cipher AES-128-CBC   # AES
auth SHA256
comp-lzo
max-clients 10
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append  /var/log/openvpn.log
verb 3

net.ipv4.ip_forward=1 ayarlandı /etc/sysctl.conf

client1-test.ovpn :

client
dev tun
proto udp
remote 84.%%.%%%.%% %%%%%
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
remote-cert-tls server
cipher AES-128-CBC
auth SHA256
key-direction 1
comp-lzo
verb 3
...

Bağlı bir müşteriyle (aşağıdaki günlük dosyaları bir Lubuntu VM olması durumunda) bu rota bilgisini alıyorum :

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.0.2.0        0.0.0.0         255.255.255.0   U     100    0        0 enp0s3
10.8.0.1        10.8.0.5        255.255.255.255 UGH   0      0        0 tun0
10.8.0.5        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
84.%%.%%%.%%    10.0.2.2        255.255.255.255 UGH   0      0        0 enp0s3

ve bu ifconfig :

enp0s3: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.0.2.15  netmask 255.255.255.0  broadcast 10.0.2.255
        inet6 %%%%::%%%%:%%%%:%%%%:%%%%  prefixlen 64  scopeid 0x20<link>
        ether 08:00:27:bc:92:fa  txqueuelen 1000  (Ethernet)
        RX packets 144  bytes 23728 (23.7 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 272  bytes 33595 (33.5 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1  (Local Loopback)
        RX packets 379  bytes 29199 (29.1 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 379  bytes 29199 (29.1 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.8.0.6  netmask 255.255.255.255  destination 10.8.0.5
        inet6 %%%%::%%%%:%%%%:%%%:%%%%  prefixlen 64  scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 3  bytes 144 (144.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Openvpn istemci logfile Bu içeriği gösterilmektedir:

Wed Jun 21 22:32:54 2017 OpenVPN 2.3.11 i686-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jun 22 2016
Wed Jun 21 22:32:54 2017 library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.08
Wed Jun 21 22:32:54 2017 Control Channel Authentication: tls-auth using INLINE static key file
Wed Jun 21 22:32:54 2017 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Wed Jun 21 22:32:54 2017 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Wed Jun 21 22:32:54 2017 Socket Buffers: R=[163840->163840] S=[163840->163840]
Wed Jun 21 22:32:54 2017 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Wed Jun 21 22:32:54 2017 UDPv4 link local: [undef]
Wed Jun 21 22:32:54 2017 UDPv4 link remote: [AF_INET]84.%%.%%%.%%:%%%%%
Wed Jun 21 22:32:55 2017 TLS: Initial packet from [AF_INET]84.%%.%%%.%%:%%%%%, sid=6e1bbb5e 017448e9
Wed Jun 21 22:32:55 2017 VERIFY OK: depth=1, C=%%, ST=%%, L=%%%%, O=%%%%%%%%%%, OU=%%%%%, CN=%%%%%%%%%%%%, name=server
Wed Jun 21 22:32:55 2017 Validating certificate key usage
Wed Jun 21 22:32:55 2017 ++ Certificate has key usage  00a0, expects 00a0
Wed Jun 21 22:32:55 2017 VERIFY KU OK
Wed Jun 21 22:32:55 2017 Validating certificate extended key usage
Wed Jun 21 22:32:55 2017 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Wed Jun 21 22:32:55 2017 VERIFY EKU OK
Wed Jun 21 22:32:55 2017 VERIFY OK: depth=0, C=%%, ST=%%, L=%%%%, O=%%%%%%%%%, OU=%%%%%, CN=server, name=server
Wed Jun 21 22:32:55 2017 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Wed Jun 21 22:32:55 2017 Data Channel Encrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Wed Jun 21 22:32:55 2017 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Wed Jun 21 22:32:55 2017 Data Channel Decrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Wed Jun 21 22:32:55 2017 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Jun 21 22:32:55 2017 [server] Peer Connection Initiated with [AF_INET]84.%%.%%%.%%:%%%%%
Wed Jun 21 22:32:57 2017 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Jun 21 22:32:57 2017 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway autolocal,dhcp-option DNS 8.8.8.8,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Wed Jun 21 22:32:57 2017 OPTIONS IMPORT: timers and/or timeouts modified
Wed Jun 21 22:32:57 2017 OPTIONS IMPORT: --ifconfig/up options modified
Wed Jun 21 22:32:57 2017 OPTIONS IMPORT: route options modified
Wed Jun 21 22:32:57 2017 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Jun 21 22:32:57 2017 ROUTE_GATEWAY 10.0.2.2/255.255.255.0 IFACE=enp0s3 HWADDR=%%:%%:%%:%%:%%:%%
Wed Jun 21 22:32:57 2017 TUN/TAP device tun0 opened
Wed Jun 21 22:32:57 2017 TUN/TAP TX queue length set to 100
Wed Jun 21 22:32:57 2017 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Jun 21 22:32:57 2017 /sbin/ip link set dev tun0 up mtu 1500
Wed Jun 21 22:32:57 2017 /sbin/ip addr add dev tun0 local 10.8.0.6 peer 10.8.0.5
Wed Jun 21 22:32:57 2017 ROUTE remote_host is NOT LOCAL
Wed Jun 21 22:32:57 2017 /sbin/ip route add 84.%%.%%%.%%/32 via 10.0.2.2
Wed Jun 21 22:32:57 2017 /sbin/ip route del 0.0.0.0/0
Wed Jun 21 22:32:57 2017 /sbin/ip route add 0.0.0.0/0 via 10.8.0.5
Wed Jun 21 22:32:57 2017 /sbin/ip route add 10.8.0.1/32 via 10.8.0.5
Wed Jun 21 22:32:57 2017 GID set to nogroup
Wed Jun 21 22:32:57 2017 UID set to nobody
Wed Jun 21 22:32:57 2017 Initialization Sequence Completed

