토폴로지 서브넷을 사용하여 openVPN 서버를 설정했습니다. 여기에는 라우팅되는 10.0.XX 지역의 클라이언트에 대한 서브넷 세트가 포함되어 있습니다. 서버 네트워크에는 VPN 사용자가 액세스해야 하는 서비스를 실행하는 클라이언트(VPN이 아님)가 있습니다.
그래서 기본적으로 저는 다양한 사용자 그룹에 웹 서비스에 대한 액세스 권한을 부여하려고 합니다. openvpn과 webservice는 모두 docker 인스턴스에서 실행됩니다.
지금까지 2주 동안 이 문제로 싸우고 있으므로 도움이나 팁을 주시면 매우 감사하겠습니다.
취한 단계: 경로와 클라이언트-클라이언트를 사용하여 openvpn conf를 설정했습니다.
server 192.168.255.0 255.255.255.0
verb 3
key /etc/openvpn/pki/private/xxxx.key
ca /etc/openvpn/pki/ca.crt
cert /etc/openvpn/pki/issued/xxxx.crt
dh /etc/openvpn/pki/dh.pem
tls-auth /etc/openvpn/pki/ta.key
key-direction 0
keepalive 10 60
persist-key
persist-tun
proto udp
# Rely on Docker to do port mapping, internally always 1194
port 1194
dev tun
status /tmp/openvpn-status.log
topology subnet
client-config-dir ccd
user nobody
group nogroup
comp-lzo no
client-to-client
### Route Configurations Below
route 192.168.254.0 255.255.255.0
route 10.0.0.0 255.255.255.0
route 10.0.1.0 255.255.255.0
route 10.0.3.0 255.255.255.0
route 10.0.4.0 255.255.255.0
route 10.0.5.0 255.255.255.0
### Push Configurations Below
#push "block-outside-dns"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "comp-lzo no"
push "route 172.17.0.0 255.255.255.0"
net.ipv4.ip_forward = 1
/etc/sysctl.conf에서 설정하여 전달을 구성했습니다.
iptable 규칙을 구성했습니다.
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A FORWARD -s 192.168.255.0/24 -d 172.17.0.0/24 -i tun0 -j ACCEPT
-A FORWARD -j ACCEPT
-A FORWARD -s 192.168.255.0/24 -d 10.0.0.0/24 -i tun0 -j ACCEPT
하지만 서버 범위(192.168.255.2)의 IP에서는 핑을 할 수 없거나 어떤 것(172.17.0.4 또는 10.0.0.1)에도 액세스할 수 없습니다.
추적 경로는 게이트웨이에서 끝납니다.
% traceroute 10.0.0.1
traceroute to 10.0.0.1 (10.0.0.1), 64 hops max, 52 byte packets
1 192.168.88.1 (192.168.88.1) 12.279 ms 3.251 ms 1.882 ms
2 *
여기 내 고객의 로그도 있습니다
2022-04-30 06:24:38.983758 *Tunnelblick: macOS 12.3.1 (21E258); Tunnelblick 3.8.5beta05 (build 5650)
2022-04-30 06:24:39.446714 *Tunnelblick: Attempting connection with greenhive_master using shadow copy; Set nameserver = 769; monitoring connection
2022-04-30 06:24:39.450786 *Tunnelblick: openvpnstart start greenhive_master.tblk 52399 769 0 1 0 34652464 -ptADGNWradsgnw 2.4.10-openssl-1.1.1j
2022-04-30 06:24:39.477788 *Tunnelblick: openvpnstart starting OpenVPN
2022-04-30 06:24:39.857743 OpenVPN 2.4.10 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Feb 25 2021
2022-04-30 06:24:39.857947 library versions: OpenSSL 1.1.1j 16 Feb 2021, LZO 2.10
2022-04-30 06:24:39.859534 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:52399
2022-04-30 06:24:39.859562 Need hold release from management interface, waiting...
2022-04-30 06:24:40.078894 *Tunnelblick: openvpnstart log:
OpenVPN started successfully.
