Intereting Posts

MySQL查询（通过SSL）在IIS 7中使用默认AppPool身份失败 Squid在CentOS 7上耗尽文件描述符 CDN（内容分发networking）什么时候值得呢？ MAK – 通过WDS激活 – 错误代码：0xc004f038 Solaris 10 ZFS ARC Maxed Out和CPU已超载 Xen Dom0无法find启动设备（或任何磁盘） Apache：以每个虚拟主机的方式configurationprefork 为什么Tomcat不停止？如何在Debian 7上激活iptables？在nginx后面设置mongodb 在Windows 10 Pro上禁用Microsoft消费者体验在debian中创build两个单独的http处理位置我的网站不显示某些图像在centOS 6.7上安装带有Apache 2.4.16的PHP 5.6.11安装Ioncube 带有两个DNS名称的计算机。 “目前没有login服务器来提供login请求”

opvnvpn：在LAN-behinds中寻址节点

我已经build立了一个openvpn服务器，我可以远程访问，一旦连接，它将在服务器和客户端上使用虚拟ip 10.15.119.x创build一个tun0设备。 openvpn服务器本身是10.15.119.1。

问：我如何解决openvpn服务器后面的局域网中的其他节点？我可以访问openvpn服务器本身的地址为10.15.119.1:(port）的服务，但我不知道如何解决其他不参与openvpn连接的openvpn服务器所在的LAN： 希望这样的节点可以从10.15.119.x范围内的一些其他虚拟ip客户端节点寻址，如果是这样的话，我只需要一种方法来知道这些ip是什么

我可以创build一些iptables和路由命令转发端口到其他特定的节点，但我相信必须有一个更好的方法来做到这一点，直接寻址节点

为server.conf：

dev tun server 10.15.119.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "route 192.168.0.0 255.255.255.0" up ./office.up tls-server dh /home/lurscher/keys/dh1024.pem ca /home/lurscher/keys/ca.crt cert /home/lurscher/keys/vpnCh8TestServer.crt key /home/lurscher/keys/vpnCh8TestServer.key status openvpn-status.log log openvpn.log comp-lzo verb 3

office.up脚本有：

 #!/bin/sh #route 10.15.119.0 255.255.255.0 route add -net 10.15.119.0 netmask 255.255.255.0 gw $5 #fixed the wrong 10.15.0.0 address

client.conf改为：

 dev tun remote my.server.com tls-client pull ca /home/chuckq/keys/ca.crt cert /home/chuckq/keys/vpnCh8TestClient.crt key /home/chuckq/keys/vpnCh8TestClient.key ns-cert-type server ; port 1194 ; user nobody ; group nogroup status openvpn-status.log log openvpn.log comp-lzo verb 3

来自服务器的新相关日志：

 Thu May 26 16:59:59 2011 vpnCh8TestClient/YYYY:1194 PUSH: Received control message: 'PUSH_REQUEST' Thu May 26 16:59:59 2011 vpnCh8TestClient/YYYY:1194 SENT CONTROL [vpnCh8TestClient]: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,route 10.15.119.1,topology net30,ifconfig 10.15.119.6 10.15.119.5' (status=1) Thu May 26 17:02:17 2011 vpnCh8TestClient/YYYY:1194 Replay-window backtrack occurred [1]

来自客户的相关日志：

 Thu May 26 16:53:30 2011 [vpnCh8TestServer] Peer Connection Initiated with [AF_INET]XXXX:1194 Thu May 26 16:53:32 2011 SENT CONTROL [vpnCh8TestServer]: 'PUSH_REQUEST' (status=1) Thu May 26 16:53:32 2011 PUSH: Received control message: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0,route 10.15.119.1,topology net30,ifconfig 10.15.119.6 10.15.119.5' Thu May 26 16:53:32 2011 OPTIONS IMPORT: --ifconfig/up options modified Thu May 26 16:53:32 2011 OPTIONS IMPORT: route options modified Thu May 26 16:53:32 2011 ROUTE default_gateway=10.21.2.254 Thu May 26 16:53:32 2011 TUN/TAP device tun0 opened Thu May 26 16:53:32 2011 TUN/TAP TX queue length set to 100 Thu May 26 16:53:32 2011 /sbin/ifconfig tun0 10.15.119.6 pointopoint 10.15.119.5 mtu 1500 Thu May 26 16:53:32 2011 /sbin/route add -net 192.168.0.0 netmask 255.255.255.0 gw 10.15.119.5 Thu May 26 16:53:32 2011 /sbin/route add -net 10.15.119.1 netmask 255.255.255.255 gw 10.15.119.5 Thu May 26 16:53:32 2011 Initialization Sequence Completed

