需要帮助在Ubuntu服务器上设置OpenVPN

编辑：

好的，感谢您的帮助，我已经取得了一些进展。我通过在接口文件中手动设置网桥并编辑网桥启动和网桥停止脚本来仅修改分接接口（请参阅下文中的这些文件的当前版本）来解决与网桥的连接问题。）

现在我可以连接到服务器，但连接不断下降。这是一个关键问题？我试过重新生成密钥无济于事。

尝试连接到我的服务器时从Tunnelbrick的日志：

2010-09-19 10:08:05 *Tunnelblick: OS X 10.6.4; Tunnelblick 3.0 (build 1437); OpenVPN 2.1.1 2010-09-19 10:08:07 *Tunnelblick: Attempting connection with evan's apartment.conf; Set nameserver = 1; monitoring connection 2010-09-19 10:08:07 *Tunnelblick: /Applications/Tunnelblick.app/Contents/Resources/openvpnstart start evan's\ apartment.conf 1338 1 0 0 0 2010-09-19 10:08:07 *Tunnelblick: /Applications/Tunnelblick.app/Contents/Resources/openvpn --management-query-passwords --cd /Users/evan/Library/Application Support/Tunnelblick/Configurations --daemon --management-hold --management 127.0.0.1 1338 --config /Users/evan/Library/Application Support/Tunnelblick/Configurations/evan's apartment.conf --script-security 2 --up "/Applications/Tunnelblick.app/Contents/Resources/client.up.osx.sh" --down "/Applications/Tunnelblick.app/Contents/Resources/client.down.osx.sh" --up-restart 2010-09-19 10:08:07 SUCCESS: pid=2376 2010-09-19 10:08:07 SUCCESS: real-time state notification set to ON 2010-09-19 10:08:07 SUCCESS: real-time log notification set to ON 2010-09-19 10:08:07 OpenVPN 2.1.1 i386-apple-darwin10.2.0 [SSL] [LZO2] [PKCS11] built on Feb 24 2010 2010-09-19 10:08:07 MANAGEMENT: TCP Socket listening on 127.0.0.1:1338 2010-09-19 10:08:07 waiting... 2010-09-19 10:08:07 MANAGEMENT: Client connected from 127.0.0.1:1338 2010-09-19 10:08:07 MANAGEMENT: CMD 'pid' 2010-09-19 10:08:07 MANAGEMENT: CMD 'state on' 2010-09-19 10:08:07 MANAGEMENT: CMD 'log on all' 2010-09-19 10:08:07 END 2010-09-19 10:08:07 MANAGEMENT: CMD 'hold release' 2010-09-19 10:08:07 SUCCESS: hold release succeeded 2010-09-19 10:08:07 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 2010-09-19 10:08:07 Control Channel Authentication: using '/Users/evan/VPN/ta.key' as a OpenVPN static key file 2010-09-19 10:08:07 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication 2010-09-19 10:08:07 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication 2010-09-19 10:08:07 LZO compression initialized 2010-09-19 10:08:07 Control Channel MTU parms [ L:1576 D:168 EF:68 EB:0 ET:0 EL:0 ] 2010-09-19 10:08:07 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ] 2010-09-19 10:08:07 Local Options hash (VER=V4): 'e39a3273' 2010-09-19 10:08:07 Expected Remote Options hash (VER=V4): '3c14feac' 2010-09-19 10:08:07 or --up-delay 2010-09-19 10:08:07 Attempting to establish TCP connection with 192.168.0.2:1194 [nonblock] 2010-09-19 10:08:07 2010-09-19 10:08:08 TCP connection established with 192.168.0.2:1194 2010-09-19 10:08:08 Socket Buffers: R=[525624->65536] S=[131768->65536] 2010-09-19 10:08:08 TCPv4_CLIENT link local: [undef] 2010-09-19 10:08:08 TCPv4_CLIENT link remote: 192.168.0.2:1194 2010-09-19 10:08:08 2010-09-19 10:08:08 restarting [0] 2010-09-19 10:08:08 TCP/UDP: Closing socket 2010-09-19 10:08:08 process restarting 2010-09-19 10:08:08 2010-09-19 10:08:08 MANAGEMENT: CMD 'hold release' 2010-09-19 10:08:08 SUCCESS: hold release succeeded 2010-09-19 10:08:08 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 2010-09-19 10:08:08 Re-using SSL/TLS context 2010-09-19 10:08:08 LZO compression initialized 2010-09-19 10:08:08 Control Channel MTU parms [ L:1576 D:168 EF:68 EB:0 ET:0 EL:0 ] 2010-09-19 10:08:08 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ] 2010-09-19 10:08:08 Local Options hash (VER=V4): 'e39a3273' 2010-09-19 10:08:08 Expected Remote Options hash (VER=V4): '3c14feac' 2010-09-19 10:08:08 Attempting to establish TCP connection with 192.168.0.2:1194 [nonblock] 2010-09-19 10:08:08 2010-09-19 10:08:09 TCP connection established with 192.168.0.2:1194 2010-09-19 10:08:09 Socket Buffers: R=[525624->65536] S=[131768->65536] 2010-09-19 10:08:09 TCPv4_CLIENT link local: [undef] 2010-09-19 10:08:09 TCPv4_CLIENT link remote: 192.168.0.2:1194 2010-09-19 10:08:09 2010-09-19 10:08:09 restarting [0] ... (just keeps repeating from here)