Bir /etc/firewall-openvpn-rules.sh dosyasına (sunucuda) eklediğim aşağıdaki satır :

iptables -v -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.201.246

Benim / etc / network / interfaceslarım şöyle görünür:

source-directory /etc/network/interfaces.d

auto lo
    iface lo inet loopback

iface eth0 inet manual
    pre-up /etc/firewall-openvpn-rules.sh

allow-hotplug wlan0
iface wlan0 inet manual
    wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

allow-hotplug wlan1
iface wlan1 inet manual
    wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

Kimsenin bir fikri var, neden VPN üzerinden yönlendirme düzgün çalışmıyor? Raspian firewall'unda trafiğimin engellenip engellenmediğinden (VPN UDP portu için açılmış) veya rotalamanın yanlış olup olmadığından emin değilim. Sorunu daha fazla nasıl araştırabilirim bilmiyorum. Tüm trafiğin VPN'den geçmesini ve evdeki internet bağlantımı kullanmasını istiyorum.

Ben çoğunlukla bu iki rehberi takip ettim:

• https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-16-04
• https://sys.jonaharagon.com/2016/05/12/setting-up-an-openvpn-server-on-a-raspberry-pi-2-part-12/

Sorunu çözebilirim. İlk sorun, /etc/firewall-openvpn-rules.sh dosyasındaki iptables yapılandırmamın tetiklenmemesiydi, manuel olarak çalıştırmak zorunda kaldım.

Bu makale , iptables ve NAT'ı anlamama yardımcı oldu. Ardından, DNS çalışmasını sağlamak için * .ovpn istemci dosyasında bu satırları etkinleştirmem gerekiyordu:

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

Yönlendirme ve DNS şimdi iyi çalışıyor. Burada bu konu kopyası, sanmıyorum biri @ liam-Dennehy tarafından belirtildiği gibi.