编辑感谢沃尔夫冈茨在office.up注意到一个错字，我再次尝试tracepath没有任何改进：

 $ tracepath 192.168.0.100 1: 10.15.119.6 0.261ms pmtu 1500 1: 10.15.119.1 88.989ms 1: 10.15.119.1 58.752ms 2: no reply

请注意，当ip是来自openvpn服务器的结果时，结果有多不同

 $ tracepath 192.168.0.101 1: 10.15.119.6 0.308ms pmtu 1500 1: 192.168.0.101 115.713ms reached 1: 192.168.0.101 65.064ms reached Resume: pmtu 1500 hops 1 back 64

在客户端路由条目：

 $ route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.15.119.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 10.15.119.1 10.15.119.5 255.255.255.255 UGH 0 0 0 tun0 192.168.0.0 10.15.119.5 255.255.255.0 UG 0 0 0 tun0 10.21.2.0 0.0.0.0 255.255.255.0 U 1 0 0 eth0 169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 eth0 0.0.0.0 10.21.2.254 0.0.0.0 UG 0 0 0 eth0

并在（openvpn）服务器上路由条目：

 $ route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.15.119.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 10.15.119.0 10.15.119.2 255.255.255.0 UG 0 0 0 tun0 192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1 169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0 169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 vboxnet0 0.0.0.0 192.168.0.1 0.0.0.0 UG 0 0 0 eth1 0.0.0.0 0.0.0.0 0.0.0.0 U 1002 0 0 eth0 0.0.0.0 0.0.0.0 0.0.0.0 U 1004 0 0 vboxnet0

编辑2：我已经检查，IP转发已启用

 $ cat /proc/sys/net/ipv4/ip_forward 1

这里是服务器中iptables的输出：

 $ sudo iptables -nv -L Chain INPUT (policy DROP 1 packets, 52 bytes) pkts bytes target prot opt in out source destination 0 0 DROP all -- eth0 * 127.0.0.1 0.0.0.0/0 0 0 DROP all -- eth0 * 0.0.0.0/0 127.0.0.1 0 0 DROP all -- eth0 * 192.168.0.0/16 0.0.0.0/0 0 0 DROP all -- eth0 * 172.16.0.0/12 0.0.0.0/0 0 0 DROP all -- eth0 * 10.0.0.0/8 0.0.0.0/0 8 416 ACCEPT all -- * * 127.0.0.1 0.0.0.0/0 0 0 ACCEPT all -- * * 0.0.0.0/0 127.0.0.1 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 91 8915 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 293 28499 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1194 1 1500 ACCEPT all -- tun+ * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- tap+ * 0.0.0.0/0 0.0.0.0/0 18 2010 ACCEPT all -- eth1 * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED Chain FORWARD (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 DROP all -- eth0 * 127.0.0.1 0.0.0.0/0 0 0 DROP all -- eth0 * 0.0.0.0/0 127.0.0.1 0 0 DROP all -- eth0 * 192.168.0.0/16 0.0.0.0/0 0 0 DROP all -- eth0 * 172.16.0.0/12 0.0.0.0/0 0 0 DROP all -- eth0 * 10.0.0.0/8 0.0.0.0/0 0 0 DROP tcp -- * eth0 0.0.0.0/0 0.0.0.0/0 tcp spts:137:139 0 0 DROP udp -- * eth0 0.0.0.0/0 0.0.0.0/0 udp spts:137:139 0 0 DROP all -- eth1 * !10.0.0.0/24 0.0.0.0/0 38 57000 ACCEPT all -- tun+ * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- tap+ * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- eth1 * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- * eth0 0.0.0.0/0 0.0.0.0/0 state NEW 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED Chain OUTPUT (policy ACCEPT 306 packets, 34543 bytes) pkts bytes target prot opt in out source destination 0 0 DROP tcp -- * eth0 0.0.0.0/0 0.0.0.0/0 tcp spts:137:139 0 0 DROP udp -- * eth0 0.0.0.0/0 0.0.0.0/0 udp spts:137:139 0 0 ACCEPT all -- * eth0 0.0.0.0/0 0.0.0.0/0 state NEW