以下是我更改的更新文件：

接口

 # The loopback network interface auto lo iface lo inet loopback # The primary network interface auto eth0 iface eth0 inet static address 192.168.0.2 netmask 255.255.255.0 gateway 192.168.0.1 # Bridge for OpenVPN auto br0 iface br0 inet static address 192.168.0.2 netmask 255.255.255.0 gateway 192.168.0.1 bridge_ports eth0

桥启动

 #!/bin/bash ################################# # Set up Ethernet bridge on Linux # Requires: bridge-utils ################################# # Define Bridge Interface br="br0" # Define list of TAP interfaces to be bridged, # for example tap="tap0 tap1 tap2". tap="tap0" # Define physical ethernet interface to be bridged # with TAP interface(s) above. eth="eth0" eth_ip="192.168.0.2" eth_netmask="255.255.255.0" eth_broadcast="192.168.0.255" eth_gateway="192.168.0.1" eth_network="192.168.0.0" for t in $tap; do openvpn --mktun --dev $t done #brctl addbr $br #brctl addif $br $eth for t in $tap; do brctl addif $br $t done for t in $tap; do ifconfig $t 0.0.0.0 promisc up done ifconfig $eth 0.0.0.0 promisc up #ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast gateway $eth_gateway

桥站

 #!/bin/bash #################################### # Tear Down Ethernet bridge on Linux #################################### # Define Bridge Interface br="br0" # Define list of TAP interfaces to be bridged together tap="tap0" #ifconfig $br down #brctl delbr $br for t in $tap; do openvpn --rmtun --dev $t done

我的server.conf文件看起来像一个alerootbuild议。

感谢所有的帮助到目前为止，我想我现在很近:)。

原文问题：

我试图让我的Ubuntu 10.04服务器作为一个OpenVPN服务器，所以我最终可以在我工作的时候在我的labtop上安装我的数据。现在我已经按照这里的指示几次，没有运气。

我很确定这个问题与设置网桥和tap接口有关。我认为这是因为一旦我设置了桥梁（使用这些脚本 – http openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernetbridging.html#linuxscript – 对不起，我只能做一个链接在这一刻:)），并启动服务器（开始没有错误）我失去了我的eth0连接（当我运行ifconfig，只有新的br0有一个IP地址）。同样，在启用网桥后，我不能再ssh到我的服务器，当我停止openvpn服务器并运行网桥停止脚本时，再次开始工作。

