Intereting Posts

添加整个300 GB的文件系统到Git Annex库？ Debian上的部落：包还是上游？（nginx）Apache Forbidden错误（随机）：没有错误日志上传DEV的configuration时避免修改REAL的configuration 代理服务器收到来自上游服务器的无效响应不能从远程访问Asterisk sip 如何将警报设置为仅在特定时间内触发了解桥接模式接口的接口TX和RX计数器如何使用公钥SFTP将Windows连接到Unix？ Xen与KVM的性能如何通过VPN客户端网关路由来自OPENVPN访问服务器的stream量？ OS X服务器是否支持多个相互信任的pipe理域？在UNIX中限制文件夹只接受某些types的文件（比如图像）通过ssh在远程服务器上使用本地LS_COLORS，而无需修改远程服务器用WFF和ARR设置iis web farm

如何使用Linux OpenVPN客户端主机作为Windows OpenVPN客户端主机的通道？

我有一个环境，我有一个OpenVPN服务器（Linux）和一些OpenVPN客户端（包括Windows和Linux）。所有这些主机（服务器和客户端）都连接到互联网，它们在局域网中没有互相连接。

这个想法是让Windows客户端使用Linux客户端作为网关（而不是OpenVPN服务器）。我想通过推“路由网关10.8.0.200”和“redirect网关def1”到Windows客户端实现这一点。一旦在Linux网关（10.8.0.200）上启用了SNAT（或MASQUERADE），并且将sysctl ip转发标志设置为true，它应该能够充当网关，对吧？

但我没有做到这一点。我会简短地解释我的设置，并显示出错的地方。

10.8.0.1：OpenVPN服务器（Linux）
10.8.0.200 ：网关，OpenVPN客户端（Linux）
10.8.0.2：OpenVPN客户端（Windows）
networking掩码：255.255.255.0

networking布局：

############ +---------------------------+ INTERNET +--------------------------+ | #####+###### | | | +-------+-------+ | | | 9.10.11.12 | | | ++---------------++ | | | DSL Modem Router| | | +--------+--------+ | | | +---+---+ +---+---+ +---+---+ | eth0 | | eth0 | | LAN | +---+-------+---+ +---+-------+---+ +---+-------+---+ | 5.6.7.8 | | 1.2.3.4 | | 10.0.2.15 | +--+---------------+--+ +--+---------------+--+ +--+---------------+--+ | Linux | | Linux | | Windows | | OpenVPN | | OpenVPN | | OpenVPN | | Client | | Server | | Client | +--+---------------+--+ +--+---------------+--+ +--+---------------+--+ | 10.8.0.200 | | 10.8.0.1 | | 10.8.0.2 | +---+-------+---+ +---+-------+---+ +---+-------+---+ | tun1 | | tun0 | |tun/tap| +---+---+ +---+---+ +---+---+ | | | +--------------------------------+--------------------------------+

networkingconfiguration：

10.8.0.1路由：

 [email protected]:/# route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default 1.2.3.1 0.0.0.0 UG 0 0 0 eth0 10.8.0.0 * 255.255.255.0 U 0 0 0 tun0 1.2.3.0 * 255.255.254.0 U 0 0 0 eth0

10.8.0.200路线：

 [email protected]:/# route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default 5.6.7.1 0.0.0.0 UG 0 0 0 eth0 10.8.0.0 * 255.255.255.0 U 0 0 0 tun1 5.6.7.0 * 255.255.254.0 U 0 0 0 eth0

10.8.0.2路由：

 IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 10.0.2.2 10.0.2.15 266 0.0.0.0 128.0.0.0 10.8.0.200 10.8.0.2 20 10.0.2.0 255.255.255.0 On-link 10.0.2.15 266 10.0.2.15 255.255.255.255 On-link 10.0.2.15 266 10.0.2.255 255.255.255.255 On-link 10.0.2.15 266 10.8.0.0 255.255.255.0 On-link 10.8.0.2 276 10.8.0.2 255.255.255.255 On-link 10.8.0.2 276 10.8.0.255 255.255.255.255 On-link 10.8.0.2 276 107.191.51.248 255.255.255.255 10.0.2.2 10.0.2.15 10 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 128.0.0.0 128.0.0.0 10.8.0.200 10.8.0.2 20 224.0.0.0 240.0.0.0 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 10.0.2.15 266 224.0.0.0 240.0.0.0 On-link 10.8.0.2 276 255.255.255.255 255.255.255.255 On-link 127.0.0.1 306 255.255.255.255 255.255.255.255 On-link 10.0.2.15 266 255.255.255.255 255.255.255.255 On-link 10.8.0.2 276 ===========================================================================

