Windows 7(클라이언트)에서 Ubuntu 서버의 네트워크에 ping을 시도하고 있습니다. Ubuntu와 Windows는 모두 옵션이 있는 다른 OpenVPN 서버의 클라이언트입니다 client-to-client. 클라이언트는 서버에 연결할 수 있지만(10.0.0.50의 IP 주소를 얻음) 서버 네트워크의 어떤 주소에도 ping을 보낼 수 없습니다. 이 서버 옵션을 시도했지만 push "route 10.0.0.0 255.255.255.0 10.2.0.21"작동하지 않았습니다. 내가 여기서 무엇을 놓치고 있는 걸까요? 감사합니다.
Windows 7, 클라이언트, 구성
# client config
remote 10.2.0.21 1723
client
proto udp
dev tap
dev-node OpenVPN_Route1
reneg-sec 28800
resolv-retry infinite
# security
remote-cert-tls server
tls-auth "PC71_hamsing_server\\ta.key" 1
ca "PC71_hamsing_server\\ca.crt"
cert "PC71_hamsing_server\\PC71_hamsing_server.crt"
key "PC71_hamsing_server\\PC71_hamsing_server.key"
# connection
nobind
persist-key
persist-tun
# logging
status "C:\\Program Files\\OpenVPN\\log\\Hamsing_Server.log"
log "C:\\Program Files\\OpenVPN\\log\\Hamsing_Server.log"
verb 3
mute 20
우분투 18.04, 서버, 구성
# server config (10.0.0.2 is the IP address of br0)
server-bridge 10.0.0.2 255.255.255.0 10.0.0.50 10.0.0.99
;push "route 10.0.0.0 255.255.255.0 10.2.0.21" # LAN, LAN subnet, OpenVPN IP, metric
port 1723
proto udp
dev tap
reneg-sec 28800
keepalive 10 120
# security
remote-cert-tls client
ca server/ca.crt
tls-auth server/ta.key 0 # 0 on server, 1 on clients, generate with "openvpn --genkey --secret ta.key"
cert server/hamsing_server.crt
key server/hamsing_server.key
dh server/dh2048.pem
# connection
persist-key
persist-tun
# logging
status /var/www/html/logs/vpn/server-status.log
log /var/www/html/logs/vpn/server.log
verb 3
management 127.0.0.1 7656
mute 20
클라이언트가 서버 로그에 연결
Tue Jul 23 17:02:21 2019 TLS: Initial packet from [AF_INET]10.2.0.21:1723, sid=9bc321ea 96ec878d
Tue Jul 23 17:02:21 2019 VERIFY OK: depth=1, C=US, ST=IL, L=Aurora, O=EleMech, OU=Portalogic-Field, CN=EleMech CA, name=EasyRSA, [email protected]
Tue Jul 23 17:02:21 2019 VERIFY KU OK
Tue Jul 23 17:02:21 2019 Validating certificate extended key usage
Tue Jul 23 17:02:21 2019 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Jul 23 17:02:21 2019 VERIFY EKU OK
Tue Jul 23 17:02:21 2019 VERIFY OK: depth=0, C=US, ST=IL, L=Aurora, O=EleMech, OU=Portalogic-Field, CN=hamsing_server, name=EasyRSA, [email protected]
Tue Jul 23 17:02:21 2019 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue Jul 23 17:02:21 2019 [hamsing_server] Peer Connection Initiated with [AF_INET]10.2.0.21:1723
Tue Jul 23 17:02:22 2019 MANAGEMENT: >STATE:1563919342,GET_CONFIG,,,,,,
Tue Jul 23 17:02:22 2019 SENT CONTROL [hamsing_server]: 'PUSH_REQUEST' (status=1)
Tue Jul 23 17:02:22 2019 PUSH: Received control message: 'PUSH_REPLY,route-gateway 10.0.0.2,ping 10,ping-restart 120,ifconfig 10.0.0.50 255.255.255.0,peer-id 0,cipher AES-256-GCM'
Tue Jul 23 17:02:22 2019 OPTIONS IMPORT: timers and/or timeouts modified
Tue Jul 23 17:02:22 2019 OPTIONS IMPORT: --ifconfig/up options modified
Tue Jul 23 17:02:22 2019 OPTIONS IMPORT: route-related options modified
Tue Jul 23 17:02:22 2019 OPTIONS IMPORT: peer-id set