我想我很困惑哪个IP地址在哪里。

我的路由器有公共IP地址，可以说它是25.25.25.25，我的Ubuntu服务器有一个静态IP地址192.168.0.2（端口转发和一切工作正常，我可以从任何地方ssh，直到我运行桥脚本或尝试:)）。这里是我在上面指定的文件中使用的值，他们看起来是正确的吗？

从桥接开始（链接到上面的完整文件）

 # Define physical ethernet interface to be bridged # with TAP interface(s) above. eth="eth0" eth_ip="192.168.0.2" eth_netmask="255.255.255.0" eth_broadcast="192.168.0.255"

从server.conf

 local 192.168.0.2 dev tap0 up "/etc/openvpn/up.sh br0" down "/etc/openvpn/down.sh br0" ;server 10.8.0.0 255.255.255.0 server-bridge 192.168.0.2 255.255.255.0 192.168.0.50 192.168.100 push "route 192.168.0.2 255.255.255.0" push "dhcp-option DNS 192.168.0.1" ;push "dhcp-option DOMAIN example.com" <- commented not sure what i should use, the value is resolve.conf? tls-auth ta.key 0 # This file is secret user nobody group nogroup

谢谢你的帮助！！

上面的configuration真的不能提供很多，但我可以build议一些替代scheme：

你可能要考虑安装OpenVPN-AS服务器 – 我们在Ubuntu上运行它，这很好。它安装迅速，无痛，并具有直观的Web界面进行configuration和监控。它可以透明地设置接口，甚至为你configuration合适的iptables规则。最多2个并发用户是免费的，更便宜（$ 5 /用户/年）。客户可以从Web界面下载预configuration的自定义configuration文件（* .nix）或安装包（Windows）。

或者，你也可以在虚拟机上运行pfSense （在Ubuntu的KVM下运行），或者把它放在一个独立的盒子里（这对硬件来说并不需要太多），并且利用内置的L2TP，OpenVPN或者PPTP VPN服务器。再一次，这将会带来一些configuration和设置的痛苦，但是如果你去了这条路线，你需要设置KVM 。

我不认为你需要为你想做的事情搭桥。你有没有尝试过build立一个普通的OpenVPN服务器？

在你的情况下Server.cfg的一个例子：

 port 1194 proto tcp dev tap ca /etc/openvpn/easy-rsa/keys/ca.crt cert /etc/openvpn/easy-rsa/keys/Server-VPN.crt key /etc/openvpn/easy-rsa/keys/Server-VPN.key dh /etc/openvpn/easy-rsa/keys/dh1024.pem ifconfig-pool-persist ipp.txt server-bridge 192.168.0.2 255.255.255.0 192.168.0.50 192.168.0.100 push "route 192.0.0.0 255.0.0.0" keepalive 10 120 comp-lzo persist-key persist-tun status /var/log/openvpn-status.log verb 3

还需要在系统启动时运行此脚本（将其插入到/etc/init.d/中，并在您的ubuntu发行版的/etc/rcX.d/中将其插入到/etc/rcX.d/中）以设置您的桥接器：

 #!/bin/bash ################################# # Set up Ethernet bridge on Linux # Requires: bridge-utils ################################# # Define Bridge Interface br="br0" # Define list of TAP interfaces to be bridged, # for example tap="tap0 tap1 tap2". tap="tap0" # Define physical ethernet interface to be bridged # with TAP interface(s) above. eth="eth0" eth_ip="192.168.0.2" eth_netmask="255.255.255.0" eth_broadcast="192.168.0.255" for t in $tap; do openvpn --mktun --dev $t done brctl addbr $br brctl addif $br $eth for t in $tap; do brctl addif $br $t done for t in $tap; do ifconfig $t 0.0.0.0 promisc up done ifconfig $eth 0.0.0.0 promisc up ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast