Temat: LEDE Openvpn - problem z dostępem do sieci lokalnej
Witam,
Mam problem z prawidłową konfiguracją serwera openvpn na routerze aby hosty łączące się miały dostęp do sieci lokalnej.
W tej chwili klienci łączą się i mają dostęp do routera. Wprowadziłem zmiany jak z poradnika http://eko.one.pl/?p=openwrt-openvpntun … eztunelvpn. Niestety nie pomogły. Sieć lokalna za routerem posiada IP 192.168.25.0/24
Oto moja konfiguracja serwera:
port 1194
proto udp
dev tun
ca /etc/openvpn/1/ca.crt
cert /etc/openvpn/1/server.crt
key /etc/openvpn/1/server.key # This file should be kept secret
dh /etc/openvpn/1/dh2048.pem
topology subnet
server 10.24.3.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
route 10.24.3.0 255.255.255.0
client-to-client
keepalive 5 30
tls-auth /etc/openvpn/1/ta.key 0 # This file is secret
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 4
multihome
route 10.24.3.0 255.255.255.0
push "route 192.168.25.0 255.255.255.0"routing serwera:
route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.24.3.0 10.24.3.2 255.255.255.0 UG 0 0 0 tun0
10.24.3.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
192.168.25.0 0.0.0.0 255.255.255.0 U 0 0 0 br-lanfirewall na routerze:
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
config zone 'wan'
option name 'wan'
list network 'wan'
list network 'wan6'
list network 'wifiwan0'
list network 'wifiwan1'
option input 'DROP'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Drop-ping'
option src 'wan'
option proto 'icmp'
option family 'ipv4'
option target 'DROP'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
config rule
option src 'wan'
option proto 'esp'
option target 'ACCEPT'
config zone
option name 'vpn'
option input 'ACCEPT'
option forward 'ACCEPT'
option output 'ACCEPT'
option network 'vpn'
option masq '1'
config forwarding
option src 'vpn'
option dest 'wan'
config rule
option name 'OpenVPN'
option target 'ACCEPT'
option src 'wan'
option proto 'udp'
option dest_port '1194'
config forwarding
option src 'vpn'
option dest 'lan'Konfiguracja klienta:
client
dev tun
proto udp
remote x.x.x.x 1194 # adres serwera
resolv-retry infinite
nobind
persist-key
persist-tun
persist-local-ip
persist-remote-ip
ca /etc/openvpn/ca.crt
cert /etc/openvpn/client-3.crt
key /etc/openvpn/client-3.key
ns-cert-type server
tls-auth /etc/openvpn/ta.key 1
comp-lzo
verb 3
tun-mtu 1464routing klienta:
route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.8.1 0.0.0.0 UG 0 0 0 eth0
10.24.3.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
192.168.25.0 10.24.3.1 255.255.255.0 UG 0 0 0 tun0
192.168.8.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0Prawie jestem pewien że problem jest z routingiem