编辑3

我想我已经留下了一条重要的信息，我没有想到它可能是相关的，但最近的答案使我可以这样做; openvpn是直接连接到路由器，并在路由器configuration（在192.168.0.1）我已经启用openvpn端口1194到openvpn服务器的端口转发，这是我目前如何连接远程

编辑4

我已经尝试在192.168.0.100 （辅助服务器）机器上运行以下内容，以查看是否可以通过为其路由到10.15.119.x路由来解决此问题：

 sudo route add -net 10.15.119.0 netmask 255.255.255.0 gw 192.168.0.101

（192.168.0.101是openvpn服务器地址，192.168.0.100是我想从外部访问的辅助服务器）

我试过这个， ping 10.15.119.1工作，以达到openvpn服务器，但ping 10.15.119.6 （我的客户端IP）只是失败

编辑5

我试图从客户端ping 192.168.0.100时，在openvpn服务器上添加了tcpdump的结果：

 $ sudo tcpdump -v -i any host 192.168.0.100 tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes 11:10:43.675915 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 10.15.119.6 > services-host-1.local: ICMP echo request, id 2494, seq 1, length 64 11:10:43.675932 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 10.15.119.6 > services-host-1.local: ICMP echo request, id 2494, seq 1, length 64 11:10:43.676149 IP (tos 0x0, ttl 64, id 40127, offset 0, flags [none], proto ICMP (1), length 84) services-host-1.local > 10.15.119.6: ICMP echo reply, id 2494, seq 1, length 64 11:10:43.778583 IP (tos 0x0, ttl 255, id 0, offset 0, flags [DF], proto UDP (17), length 103) services-host-1.local.mdns > 224.0.0.251.mdns: 0*- [0q] 1/0/0 100.0.168.192.in-addr.arpa. (Cache flush) PTR services-host-1.local. (75) 11:10:43.778588 IP (tos 0x0, ttl 255, id 0, offset 0, flags [DF], proto UDP (17), length 103) services-host-1.local.mdns > 224.0.0.251.mdns: 0*- [0q] 1/0/0 100.0.168.192.in-addr.arpa. (Cache flush) PTR services-host-1.local. (75) 11:10:44.681801 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 10.15.119.6 > services-host-1.local: ICMP echo request, id 2494, seq 2, length 64 11:10:44.681809 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 10.15.119.6 > services-host-1.local: ICMP echo request, id 2494, seq 2, length 64 11:10:44.682007 IP (tos 0x0, ttl 64, id 40128, offset 0, flags [none], proto ICMP (1), length 84) services-host-1.local > 10.15.119.6: ICMP echo reply, id 2494, seq 2, length 64 11:10:45.689926 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 10.15.119.6 > services-host-1.local: ICMP echo request, id 2494, seq 3, length 64 11:10:45.689933 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 10.15.119.6 > services-host-1.local: ICMP echo request, id 2494, seq 3, length 64 11:10:45.690121 IP (tos 0x0, ttl 64, id 40129, offset 0, flags [none], proto ICMP (1), length 84) services-host-1.local > 10.15.119.6: ICMP echo reply, id 2494, seq 3, length 64 11:10:46.698990 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 10.15.119.6 > services-host-1.local: ICMP echo request, id 2494, seq 4, length 64 11:10:46.698997 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 10.15.119.6 > services-host-1.local: ICMP echo request, id 2494, seq 4, length 64 11:10:46.699190 IP (tos 0x0, ttl 64, id 40130, offset 0, flags [none], proto ICMP (1), length 84) services-host-1.local > 10.15.119.6: ICMP echo reply, id 2494, seq 4, length 64 11:10:47.706870 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 10.15.119.6 > services-host-1.local: ICMP echo request, id 2494, seq 5, length 64 11:10:47.706878 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 10.15.119.6 > services-host-1.local: ICMP echo request, id 2494, seq 5, length 64 11:10:47.707067 IP (tos 0x0, ttl 64, id 40131, offset 0, flags [none], proto ICMP (1), length 84) services-host-1.local > 10.15.119.6: ICMP echo reply, id 2494, seq 5, length 64 11:10:48.680540 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has services-host-1.local tell openvpnServer, length 28 11:10:48.680737 ARP, Ethernet (len 6), IPv4 (len 4), Reply services-host-1.local is-at 08:00:27:a4:e2:01 (oui Unknown), length 28 11:10:48.684812 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has dfdlinkrouter tell services-host-1.local, length 28 11:10:48.685338 ARP, Ethernet (len 6), IPv4 (len 4), Reply dfdlinkrouter is-at 00:26:5a:ae:90:88 (oui Unknown), length 46 11:10:48.716100 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 10.15.119.6 > services-host-1.local: ICMP echo request, id 2494, seq 6, length 64 11:10:48.716107 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 10.15.119.6 > services-host-1.local: ICMP echo request, id 2494, seq 6, length 64 11:10:48.716347 IP (tos 0x0, ttl 64, id 40132, offset 0, flags [none], proto ICMP (1), length 84) services-host-1.local > 10.15.119.6: ICMP echo reply, id 2494, seq 6, length 64

所以看来ping是到达服务器，他回复，但数据包在进入vpn之前被丢弃，所以我在iptables中添加一行logging所有INPUT和FORWARD数据包丢弃或拒绝，这里是什么被过滤/var/log/syslog

 May 30 10:59:24 openvpnServer kernel: [40433.898392] iptables INPUT denied: IN=eth1 OUT= MAC= SRC=192.168.0.101 DST=224.0.0.251 LEN=98 TOS=0x00 PREC=0x00 TTL=255 ID=0 DF PROTO=UDP SPT=5353 DPT=5353 LEN=78 May 30 10:59:24 openvpnServer kernel: [40434.001003] iptables INPUT denied: IN=eth1 OUT= MAC=01:00:5e:00:00:fb:08:00:27:a4:e2:01:08:00 SRC=192.168.0.100 DST=224.0.0.251 LEN=62 TOS=0x00 PREC=0x00 TTL=255 ID=0 DF PROTO=UDP SPT=5353 DPT=5353 LEN=42 May 30 10:59:24 openvpnServer kernel: [40434.001102] iptables INPUT denied: IN=eth1 OUT= MAC= SRC=192.168.0.101 DST=224.0.0.251 LEN=72 TOS=0x00 PREC=0x00 TTL=255 ID=0 DF PROTO=UDP SPT=5353 DPT=5353 LEN=52 May 30 11:03:28 openvpnServer kernel: [40677.329586] iptables INPUT denied: IN=eth1 OUT= MAC= SRC=192.168.0.101 DST=224.0.0.251 LEN=67 TOS=0x00 PREC=0x00 TTL=255 ID=0 DF PROTO=UDP SPT=5353 DPT=5353 LEN=47 May 30 11:03:29 openvpnServer kernel: [40678.330065] iptables INPUT denied: IN=eth1 OUT= MAC= SRC=192.168.0.101 DST=224.0.0.251 LEN=67 TOS=0x00 PREC=0x00 TTL=255 ID=0 DF PROTO=UDP SPT=5353 DPT=5353 LEN=47

我已经注释掉了iptables中的大多数DROP和REJECT命令，看看是否有效，但我仍然遇到同样的问题，这是我的iptables删除所有滴

 $ sudo iptables -L -nv Chain INPUT (policy ACCEPT 88 packets, 15209 bytes) pkts bytes target prot opt in out source destination 3404 3162K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 0 0 REJECT all -- !lo * 0.0.0.0/0 127.0.0.0/8 reject-with icmp-port-unreachable 2950 249K ACCEPT all -- tun+ * 0.0.0.0/0 0.0.0.0/0 12881 6906K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 162 9696 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22 1 42 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1194 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 60 10407 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 5/min burst 5 LOG flags 0 level 7 prefix `iptables INPUT denied: ' Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 30 2448 ACCEPT all -- tun+ * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1194 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 5/min burst 5 LOG flags 0 level 7 prefix `iptables FORWARD denied: ' Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 2826 857K ACCEPT all -- * tun+ 0.0.0.0/0 0.0.0.0/0 17443 5842K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0

编辑6

正如Steven所build议的那样，我添加了3个tcpdump，2个在服务器端，另一个在客户端，而从客户端运行

 $ ping 192.168.0.100 PING 192.168.0.100 (192.168.0.100) 56(84) bytes of data. ^C --- 192.168.0.100 ping statistics --- 5 packets transmitted, 0 received, 100% packet loss, time 4024ms