OpenVPNconfiguration：

10.8.0.1（OpenVPN服务器）configuration：

/etc/openvpn/server.conf：

 mode server tls-server topology subnet push "topology subnet" dev tun0 local 1.2.3.4 port 1194 proto udp client-to-client max-clients 200 ca ca.crt cert server.crt key server.key dh dh2048.pem tls-auth ta.key 0 ifconfig 10.8.0.1 255.255.255.0 ifconfig-pool 10.8.0.2 10.8.0.199 255.255.255.0 client-config-dir /etc/openvpn/clients keepalive 10 60 comp-lzo yes push "comp-lzo yes" user nobody group nogroup persist-key persist-tun status status.log verb 3 mute 20

在/ etc / OpenVPN的/客户/ linclient：

 ifconfig-push 10.8.0.200 255.255.255.0

在/ etc / OpenVPN的/客户/ winclient：

 push "route-gateway 10.8.0.200" push "redirect-gateway def1"

10.8.0.200（OpenVPN客户端）configuration：

/etc/openvpn/linclient.conf：

 remote 1.2.3.4 1194 client dev tun1 ca ca.crt cert linclient.crt key linclient.key tls-auth ta.key 1 remote-cert-tls server comp-lzo user nobody group nogroup persist-key persist-tun status status.log verb 3 mute 20

10.8.0.2（OpenVPN客户端）configuration：

C：\ Program Files \ OpenVPN \ config \ winclient \ winclient.ovpn：

 remote 1.2.3.4 1194 client dev tun ca ca.crt cert winclient.crt key winclient.key tls-auth ta.key 1 remote-cert-tls server comp-lzo user nobody group nogroup persist-key persist-tun status status.log verb 3 mute 20

当我从Windows客户端Ping到OpenVPN服务器（10.8.0.1）时：

在Windows中：

C：\ Windows \ system32> ping 10.8.0.1

 Pinging 10.8.0.1 with 32 bytes of data: Reply from 10.8.0.1: bytes=32 time=119ms TTL=64 Reply from 10.8.0.1: bytes=32 time=120ms TTL=64 Reply from 10.8.0.1: bytes=32 time=120ms TTL=64 Reply from 10.8.0.1: bytes=32 time=119ms TTL=64 Ping statistics for 10.8.0.1: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 119ms, Maximum = 120ms, Average = 119ms

在OpenVPN服务器（10.8.0.1）上：

 [email protected]:/# tcpdump -i tun0 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes 16:46:12.316295 IP 10.8.0.2 > 10.8.0.1: ICMP echo request, id 1, seq 3930, length 40 16:46:12.316316 IP 10.8.0.1 > 10.8.0.2: ICMP echo reply, id 1, seq 3930, length 40 16:46:13.333982 IP 10.8.0.2 > 10.8.0.1: ICMP echo request, id 1, seq 3931, length 40 16:46:13.333994 IP 10.8.0.1 > 10.8.0.2: ICMP echo reply, id 1, seq 3931, length 40 16:46:14.344666 IP 10.8.0.2 > 10.8.0.1: ICMP echo request, id 1, seq 3932, length 40 16:46:14.344678 IP 10.8.0.1 > 10.8.0.2: ICMP echo reply, id 1, seq 3932, length 40 16:46:15.356811 IP 10.8.0.2 > 10.8.0.1: ICMP echo request, id 1, seq 3933, length 40 16:46:15.356824 IP 10.8.0.1 > 10.8.0.2: ICMP echo reply, id 1, seq 3933, length 40

当我从Windows客户端Ping到OpenVPN客户端时，“网关”（10.8.0.200）：

在Windows中：

C：\ Windows \ system32> ping 10.8.0.200

 Pinging 10.8.0.200 with 32 bytes of data: Reply from 10.8.0.200: bytes=32 time=226ms TTL=64 Reply from 10.8.0.200: bytes=32 time=226ms TTL=64 Reply from 10.8.0.200: bytes=32 time=225ms TTL=64 Reply from 10.8.0.200: bytes=32 time=225ms TTL=64 Ping statistics for 10.8.0.200: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 225ms, Maximum = 226ms, Average = 225ms

