Mam problem z konfiguracja OpenVPN-a, propozycje z innych tematów nie pomogły wiec tworzę swój temat:
Chce podłączyć komputer z domu z firmą (dyski serwera oraz baza postgres. Udaje mi się ustanowić połączenie VPN, lecz nie mam na kliencie internetu oraz dostępu do zasobów.
pingi:
klient - serwer po IP - brak
klient - serwer po nazwie - OK rozpoznaje jako ip6
serwer - klient po IP - brak
serwer - klient po nazwie - OK rozpoznaje jako ip6
na pierwszy rzut oka.
problemem może być fakt, że po obu stronach tunelu VPN masz tą samą adresację.
rzecz druga, ktora odkrylem na poczatku doswiadczen ovpn - sprzet musi miec ustawiona brame domyslna na adres ggdzie jest koniec tunelu lub chociaz routing statyczny
To moze zacznij od tracert ? aby sprawdzic jak wyglada w ogole droga z sieci B do urzadzenia w sieci A ?
zawsze mozesz ovpn zabrac do domu i u siebie na chwile adresacje zmienic.
rzecz druga, ktora odkrylem na poczatku doswiadczen ovpn - sprzet musi miec ustawiona brame domyslna na adres ggdzie jest koniec tunelu lub chociaz routing statyczny
zmieniles siec B na 192.168.0.1/24 ? chyba 192.168.0.0/24 ?
tak czy inaczej
destination lan net 192.168.0.0 - jezeli dobrze zwrocilem uwage wyzej
subnete 255.255.255.0
gateway 192.168.1.50
interfaces - musisz potestowac, chociaz wydaje mi sie ze lan&wan moze zadzaialc
Tue Dec 16 23:43:26 2014 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec 1 2014
Tue Dec 16 23:43:26 2014 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Tue Dec 16 23:43:26 2014 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Tue Dec 16 23:43:26 2014 UDPv4 link local: [undef]
Tue Dec 16 23:43:26 2014 UDPv4 link remote: [AF_INET]IP_SEWERA:999
Tue Dec 16 23:43:27 2014 [vpn.bfr.com.pl] Peer Connection Initiated with [AF_INET]IP_SEWERA:999
Tue Dec 16 23:43:29 2014 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:3: direct-gateway (2.3.6)
Tue Dec 16 23:43:29 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Dec 16 23:43:29 2014 open_tun, tt->ipv6=0
Tue Dec 16 23:43:29 2014 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{F9A86495-8FAA-4973-9FD8-A1ED70A78164}.tap
Tue Dec 16 23:43:29 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.2.6/255.255.255.0 on interface {F9A86495-8FAA-4973-9FD8-A1ED70A78164} [DHCP-serv: 192.168.2.0, lease-time: 31536000]
Tue Dec 16 23:43:29 2014 Successful ARP Flush on interface [34] {F9A86495-8FAA-4973-9FD8-A1ED70A78164}
Tue Dec 16 23:43:34 2014 Initialization Sequence Completed
log z serwera
Cytat:
Tue Dec 16 23:38:39 2014 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec 1 2014
Tue Dec 16 23:38:39 2014 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Tue Dec 16 23:38:39 2014 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Tue Dec 16 23:38:40 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Dec 16 23:38:40 2014 open_tun, tt->ipv6=0
Tue Dec 16 23:38:40 2014 TAP-WIN32 device [Local Area Connection] opened: \\.\Global\{36436809-60FF-4EAB-A9E4-F8AAB09762A4}.tap
Tue Dec 16 23:38:40 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.2.1/255.255.255.0 on interface {36436809-60FF-4EAB-A9E4-F8AAB09762A4} [DHCP-serv: 192.168.2.0, lease-time: 31536000]
Tue Dec 16 23:38:40 2014 Sleeping for 10 seconds...