Tue Jul 23 17:02:22 2019 OPTIONS IMPORT: adjusting link_mtu to 1656
Tue Jul 23 17:02:22 2019 OPTIONS IMPORT: data channel crypto options modified
Tue Jul 23 17:02:22 2019 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Jul 23 17:02:22 2019 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Jul 23 17:02:22 2019 Preserving previous TUN/TAP instance: OpenVPN_Route1
Tue Jul 23 17:02:22 2019 Initialization Sequence Completed
Tue Jul 23 17:02:22 2019 MANAGEMENT: >STATE:1563919342,CONNECTED,SUCCESS,10.0.0.50,10.2.0.21,1723,,
클라이언트의 서버 로그
Tue Jul 23 14:56:10 2019 WARNING: file 'server/hamsing_server.key' is group or others accessible
Tue Jul 23 14:56:10 2019 WARNING: file 'server/ta.key' is group or others accessible
Tue Jul 23 14:56:10 2019 OpenVPN 2.4.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 14 2019
Tue Jul 23 14:56:10 2019 library versions: OpenSSL 1.1.1 11 Sep 2018, LZO 2.08
Tue Jul 23 14:56:10 2019 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:7656
Tue Jul 23 14:56:10 2019 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Tue Jul 23 14:56:10 2019 Diffie-Hellman initialized with 2048 bit key
Tue Jul 23 14:56:10 2019 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 23 14:56:10 2019 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 23 14:56:10 2019 TUN/TAP device tap0 opened
Tue Jul 23 14:56:10 2019 TUN/TAP TX queue length set to 100
Tue Jul 23 14:56:10 2019 Could not determine IPv4/IPv6 protocol. Using AF_INET
Tue Jul 23 14:56:10 2019 Socket Buffers: R=[212992->212992] S=[212992->212992]
Tue Jul 23 14:56:10 2019 UDPv4 link local (bound): [AF_INET][undef]:1723
Tue Jul 23 14:56:10 2019 UDPv4 link remote: [AF_UNSPEC]
Tue Jul 23 14:56:10 2019 MULTI: multi_init called, r=256 v=256
Tue Jul 23 14:56:10 2019 IFCONFIG POOL: base=10.0.0.50 size=50, ipv6=0
Tue Jul 23 14:56:10 2019 Initialization Sequence Completed
Tue Jul 23 14:56:21 2019 10.2.0.15:61917 TLS: Initial packet from [AF_INET]10.2.0.15:61917, sid=35913f44 fa1e7a5f
Tue Jul 23 14:56:22 2019 10.2.0.15:61917 VERIFY OK: depth=1, C=US, ST=IL, L=Aurora, O=EleMech, OU=Portalogic-Field, CN=EleMech CA, name=EasyRSA, [email protected]
Tue Jul 23 14:56:22 2019 10.2.0.15:61917 VERIFY KU OK
Tue Jul 23 14:56:22 2019 10.2.0.15:61917 Validating certificate extended key usage
Tue Jul 23 14:56:22 2019 10.2.0.15:61917 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
Tue Jul 23 14:56:22 2019 10.2.0.15:61917 VERIFY EKU OK
Tue Jul 23 14:56:22 2019 10.2.0.15:61917 VERIFY OK: depth=0, C=US, ST=IL, L=Aurora, O=EleMech, OU=Portalogic-Field, CN=PC71_hamsing_server, name=EasyRSA, [email protected]
Tue Jul 23 14:56:22 2019 10.2.0.15:61917 peer info: IV_VER=2.4.1
Tue Jul 23 14:56:22 2019 10.2.0.15:61917 peer info: IV_PLAT=win
Tue Jul 23 14:56:22 2019 10.2.0.15:61917 peer info: IV_PROTO=2
Tue Jul 23 14:56:22 2019 10.2.0.15:61917 peer info: IV_NCP=2
Tue Jul 23 14:56:22 2019 10.2.0.15:61917 peer info: IV_LZ4=1
Tue Jul 23 14:56:22 2019 10.2.0.15:61917 peer info: IV_LZ4v2=1