在OpenVPN客户端，“网关”（10.8.0.200）：

 [email protected]:~# tcpdump -i tun1 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on tun1, link-type RAW (Raw IP), capture size 65535 bytes 18:48:13.694836 IP 10.8.0.2 > 10.8.0.200: ICMP echo request, id 1, seq 3934, length 40 18:48:13.694862 IP 10.8.0.200 > 10.8.0.2: ICMP echo reply, id 1, seq 3934, length 40 18:48:14.706081 IP 10.8.0.2 > 10.8.0.200: ICMP echo request, id 1, seq 3935, length 40 18:48:14.706093 IP 10.8.0.200 > 10.8.0.2: ICMP echo reply, id 1, seq 3935, length 40 18:48:15.722542 IP 10.8.0.2 > 10.8.0.200: ICMP echo request, id 1, seq 3936, length 40 18:48:15.722555 IP 10.8.0.200 > 10.8.0.2: ICMP echo reply, id 1, seq 3936, length 40 18:48:16.732037 IP 10.8.0.2 > 10.8.0.200: ICMP echo request, id 1, seq 3937, length 40 18:48:16.732049 IP 10.8.0.200 > 10.8.0.2: ICMP echo reply, id 1, seq 3937, length 40

当我从Windows客户端ping到Internet时（8.8.8.8）：

在Windows中：

 C:\Windows\system32>ping 8.8.8.8 Pinging 8.8.8.8 with 32 bytes of data: Request timed out. Request timed out. Request timed out. Ping statistics for 8.8.8.8: Packets: Sent = 3, Received = 0, Lost = 3 (100% loss), Control-C ^C

在OpenVPN服务器（10.8.0.1）上：

 [email protected]:/# tcpdump -i tun0 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes 16:49:55.077094 IP 10.8.0.2 > google-public-dns-a.google.com: ICMP echo request, id 1, seq 3938, length 40 16:49:59.844689 IP 10.8.0.2 > google-public-dns-a.google.com: ICMP echo request, id 1, seq 3939, length 40 16:50:04.896020 IP 10.8.0.2 > google-public-dns-a.google.com: ICMP echo request, id 1, seq 3940, length 40 16:50:09.938695 IP 10.8.0.2 > google-public-dns-a.google.com: ICMP echo request, id 1, seq 3941, length 40

在OpenVPN客户端，“网关”（10.8.0.200）：

 [email protected]:~# tcpdump -i tun1 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on tun1, link-type RAW (Raw IP), capture size 65535 bytes ^C 0 packets captured 0 packets received by filter 0 packets dropped by kernel

更多的设置在10.8.0.200：

IP前锋：

 [email protected]:~# cat /proc/sys/net/ipv4/ip_forward 1

*过滤iptables：

 [email protected]:~# iptables -L -n -v Chain INPUT (policy ACCEPT 1752 packets, 142K bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 1496 packets, 184K bytes) pkts bytes target prot opt in out source destination

* nat iptables：

 [email protected]:~# iptables -t nat -L -n -v Chain PREROUTING (policy ACCEPT 7 packets, 1603 bytes) pkts bytes target prot opt in out source destination Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 MASQUERADE all -- * eth0 0.0.0.0/0 0.0.0.0/0

最后，在windows上使用tracert：

 C:\Windows\system32>tracert 10.8.0.1 Tracing route to 10.8.0.1 over a maximum of 30 hops 1 119 ms 119 ms 120 ms 10.8.0.1 Trace complete. C:\Windows\system32>tracert 10.8.0.200 Tracing route to 10.8.0.200 over a maximum of 30 hops 1 226 ms 226 ms 225 ms 10.8.0.200 Trace complete. C:\Windows\system32>tracert 8.8.8.8 Tracing route to 8.8.8.8 over a maximum of 30 hops 1 119 ms 119 ms 119 ms 10.8.0.1 2 * * * Request timed out. 3 * * * Request timed out. 4 ^C

我的问题：

我如何使用Linux OpenVPN客户端主机作为我的Windows OpenVPN客户端主机的网关？

我不认为你可以用tun接口轻松做到这一点。

使用另一台计算机作为您的网关工作，通过发送它在IP下面的地址给它的帧，这些帧包含IP数据包寻址到其他目的地。路由器（“网关”）将知道它必须将IP数据包转发到真正的目的地。

使用tun，IP下面没有图层。没有办法select基于tun的子网的特定成员来接收未发送给它的IP数据包。我认为你的OpenVPN服务器根本不会将发往8.8.8.8的IP数据包转发给Linux客户端，那么为什么呢？它不知道客户是特别的。

有可能创造性地使用OpenVPN的“iroute”指令来做你想做的事情，但是我认为你可以用下面的解决scheme之一来更好地实现：

从tun切换到任何地方。
使用单独的OpenVPN会话（即隧道中的隧道）build立一个从10.8.0.2到10.8.0.200的子隧道，并设置默认路由指向它。