Tue Dec 16 23:38:50 2014 Successful ARP Flush on interface [21] {36436809-60FF-4EAB-A9E4-F8AAB09762A4}
Tue Dec 16 23:38:50 2014 UDPv4 link local (bound): [AF_INET]192.168.1.50:999
Tue Dec 16 23:38:50 2014 UDPv4 link remote: [undef]
Tue Dec 16 23:38:50 2014 Initialization Sequence Completed
Tue Dec 16 23:39:16 2014 IP_KLIENTA:59629 [Krystian] Peer Connection Initiated with [AF_INET]IP_KLIENTA:59629
Tue Dec 16 23:39:16 2014 Krystian/IP_KLIENTA:59629 MULTI_sva: pool returned IPv4=192.168.2.5, IPv6=(Not enabled)
Tue Dec 16 23:39:18 2014 Krystian/IP_KLIENTA:59629 send_push_reply(): safe_cap=940
Tue Dec 16 23:41:04 2014 IP_KLIENTA:51271 [Krystian] Peer Connection Initiated with [AF_INET]IP_KLIENTA:51271
Tue Dec 16 23:41:04 2014 MULTI_sva: pool returned IPv4=192.168.2.5, IPv6=(Not enabled)
Tue Dec 16 23:41:07 2014 Krystian/IP_KLIENTA:51271 send_push_reply(): safe_cap=940
Wed Dec 17 09:20:34 2014 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec 1 2014
Wed Dec 17 09:20:34 2014 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Enter Management Password:
Wed Dec 17 09:20:44 2014 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Wed Dec 17 09:20:44 2014 UDPv4 link local: [undef]
Wed Dec 17 09:20:44 2014 UDPv4 link remote: [AF_INET]IP_SERWERA:999
Wed Dec 17 09:20:44 2014 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Dec 17 09:20:44 2014 [vpn.bfr.com.pl] Peer Connection Initiated with [AF_INET]IP_SERWERA:999
Wed Dec 17 09:20:46 2014 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:3: direct-gateway (2.3.6)
Wed Dec 17 09:20:46 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Dec 17 09:20:46 2014 open_tun, tt->ipv6=0
Wed Dec 17 09:20:46 2014 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{F9A86495-8FAA-4973-9FD8-A1ED70A78164}.tap
Wed Dec 17 09:20:46 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.2.6/255.255.255.252 on interface {F9A86495-8FAA-4973-9FD8-A1ED70A78164} [DHCP-serv: 192.168.2.5, lease-time: 31536000]
Wed Dec 17 09:20:46 2014 Successful ARP Flush on interface [34] {F9A86495-8FAA-4973-9FD8-A1ED70A78164}
Wed Dec 17 09:20:52 2014 Initialization Sequence Completed
zaczynam sie zastanawiac czy moze cos certyfikatami jest nie tak, chodziaz nie wiem jak to sie objawia.
Wed Dec 17 09:20:46 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.2.6/255.255.255.252 on interface {F9A86495-8FAA-4973-9FD8-A1ED70A78164} [DHCP-serv: 192.168.2.5, lease-time: 31536000]
koncowka tunelu po stronie serwera ma 192.168.2.5 - spinguj ten adres
jezeli certyfikaty zamierzasz robic przez XCA to w najnowszej wersji jest kilka rozbieznosci z poradnikiem.
jak np. obrazek 20 pokazuje aby zaznaczyc microsoft client - wybierz tls coś tam client a po stronie serwera zamiast microsfot server tls coś tam server
i przy przykladowym pliku konfiguracji dla klienta w lini
Jeden komentarz.
Klient OpenVPN pod winzgroze ma bug/ograniczenie.
Oba konce tunelu musza byc z podsieci /30, czyli przykladowo oba konce tunelu musza miec adresy:
192.168.1.2 i 192.168.1.3
or
192.168.1.5 i 192.168.1.6
or
192.168.1.9 i 192.168.1.10
or
192.168.1.13 i 192.168.1.14
.....
http://pl.wikipedia.org/wiki/Maska_podsieci Podsiec o masce /30 lub 255.255.255.252 jesli wolisz.
Taka podsiec ma 4 adresy, z czego 2 uzyteczne. Pierwszy to adres sieci, ostatni to broadcast.
itd
Z czego 2 uzyteczne adresy sa zawsze te 2 w srodku.
Ale rownie dobrze mozeesz uzyc dla koncow tunelu:
192.168.1.61 i 192.168.1.62
Dodano po 3 [minuty]:
Kolejna uwaga, moze nie wiesz, jesli wiesz to sorry.
Konfiguracje masz z certyfikatem klienta.
Certyfikat klienta MUSI byc wystawiony przez to samo CA co certyfikat serwera.
Jesli Ci to cos pomoze, to moja konfiguracja klienta dzialajaca pod Win.
Ale bez certyfikatu klienta.
ca OpenVPN_CA.pem
cert openvpnsrv_cert.pem
key openvpnsrv_key.pem # This file should be kept secret
dh dh2048.pem
remote-cert-eku "TLS Web Client Authentication"
# Configure server mode and supply a VPN subnet
# for OpenVPN to draw client addresses from.
# The server will take 10.8.0.1 for itself,
# the rest will be made available to clients.
# Each client will be able to reach the server
# on 10.8.0.1. Comment this line out if you are
# ethernet bridging. See the man page for more info.
server 10.8.0.0 255.255.255.248
ifconfig-pool-persist ipp.txt
Sun Dec 21 03:00:34 2014 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec 1 2014
Sun Dec 21 03:00:34 2014 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Enter Management Password:
Sun Dec 21 03:00:34 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25344
Sun Dec 21 03:00:34 2014 Need hold release from management interface, waiting...