Tue Jul 23 14:56:22 2019 10.2.0.15:61917 peer info: IV_LZO=1
Tue Jul 23 14:56:22 2019 10.2.0.15:61917 peer info: IV_COMP_STUB=1
Tue Jul 23 14:56:22 2019 10.2.0.15:61917 peer info: IV_COMP_STUBv2=1
Tue Jul 23 14:56:22 2019 10.2.0.15:61917 peer info: IV_TCPNL=1
Tue Jul 23 14:56:22 2019 10.2.0.15:61917 peer info: IV_GUI_VER=OpenVPN_GUI_11
Tue Jul 23 14:56:22 2019 10.2.0.15:61917 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue Jul 23 14:56:22 2019 10.2.0.15:61917 [PC71_hamsing_server] Peer Connection Initiated with [AF_INET]10.2.0.15:61917
Tue Jul 23 14:56:22 2019 PC71_hamsing_server/10.2.0.15:61917 MULTI_sva: pool returned IPv4=10.0.0.50, IPv6=(Not enabled)
Tue Jul 23 14:56:23 2019 PC71_hamsing_server/10.2.0.15:61917 PUSH: Received control message: 'PUSH_REQUEST'
Tue Jul 23 14:56:23 2019 PC71_hamsing_server/10.2.0.15:61917 SENT CONTROL [PC71_hamsing_server]: 'PUSH_REPLY,route-gateway 10.0.0.2,ping 10,ping-restart 120,ifconfig 10.0.0.50 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Tue Jul 23 14:56:23 2019 PC71_hamsing_server/10.2.0.15:61917 Data Channel: using negotiated cipher 'AES-256-GCM'
Tue Jul 23 14:56:23 2019 PC71_hamsing_server/10.2.0.15:61917 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Jul 23 14:56:23 2019 PC71_hamsing_server/10.2.0.15:61917 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Jul 23 14:56:23 2019 PC71_hamsing_server/10.2.0.15:61917 MULTI: Learn: 00:ff:11:98:b7:4f -> PC71_hamsing_server/10.2.0.15:61917
우분투 서버 네트워크
root@pal7687-1:/etc/openvpn# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master br0 state UP group default qlen 1000
link/ether 00:e0:67:13:94:cc brd ff:ff:ff:ff:ff:ff
3: enp4s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master br0 state UP group default qlen 1000
link/ether 00:e0:67:13:94:cd brd ff:ff:ff:ff:ff:ff
4: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 00:e0:67:13:94:cc brd ff:ff:ff:ff:ff:ff
inet 10.0.0.2/24 brd 10.0.0.255 scope global noprefixroute br0
valid_lft forever preferred_lft forever
inet6 fe80::2e0:67ff:fe13:94cc/64 scope link
valid_lft forever preferred_lft forever
17: tap0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 100
link/ether f6:13:27:e8:94:89 brd ff:ff:ff:ff:ff:ff
18: tun2: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100
link/none
inet 10.2.0.21/16 brd 10.2.255.255 scope global tun2
valid_lft forever preferred_lft forever
inet6 fe80::4fb5:d60d:e798:58a6/64 scope link stable-privacy
valid_lft forever preferred_lft forever
답변1
내 OpenVPN 서버에서 내 푸시 라인에는 네트워크와 마스크만 있습니다. 마지막에 10.2.0.21을 제거해 보세요.
push "route 10.0.0.0 255.255.255.0"
추신: 푸시 라인이 주석 처리되어 있는 것을 확인했습니다. 아마도 당신은 뭔가를 시도하고 있었고 이것을 전환하고 있었을 것입니다. 이 주석을 해제했는지 확인하세요.
답변2
OpenVPN 서비스가 시작된 후 Linux에서 다음 명령을 실행하기만 하면 됩니다.
brctl addif br0 tap0
ifconfig tap0 0.0.0.0 promisc up
OpenVPN 가이드에서 사용된 내용을 볼 수 있습니다.이더넷 브리징, Windows 클라이언트, Linux 서버
또한 Windows TAP 어댑터가 DHCP에 있는지 확인하세요. 저는 어떤 이유로 빈 고정 주소로 이동하는 것을 좋아합니다.