Command used to start OpenVPN (one argument per displayed line):
/Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.4.10-openssl-1.1.1j/openvpn
--daemon
--log /Library/Application Support/Tunnelblick/Logs/-SUsers-Srobertk-SLibrary-SApplication Support-STunnelblick-SConfigurations-Sgreenhive_master.tblk-SContents-SResources-Sconfig.ovpn.769_0_1_0_34652464.52399.openvpn.log
--cd /Library/Application Support/Tunnelblick/Users/robertk/greenhive_master.tblk/Contents/Resources
--machine-readable-output
--setenv IV_GUI_VER "net.tunnelblick.tunnelblick 5650 3.8.5beta05 (build 5650)"
--verb 3
--config /Library/Application Support/Tunnelblick/Users/robertk/greenhive_master.tblk/Contents/Resources/config.ovpn
--setenv TUNNELBLICK_CONFIG_FOLDER /Library/Application Support/Tunnelblick/Users/robertk/greenhive_master.tblk/Contents/Resources
--verb 3
--cd /Library/Application Support/Tunnelblick/Users/robertk/greenhive_master.tblk/Contents/Resources
--management 127.0.0.1 52399 /Library/Application Support/Tunnelblick/geeielmngfddkiiidnhcaaaogadlpdifnpjaepip.mip
--management-query-passwords
--management-hold
--script-security 2
--route-up /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
--down /Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -9 -d -f -m -w -ptADGNWradsgnw
2022-04-30 06:24:40.108790 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:52399
2022-04-30 06:24:40.136505 MANAGEMENT: CMD 'pid'
2022-04-30 06:24:40.136565 MANAGEMENT: CMD 'auth-retry interact'
2022-04-30 06:24:40.136595 MANAGEMENT: CMD 'state on'
2022-04-30 06:24:40.136615 MANAGEMENT: CMD 'state'
2022-04-30 06:24:40.136655 MANAGEMENT: CMD 'bytecount 1'
2022-04-30 06:24:40.138068 *Tunnelblick: Established communication with OpenVPN
2022-04-30 06:24:40.152091 *Tunnelblick: >INFO:OpenVPN Management Interface Version 1 -- type 'help' for more info
2022-04-30 06:24:40.154175 MANAGEMENT: CMD 'hold release'
2022-04-30 06:24:40.155529 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2022-04-30 06:24:40.161486 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2022-04-30 06:24:40.161545 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2022-04-30 06:24:40.161718 MANAGEMENT: >STATE:1651292680,RESOLVE,,,,,,
2022-04-30 06:24:40.259123 TCP/UDP: Preserving recently used remote address: [AF_INET]xx.xx.xx.xx:1194
2022-04-30 06:24:40.259272 Socket Buffers: R=[786896->786896] S=[9216->9216]
2022-04-30 06:24:40.259296 UDP link local: (not bound)
2022-04-30 06:24:40.259311 UDP link remote: [AF_INET]xx.xx.xx.xx:1194
2022-04-30 06:24:40.259354 MANAGEMENT: >STATE:1651292680,WAIT,,,,,,
2022-04-30 06:24:40.305386 MANAGEMENT: >STATE:1651292680,AUTH,,,,,,
2022-04-30 06:24:40.305631 TLS: Initial packet from [AF_INET]xx.xx.xx.xx:1194, sid=06c4262e 884c5cdc
2022-04-30 06:24:40.369493 VERIFY OK: depth=1, CN=greenhive
2022-04-30 06:24:40.370236 VERIFY KU OK
2022-04-30 06:24:40.370275 Validating certificate extended key usage
2022-04-30 06:24:40.370301 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2022-04-30 06:24:40.370323 VERIFY EKU OK
2022-04-30 06:24:40.370346 VERIFY OK: depth=0, CN=VPN.greenhive.at
2022-04-30 06:24:40.439317 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1541', remote='link-mtu 1542'
2022-04-30 06:24:40.439596 WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
2022-04-30 06:24:40.439767 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
2022-04-30 06:24:40.439834 [VPN.greenhive.at] Peer Connection Initiated with [AF_INET]xx.xx.xx.xx:1194
2022-04-30 06:24:41.558800 MANAGEMENT: >STATE:1651292681,GET_CONFIG,,,,,,
2022-04-30 06:24:41.559492 SENT CONTROL [VPN.greenhive.at]: 'PUSH_REQUEST' (status=1)