Sun Dec 21 03:00:34 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25344
Sun Dec 21 03:00:35 2014 MANAGEMENT: CMD 'state on'
Sun Dec 21 03:00:35 2014 MANAGEMENT: CMD 'log all on'
Sun Dec 21 03:00:35 2014 MANAGEMENT: CMD 'hold off'
Sun Dec 21 03:00:35 2014 MANAGEMENT: CMD 'hold release'
Sun Dec 21 03:00:35 2014 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Sun Dec 21 03:00:35 2014 Diffie-Hellman initialized with 2048 bit key
Sun Dec 21 03:00:35 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sun Dec 21 03:00:35 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Dec 21 03:00:35 2014 MANAGEMENT: >STATE:1419127235,ASSIGN_IP,,10.8.0.1,
Sun Dec 21 03:00:35 2014 open_tun, tt->ipv6=0
Sun Dec 21 03:00:35 2014 TAP-WIN32 device [Local Area Connection] opened: \\.\Global\{36436809-60FF-4EAB-A9E4-F8AAB09762A4}.tap
Sun Dec 21 03:00:35 2014 TAP-Windows Driver Version 9.21
Sun Dec 21 03:00:35 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.1/255.255.255.252 on interface {36436809-60FF-4EAB-A9E4-F8AAB09762A4} [DHCP-serv: 10.8.0.2, lease-time: 31536000]
Sun Dec 21 03:00:35 2014 Sleeping for 10 seconds...
Sun Dec 21 03:00:45 2014 Successful ARP Flush on interface [21] {36436809-60FF-4EAB-A9E4-F8AAB09762A4}
Sun Dec 21 03:00:45 2014 MANAGEMENT: >STATE:1419127245,ADD_ROUTES,,,
Sun Dec 21 03:00:45 2014 C:\Windows\system32\route.exe ADD 10.0.0.1 MASK 255.255.0.0 10.8.0.2
Sun Dec 21 03:00:45 2014 Warning: route gateway is not reachable on any active network adapters: 10.8.0.2
Sun Dec 21 03:00:45 2014 Route addition via IPAPI failed [adaptive]
Sun Dec 21 03:00:45 2014 Route addition fallback to route.exe
Sun Dec 21 03:00:45 2014 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Sun Dec 21 03:00:45 2014 C:\Windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.248 10.8.0.2
Sun Dec 21 03:00:45 2014 Warning: route gateway is not reachable on any active network adapters: 10.8.0.2
Sun Dec 21 03:00:45 2014 Route addition via IPAPI failed [adaptive]
Sun Dec 21 03:00:45 2014 Route addition fallback to route.exe
Sun Dec 21 03:00:45 2014 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Sun Dec 21 03:00:45 2014 UDPv4 link local (bound): [undef]
Sun Dec 21 03:00:45 2014 UDPv4 link remote: [undef]
Sun Dec 21 03:00:45 2014 MULTI: multi_init called, r=256 v=256
Sun Dec 21 03:00:45 2014 IFCONFIG POOL: base=10.8.0.4 size=1, ipv6=0
Sun Dec 21 03:00:45 2014 ifconfig_pool_read(), in='openvpnclient,10.8.0.4', TODO: IPv6
Sun Dec 21 03:00:45 2014 succeeded -> ifconfig_pool_set()
Sun Dec 21 03:00:45 2014 IFCONFIG POOL LIST
Sun Dec 21 03:00:45 2014 openvpnclient,10.8.0.4
Sun Dec 21 03:00:45 2014 Initialization Sequence Completed
Sun Dec 21 03:00:45 2014 MANAGEMENT: >STATE:1419127245,CONNECTED,SUCCESS,10.8.0.1,
config klienta
Cytat:
client
dev tun
proto udp
remote ADRES_SERWERA 999
resolv-retry infinite
nobind
persist-key
persist-tun
ca OpenVPN_CA.pem
cert openvpnclient_cert.pem
key openvpnclient_key.pem
remote-cert-eku "TLS Web Server Authentication"
tls-remote "/CN=openvpnsrv"
cipher AES-128-CBC # AES
comp-lzo
verb 3
log klienta
Cytat:
Sun Dec 21 03:06:32 2014 MANAGEMENT: CMD 'hold release'
Sun Dec 21 03:06:32 2014 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sun Dec 21 03:06:32 2014 MANAGEMENT: >STATE:1419127592,RESOLVE,,,
Sun Dec 21 03:06:32 2014 UDPv4 link local: [undef]
Sun Dec 21 03:06:32 2014 UDPv4 link remote: [AF_INET]ADRES_SERWERA:999
Sun Dec 21 03:06:32 2014 MANAGEMENT: >STATE:1419127592,WAIT,,,
Sun Dec 21 03:06:32 2014 MANAGEMENT: >STATE:1419127592,AUTH,,,
Sun Dec 21 03:06:32 2014 TLS: Initial packet from [AF_INET]ADRES_SERWERA:999, sid=2e3757c3 ce62b26c
Sun Dec 21 03:06:43 2014 VERIFY OK: depth=1, /CN=OPenVPN_CA
Sun Dec 21 03:06:43 2014 Validating certificate extended key usage