但首先我在openvpn服务器上刷新了iptables规则：

 $ sudo iptables -L -nv Chain INPUT (policy ACCEPT 206 packets, 26537 bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 50 packets, 7781 bytes) pkts bytes target prot opt in out source destination

这里是openvpn服务器的第一个tcpdump的输出

 $ sudo tcpdump -vn -i tun0 '(host 192.168.0.100 or host 10.15.119.6)' and icmp tcpdump: listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes 13:54:30.871403 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 10.15.119.6 > 192.168.0.100: ICMP echo request, id 3145, seq 1, length 64 13:54:31.870534 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 10.15.119.6 > 192.168.0.100: ICMP echo request, id 3145, seq 2, length 64 13:54:32.879562 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 10.15.119.6 > 192.168.0.100: ICMP echo request, id 3145, seq 3, length 64

服务器上的第二个tcpdump：

 $ sudo tcpdump -vn -i eth1 '(host 192.168.0.100 or host 10.15.119.6)' and icmp tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes 13:54:30.871429 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 10.15.119.6 > 192.168.0.100: ICMP echo request, id 3145, seq 1, length 64 13:54:30.875508 IP (tos 0x0, ttl 64, id 28969, offset 0, flags [none], proto ICMP (1), length 84) 192.168.0.100 > 10.15.119.6: ICMP echo reply, id 3145, seq 1, length 64 13:54:31.870544 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 10.15.119.6 > 192.168.0.100: ICMP echo request, id 3145, seq 2, length 64 13:54:31.870760 IP (tos 0x0, ttl 64, id 28970, offset 0, flags [none], proto ICMP (1), length 84) 192.168.0.100 > 10.15.119.6: ICMP echo reply, id 3145, seq 2, length 64

和第三个tcpdump，这次在客户端：

 $ sudo tcpdump -vn -i eth0 host 192.168.0.100 and icmp tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes ^C 0 packets captured 0 packets received by filter 0 packets dropped by kernel

重要的是这里有什么可能是有益的，在客户端我已经运行ip route show

 $ sudo ip route show 10.15.119.5 dev tun0 proto kernel scope link src 10.15.119.6 10.15.119.1 via 10.15.119.5 dev tun0 192.168.0.0/24 via 10.15.119.5 dev tun0 10.21.2.0/24 dev eth0 proto kernel scope link src 10.21.2.118 metric 1 169.254.0.0/16 dev eth0 scope link metric 1000 default via 10.21.2.254 dev eth0 proto static

相同的命令在openvpn服务器上

 $ sudo ip route show 10.15.119.2 dev tun0 proto kernel scope link src 10.15.119.1 10.15.119.0/24 via 10.15.119.2 dev tun0 192.168.0.0/24 dev eth1 proto kernel scope link src 192.168.0.101 metric 1 169.254.0.0/16 dev eth1 scope link metric 1000 default via 192.168.0.1 dev eth1 proto static

openvpn版本：

$ openvpn –version OpenVPN 2.1.0 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia]build立于2010年7月12日最初由James Yonan开发Copyright（C ）2002-2009 OpenVPN Technologies，Inc.

操作系统是Ubuntu 10.10 x86_64

为什么我要login客户端日志：

 ue May 31 14:45:41 2011 /sbin/ifconfig tun0 10.15.119.6 pointopoint 10.15.119.5 mtu 1500 Tue May 31 14:45:41 2011 /sbin/route add -net 192.168.0.0 netmask 255.255.255.0 gw 10.15.119.5 Tue May 31 14:45:41 2011 /sbin/route add -net 10.15.119.1 netmask 255.255.255.255 gw 10.15.119.5

那虚拟networking的255.255.255.255掩码呢？

@skrewler，这是netstat的结果：

首先，从openvpn运行的客户端：

 $ netstat -rn Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 10.15.119.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 10.15.119.1 10.15.119.5 255.255.255.255 UGH 0 0 0 tun0 192.168.0.0 10.15.119.5 255.255.255.0 UG 0 0 0 tun0 10.21.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0 0.0.0.0 10.21.2.254 0.0.0.0 UG 0 0 0 eth0 $ ifconfig -a eth0 Link encap:Ethernet HWaddr 08:00:27:0c:86:1c inet addr:10.21.2.118 Bcast:10.21.2.255 Mask:255.255.255.0 inet6 addr: fe80::a00:27ff:fe0c:861c/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:22701 errors:0 dropped:0 overruns:0 frame:0 TX packets:12806 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:2855655 (2.8 MB) TX bytes:1224261 (1.2 MB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:8 errors:0 dropped:0 overruns:0 frame:0 TX packets:8 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:480 (480.0 B) TX bytes:480 (480.0 B) tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:10.15.119.6 PtP:10.15.119.5 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