2022-04-30 06:24:41.652600 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,comp-lzo no,route 172.17.0.0 255.255.255.0,route-gateway 192.168.255.1,topology subnet,ping 10,ping-restart 60,ifconfig 192.168.255.2 255.255.255.0,peer-id 1,cipher AES-256-GCM'
2022-04-30 06:24:41.652921 OPTIONS IMPORT: timers and/or timeouts modified
2022-04-30 06:24:41.652958 OPTIONS IMPORT: compression parms modified
2022-04-30 06:24:41.652985 OPTIONS IMPORT: --ifconfig/up options modified
2022-04-30 06:24:41.653008 OPTIONS IMPORT: route options modified
2022-04-30 06:24:41.653030 OPTIONS IMPORT: route-related options modified
2022-04-30 06:24:41.653051 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2022-04-30 06:24:41.653072 OPTIONS IMPORT: peer-id set
2022-04-30 06:24:41.653094 OPTIONS IMPORT: adjusting link_mtu to 1624
2022-04-30 06:24:41.653115 OPTIONS IMPORT: data channel crypto options modified
2022-04-30 06:24:41.653139 Data Channel: using negotiated cipher 'AES-256-GCM'
2022-04-30 06:24:41.653816 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2022-04-30 06:24:41.653851 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2022-04-30 06:24:41.654722 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
2022-04-30 06:24:41.654977 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
2022-04-30 06:24:41.655036 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
2022-04-30 06:24:41.655181 Opened utun device utun3
2022-04-30 06:24:41.655203 MANAGEMENT: >STATE:1651292681,ASSIGN_IP,,192.168.255.2,,,,
2022-04-30 06:24:41.655217 /sbin/ifconfig utun3 delete
ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2022-04-30 06:24:41.665109 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2022-04-30 06:24:41.666818 /sbin/ifconfig utun3 192.168.255.2 192.168.255.2 netmask 255.255.255.0 mtu 1500 up
2022-04-30 06:24:41.672645 /sbin/route add -net 192.168.255.0 192.168.255.2 255.255.255.0
add net 192.168.255.0: gateway 192.168.255.2
2022-04-30 06:24:41.679237 MANAGEMENT: >STATE:1651292681,ADD_ROUTES,,,,,,
2022-04-30 06:24:41.679318 /sbin/route add -net 172.17.0.0 192.168.255.1 255.255.255.0
add net 172.17.0.0: gateway 192.168.255.1
06:24:41 *Tunnelblick: **********************************************
06:24:41 *Tunnelblick: Start of output from client.up.tunnelblick.sh
06:24:43 *Tunnelblick: Retrieved from OpenVPN: name server(s) [ 8.8.8.8 8.8.4.4 ], search domain(s) [ ] and SMB server(s) [ ] and using default domain name [ openvpn ]
06:24:44 *Tunnelblick: WARNING: Ignoring DomainName 'openvpn' because DomainName was set manually and '-allowChangesToManuallySetNetworkSettings' was not specified
06:24:44 *Tunnelblick: WARNING: Ignoring ServerAddresses '8.8.8.8 8.8.4.4' because ServerAddresses was set manually and '-allowChangesToManuallySetNetworkSettings' was not specified
06:24:44 *Tunnelblick: Setting search domains to '8.8.8.8 8.8.4.4' because the search domains were not set manually (or are allowed to be changed) and 'Prepend domain name to search domains' was not selected
06:24:45 *Tunnelblick: Saved the DNS and SMB configurations so they can be restored
06:24:45 *Tunnelblick: Did not change DNS ServerAddresses setting of '8.8.8.8 8.8.4.4' (but re-set it)
06:24:45 *Tunnelblick: Changed DNS SearchDomains setting from 'openvpn' to '8.8.8.8 8.8.4.4'
06:24:45 *Tunnelblick: Changed DNS DomainName setting from '' to '8.8.8.8 8.8.4.4'
06:24:45 *Tunnelblick: Did not change SMB NetBIOSName setting of ''
06:24:45 *Tunnelblick: Did not change SMB Workgroup setting of ''
06:24:45 *Tunnelblick: Did not change SMB WINSAddresses setting of ''
06:24:45 *Tunnelblick: DNS servers '8.8.8.8 8.8.4.4' were set manually
06:24:45 *Tunnelblick: DNS servers '8.8.8.8 8.8.4.4' will be used for DNS queries when the VPN is active
06:24:45 *Tunnelblick: The DNS servers include only free public DNS servers known to Tunnelblick.