Sun Dec 21 03:06:43 2014 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sun Dec 21 03:06:43 2014 VERIFY EKU OK
Sun Dec 21 03:06:43 2014 VERIFY X509NAME OK: /CN=openvpnsrv
Sun Dec 21 03:06:43 2014 VERIFY OK: depth=0, /CN=openvpnsrv
Sun Dec 21 03:06:44 2014 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Dec 21 03:06:44 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Dec 21 03:06:44 2014 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Dec 21 03:06:44 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Dec 21 03:06:44 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sun Dec 21 03:06:44 2014 [openvpnsrv] Peer Connection Initiated with [AF_INET]ADRES_SERWERA:999
Sun Dec 21 03:06:45 2014 MANAGEMENT: >STATE:1419127605,GET_CONFIG,,,
Sun Dec 21 03:06:46 2014 SENT CONTROL [openvpnsrv]: 'PUSH_REQUEST' (status=1)
Sun Dec 21 03:06:50 2014 PUSH: Received control message: 'PUSH_REPLY,route 10.0.0.1 255.255.0.0,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Sun Dec 21 03:06:50 2014 OPTIONS IMPORT: timers and/or timeouts modified
Sun Dec 21 03:06:50 2014 OPTIONS IMPORT: --ifconfig/up options modified
Sun Dec 21 03:06:50 2014 OPTIONS IMPORT: route options modified
Sun Dec 21 03:06:50 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Dec 21 03:06:50 2014 MANAGEMENT: >STATE:1419127610,ASSIGN_IP,,10.8.0.6,
Sun Dec 21 03:06:50 2014 open_tun, tt->ipv6=0
Sun Dec 21 03:06:50 2014 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{F9A86495-8FAA-4973-9FD8-A1ED70A78164}.tap
Sun Dec 21 03:06:50 2014 TAP-Windows Driver Version 9.21
Sun Dec 21 03:06:50 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {F9A86495-8FAA-4973-9FD8-A1ED70A78164} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Sun Dec 21 03:06:50 2014 Successful ARP Flush on interface [34] {F9A86495-8FAA-4973-9FD8-A1ED70A78164}
Sun Dec 21 03:06:55 2014 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Sun Dec 21 03:06:55 2014 MANAGEMENT: >STATE:1419127615,ADD_ROUTES,,,
Sun Dec 21 03:06:55 2014 C:\Windows\system32\route.exe ADD 10.0.0.1 MASK 255.255.0.0 10.8.0.5
Sun Dec 21 03:06:55 2014 Warning: address 10.0.0.1 is not a network address in relation to netmask 255.255.0.0
Sun Dec 21 03:06:55 2014 ROUTE: route addition failed using CreateIpForwardEntry: Parametr jest niepoprawny. [status=87 if_index=34]
Sun Dec 21 03:06:55 2014 Route addition via IPAPI failed [adaptive]
Sun Dec 21 03:06:55 2014 Route addition fallback to route.exe
Sun Dec 21 03:06:55 2014 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Sun Dec 21 03:06:55 2014 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Sun Dec 21 03:06:55 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Sun Dec 21 03:06:55 2014 Route addition via IPAPI succeeded [adaptive]
Sun Dec 21 03:06:55 2014 Initialization Sequence Completed
Sun Dec 21 03:06:55 2014 MANAGEMENT: >STATE:1419127615,CONNECTED,SUCCESS,10.8.0.6,91.227.89.165
SKUTEK:
internet na kliencie działa
ping przechodzi ale tylko po nazwie i odpowiada po ip6
ping konca tunelu oraz serwera brak
✨ Użytkownik ma problem z konfiguracją OpenVPN, gdzie połączenie jest nawiązane, ale brak jest dostępu do internetu oraz zasobów w sieci. Problemy związane są z identyczną adresacją IP po obu stronach tunelu VPN oraz brakiem odpowiedniego routingu. Użytkownicy sugerują zmianę adresacji sieci, ustawienie bramy domyślnej oraz routing statyczny. Po kilku próbach i zmianach w konfiguracji, w tym przejściu z TAP na TUN, użytkownik uzyskuje dostęp do internetu, ale nadal nie może pingować serwera. Wskazówki dotyczące certyfikatów oraz routingów są również omawiane, a użytkownik rozważa użycie pfSense jako routera. Ostatecznie, użytkownik zauważa, że OpenVPN na Windows Server 2008 działa lepiej, mimo ograniczonej przepustowości. Wygenerowane przez model językowy.
?