和client.conf：

 dev tun0 remote my.server.com tls-client pull ca keys/ca.crt cert keys/client.crt key keys/client.key ns-cert-type server status logs/openvpn-status.log log logs/openvpn.log comp-lzo verb 4

其次，从openvpn服务器

 $ netstat -rn Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 10.15.119.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 10.15.119.0 10.15.119.2 255.255.255.0 UG 0 0 0 tun0 192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1 169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth1 0.0.0.0 192.168.0.1 0.0.0.0 UG 0 0 0 eth1

为server.conf

 dev tun server 10.15.119.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "route 192.168.0.0 255.255.255.0" tls-server dh keys/dh1024.pem ca keys/ca.crt cert keys/openvpn-server-key.crt key keys/openvpn-server-key.key user nobody group nogroup status openvpn-status.log log logs/openvpn.log comp-lzo verb 4

与上述设置我能够：

1）从客户端ping到192.168.0.101（openvpn服务器）2）从openvpnserver到10.15.119.6（客户端）

我无法做的是从客户端ping 192.168.0.100（辅助局域网服务器）。

192.168.0.100实际上是在openserver显示的tcpdump上响应客户端的，但是不知怎的，这些数据包并没有返回给客户端

我经历了这些反应，我想我对所有这一切都很了解。

让我们做一些简单的检查来缩小这个问题的范围：

从一个无法ping通192.168.0.x主机的OpenVPN客户端： netstatn -rn也给我们ifconfig -a为* nix或ipconfig /all ping <openvpn server external 10.21.x address> ping <openvpn 10.15.x address

从openvpn服务器： netstatn -rn ping <a 192.168.0.x host> ping <a 10.15.x host> ping <a 10.21.x host>

另外，您当前的openvpn服务器configuration和客户端configuration可能位于/etc/openvpn/server.conf和客户端计算机上/etc/openvpn/<hostname>.conf或c:\program files\openvpn\config\<hostname.conf> or .ovpn

我有一个类似的设置。在我的OpenVPN服务器上，我有这个iptables规则equiv（更改hostmask /接口到你的价值应该是什么）：

 # Generated by iptables-save v1.4.4 *nat :PREROUTING ACCEPT [5:332] :POSTROUTING ACCEPT [5:740] :OUTPUT ACCEPT [5:740] -A POSTROUTING -s 10.15.119.0/2 -o eth1 -j MASQUERADE COMMIT

看起来像你的问题是绝对的，因为你缺lessiptable_nat。

 # lsmod | grep nat iptable_nat 5011 1 nf_nat 19101 2 ipt_MASQUERADE,iptable_nat nf_conntrack_ipv4 12548 3 iptable_nat,nf_nat nf_conntrack 72270 4 ipt_MASQUERADE,iptable_nat,nf_nat,nf_conntrack_ipv4 ip_tables 17942 2 iptable_nat,iptable_filter x_tables 21613 3 ipt_MASQUERADE,iptable_nat,ip_tables

modprobe iptable_nat或尝试使用-a参数。

您需要将路线推送到客户端。这是使用服务器configuration文件中的“push”选项完成的。

默认情况下，OpenVPN服务器将只推送一个路由到自己。

一般来说，在build立一个VPN服务器的时候，让VPN在一个单独的子网上工作是一个好主意，这样你就可以使你的路由更容易，同时也使你的防火墙设置更容易。例：

运行OpenVPN服务器的服务器的内部IP地址为10.15.119.1。其公有IP地址是123.1.2.3。而你的整个内部networking是在10.15.119.0/24。然后，您可以将OpenVPN服务器设置为在10.15.120.0/24上运行，这将为您提供多达63个可能的客户端连接（每个连接需要一个包含4个IP地址的小型子网）。连接的第一个客户端将获得IP地址10.15.120.5。如果您现在将路由推送到10.15.119.0/24，则客户端将添加路由到其路由表，以便此子网的所有stream量进入隧道。 OpenVPN服务器会把这个stream量回到它的私有以太网连接。