06:24:45 *Tunnelblick: Flushed the DNS cache via dscacheutil
06:24:45 *Tunnelblick: /usr/sbin/discoveryutil not present. Not flushing the DNS cache via discoveryutil
06:24:45 *Tunnelblick: Notified mDNSResponder that the DNS cache was flushed
06:24:45 *Tunnelblick: Not notifying mDNSResponderHelper that the DNS cache was flushed because it is not running
06:24:45 *Tunnelblick: Setting up to monitor system configuration with process-network-changes
06:24:45 *Tunnelblick: End of output from client.up.tunnelblick.sh
06:24:45 *Tunnelblick: **********************************************
2022-04-30 06:24:45.352811 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2022-04-30 06:24:45.352830 Initialization Sequence Completed
2022-04-30 06:24:45.352845 MANAGEMENT: >STATE:1651292685,CONNECTED,SUCCESS,192.168.255.2,xx.xx.xx.xx,1194,,
2022-04-30 06:24:46.571157 *Tunnelblick: Routing info stdout:
route to: 8.8.4.4
destination: 8.8.4.4
gateway: 192.168.88.1
interface: en0
flags: <UP,GATEWAY,HOST,DONE,WASCLONED,IFSCOPE,IFREF,GLOBAL>
recvpipe sendpipe ssthresh rtt,msec rttvar hopcount mtu expire
0 0 0 0 0 0 1500 0
stderr:
2022-04-30 06:24:46.593014 *Tunnelblick: Warning: DNS server Address 8.8.4.4 is a known public DNS server but is not being routed through the VPN
2022-04-30 06:24:46.680197 *Tunnelblick: Routing info stdout:
route to: 8.8.8.8
destination: 8.8.8.8
gateway: 192.168.88.1
interface: en0
flags: <UP,GATEWAY,HOST,DONE,WASCLONED,IFSCOPE,IFREF,GLOBAL>
recvpipe sendpipe ssthresh rtt,msec rttvar hopcount mtu expire
0 0 0 0 0 0 1500 0
stderr:
2022-04-30 06:24:46.705581 *Tunnelblick: Warning: DNS server Address 8.8.8.8 is a known public DNS server but is not being routed through the VPN
편집: 여기 서버의 IP 경로가 있습니다
bash-5.0# ip route
default via 172.17.0.1 dev eth0
10.0.0.0/24 via 192.168.255.2 dev tun0
10.0.1.0/24 via 192.168.255.2 dev tun0
10.0.3.0/24 via 192.168.255.2 dev tun0
172.17.0.0/16 dev eth0 proto kernel scope link src
172.17.0.2 192.168.254.0/24 via 192.168.255.2 dev tun0 192.168.255.0/24 dev tun0 proto kernel scope link src 192.168.255.1
클라이언트의
172.17/24 192.168.255.2 UGSc utun3
상태 로그
bash-5.0# cat /tmp/openvpn-status.log
OpenVPN CLIENT LIST
Updated,Sun May 1 08:20:48 2022
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
at_dev_1,179.115.236.15:34846,23335,23021,Sun May 1 07:14:26 2022
master,179.115.236.15:64773,9574,9889,Sun May 1 07:55:44 2022
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
192.168.255.2,master,179.115.236.15:64773,Sun May 1 07:55:44 2022
10.0.0.1,at_dev_1,179.115.236.15:34846,Sun May 1 07:14:26 2022
GLOBAL STATS
Max bcast/mcast queue length,1
END
상황을 보여주기 위해 여기에서 이미지를 편집하세요. 그래픽 설명
답변1
따라서 OpenVPN 내부에는 내부 경로가 없다는 것을 알 수 있습니다. 이는 아마도 iroute구성에서 어떤 명령문도 사용하지 않기 때문일 것입니다 . 그렇기 때문에 서버와 클라이언트의 VPN 주소만 서로 액세스할 수 있습니다.
OpenVPN "토폴로지 서브넷" VPN의 일반적인 구조는 네트워킹(OSI L3) 관점에서 다음과 같습니다.
192.168.255.10[tun] (client2) [eth] 10.0.2.1 --- ...
|
[client2].9 [eth] 10.0.1.1 --- ...
(server) [tun]192.168.255.1 --- .2[server] (OpenVPN process) [client1].5 --- 192.168.255.6[tun] (client1)
[eth] 10.0.0.1 --- ... .13[client3]
|
... --- 10.0.3.1 [eth] (client3) [tun]192.168.255.14
3개의 클라이언트가 있는 이 예에서 OpenVPN 프로세스는 4개의 인터페이스(하나는 서버를 향하고 있음)가 있는 라우터처럼 보입니다. 이 라우터에도 라우팅 설정이 필요합니다! 이것이 iroute키워드가 하는 일입니다.
따라서 클라이언트가 10.0.0.0/24서버 뒤의 네트워크에 도달하려면 해당 OpenVPN 클라이언트 연결 "주소"(예: client1 필요 ip route add 10.0.0.0/24 via 192.168.255.5)를 통해 해당 네트워크에 대한 경로가 필요합니다. "푸시 경로"를 사용하여 푸시하는 경로입니다. 다른 클라이언트 뒤에 있는 네트워크에 도달하려면 비슷한 경로를 만듭니다. 내 예의 경우 이러한 네트워크는 연속적이며 모두 단일 push "route 10.0.0.0 255.255.252.0".
또한 OpenVPN "라우터"에는 "클라이언트" 주소를 통해 이러한 네트워크에 대한 적절한 경로가 필요합니다. 예를 들어 10.0.1.0/24 네트워크는 192.168.255.6을 통해 라우팅되어야 합니다. 이렇게 하려면 서버가 를 iroute 10.0.1.0 255.255.255.0대신하여 를 실행해야 합니다 client1. 이를 달성하려면
iroute 10.0.1.0 255.255.255.0
클라이언트 구성 디렉터리(CCD)의 파일 에 저장되므로 client1일반 이름을 가진 클라이언트가 성공적으로 인증된 직후에 실행됩니다 client1.
서버 뒤의 네트워크에는 iroute. 최후의 수단으로 서버 "인터페이스"를 사용하는 것 같습니다.