阅读OpenVPN的手册页（或在互联网上的文档），了解如何推送路线的确切细节。

也许我没有正确理解，但是您试图访问VPN服务器的设备是否具有指向OpenVPN客户端子网的已configuration路由？

如果您在非默认网关的系统上运行OpenVPN，并且需要单独的路由，则这些服务器将无法将数据包返回给客户端。

源自你的OpenVPN服务器的ping是从设备可以路由到的接口发送的，但是如果其他服务器不知道那个路由，那么返回给客户端的ping可能没有路由。

这可能是无关紧要的，如果你在服务器上NAT你的客户端stream量，但我没有看到任何东西，表明在你发布的configuration。

尝试这个：

在您的服务器上添加一个iptables SNAT规则。

iptables -t nat -A POSTROUTING -s 10.15.119.0/24 -o eth0 -j SNAT – to-source 10.21.2.118

这将使任何VPN客户端的IP连接到您的networking中的其他服务器的工作/路由NAT回去。

你为什么不把iptables的规则完全刷新，以避免这种可能性。客户端的iptables呢？冲洗这些。

 iptables --flush iptables --table nat --flush iptables --delete-chain iptables --table nat --delete-chain iptables -P FORWARD ACCEPT iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT

然后在openvpn服务器上运行一个更干净的tcpdump，同时从客户端ping到192.168.0.100：

 tcpdump -vn -i tun0 '(host 192.168.0.100 or host 10.15.119.6)' and icmp

同时在服务器上运行另一个转储：

 tcpdump -vn -i eth1 '(host 192.168.0.100 or host 10.15.119.6)' and icmp

客户端上的第三个转储：

 tcpdump -vn -i eth0 host 192.168.0.100 and icmp

它看起来像ping达到192.168.0.100，答复达到openvpn，但不是你的客户端。但是你确定客户没有放弃答复吗？第一个和第三个tcpdump将validation。

你试图完成的设置是一个有点深奥的要求，并且是不是很知名的OpenVPNfunction。

大多数VPN设置都是这样configuration的，即连接到VPN服务器的客户端是链路中的最后一个链路，没有其他计算机或networking背后需要在VPN上访问。在你的场景中，VPN服务器和VPN客户端都有networking，这些networking需要能够直接相互通信。有很多方法可以实现这一点：

选项1：在每个客户端configuration源NAT。这不是首选，因为它增加了客户端的开销，并且要求每个客户端分别设置源NAT。在大量networking上维护这样的设置将是一场噩梦。

选项2：使用OpenVPN提供的iroutesfunction。使用stream水线，您可以明确指定networking中每个节点后面的networking，从而使各种networking能够通过OpenVPN的内部路由互相通信。在源NAT上使用iroutes的主要好处是没有客户端开销，并且configuration全部在VPN服务器上执行。请记住，您仍然需要指定要在VPN服务器上推送的路由 – 除此之外，还必须添加iroutes，并且仅用于定义每个VPN节点后面的networking范围。

由于iroutes不是一个平凡的话题，我build议阅读以下几页。 If you have specific problems with setting up iroutes, please ask those questions here.

http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing http://backreference.org/2009/11/15/openvpn-and-iroute

I did what you are asking for, I did some things different. For one, I used a tap-device.

Take a look below:

server.conf

 port 1194 proto udp dev tap0 ca /etc/openvpn/keys/ca.crt cert /etc/openvpn/keys/server.crt key /etc/openvpn/keys/server.key # This file should be kept secret dh /etc/openvpn/keys/dh1024.pem ifconfig-pool-persist ipp.txt server-bridge 192.168.220.1 255.255.255.0 192.168.220.90 192.168.220.100 # GATEWAY - NETMASK - START DHCP - END DHCP push "route 192.168.220.0 255.255.255.0" client-to-client keepalive 10 120 comp-lzo max-clients 20 persist-key persist-tun status openvpn-status.log verb 3

client.conf

 remote xxx.xxx.xxx.xxx 1194 udp pull tls-client persist-key ca ca.crt nobind persist-tun cert cert.crt comp-lzo dev tap key key.key resolv-retry infinite

Try removing the "up ./office.up" from your server configuration file and restarting OpenVPN. It is not necessary (the openvpn daemon will create the routes for the network defined by the "server" directive anyway) and some screwup might prevent the packets to your clients from being routed correctly.