1 Temat przez andrzej99 (edytowany przez andrzej99 2016-02-05 09:29:48)

  • Zarejestrowany: 2016-02-04
  • Posty: 29

Temat: OpenVPN i brak połączenia z Windows 7

Kilkanaście godzin, kilka dni i nadal nie wiem o co chodzi. Ale po kolei:
Konfigurowałem VPN wg."OpenWrt - konfiguracja serwera OpenVPN w trybie TUN" i nie mogę połączyć się z windows 7.

root@OpenWrt:~# uci show openvpn
openvpn.home=openvpn
openvpn.home.enabled='1'
openvpn.home.dev='tun'
openvpn.home.port='1194'
openvpn.home.proto='udp'
openvpn.home.log='/tmp/openvpn.log'
openvpn.home.verb='3'
openvpn.home.ca='/etc/openvpn/ca.crt'
openvpn.home.cert='/etc/openvpn/serwer.crt'
openvpn.home.key='/etc/openvpn/serwer.key'
openvpn.home.server='10.8.0.0 255.255.255.0'
openvpn.home.dh='/etc/openvpn/dh2048.pem'

root@OpenWrt:~# uci show network
network.loopback=interface
network.loopback.ifname='lo'
network.loopback.proto='static'
network.loopback.ipaddr='127.0.0.1'
network.loopback.netmask='255.0.0.0'
network.globals=globals
network.globals.ula_prefix='fd7b:4987:13f9::/48'
network.lan=interface
network.lan.ifname='eth0.1'
network.lan.force_link='1'
network.lan.type='bridge'
network.lan.proto='static'
network.lan.ipaddr='192.168.1.1'
network.lan.netmask='255.255.255.0'
network.lan.ip6assign='60'
network.lan.macaddr='a0:63:91:7c:fe:24'
network.wan=interface
network.wan.ifname='eth0.2'
network.wan.proto='dhcp'
network.wan.macaddr='a0:63:91:7c:fe:25'
network.wan.mtu='1500'
network.wan6=interface
network.wan6.ifname='eth0.2'
network.wan6.proto='dhcpv6'
network.@switch[0]=switch
network.@switch[0].name='switch0'
network.@switch[0].reset='1'
network.@switch[0].enable_vlan='1'
network.@switch_vlan[0]=switch_vlan
network.@switch_vlan[0].device='switch0'
network.@switch_vlan[0].vlan='1'
network.@switch_vlan[0].ports='0t 1 2 3 4'
network.@switch_vlan[1]=switch_vlan
network.@switch_vlan[1].device='switch0'
network.@switch_vlan[1].vlan='2'
network.@switch_vlan[1].ports='0t 5'
network.vpn=interface
network.vpn.ifname='tun0'
network.vpn.proto='none'

root@OpenWrt:~# uci show firewall
firewall.@defaults[0]=defaults
firewall.@defaults[0].syn_flood='1'
firewall.@defaults[0].output='ACCEPT'
firewall.@defaults[0].forward='REJECT'
firewall.@defaults[0].input='ACCEPT'
firewall.@zone[0]=zone
firewall.@zone[0].name='lan'
firewall.@zone[0].input='ACCEPT'
firewall.@zone[0].output='ACCEPT'
firewall.@zone[0].forward='ACCEPT'
firewall.@zone[0].network='lan'
firewall.@zone[1]=zone
firewall.@zone[1].name='wan'
firewall.@zone[1].output='ACCEPT'
firewall.@zone[1].forward='REJECT'
firewall.@zone[1].masq='1'
firewall.@zone[1].mtu_fix='1'
firewall.@zone[1].input='REJECT'
firewall.@zone[1].network='wan wan6'
firewall.@rule[0]=rule
firewall.@rule[0].name='Allow-DHCP-Renew'
firewall.@rule[0].src='wan'
firewall.@rule[0].proto='udp'
firewall.@rule[0].dest_port='68'
firewall.@rule[0].target='ACCEPT'
firewall.@rule[0].family='ipv4'
firewall.@rule[1]=rule
firewall.@rule[1].name='Allow-Ping'
firewall.@rule[1].src='wan'
firewall.@rule[1].proto='icmp'
firewall.@rule[1].icmp_type='echo-request'
firewall.@rule[1].family='ipv4'
firewall.@rule[1].target='ACCEPT'
firewall.@rule[2]=rule
firewall.@rule[2].name='Allow-IGMP'
firewall.@rule[2].src='wan'
firewall.@rule[2].proto='igmp'
firewall.@rule[2].family='ipv4'
firewall.@rule[2].target='ACCEPT'
firewall.@rule[3]=rule
firewall.@rule[3].name='Allow-DHCPv6'
firewall.@rule[3].src='wan'
firewall.@rule[3].proto='udp'
firewall.@rule[3].src_ip='fe80::/10'
firewall.@rule[3].src_port='547'
firewall.@rule[3].dest_ip='fe80::/10'
firewall.@rule[3].dest_port='546'
firewall.@rule[3].family='ipv6'
firewall.@rule[3].target='ACCEPT'
firewall.@rule[4]=rule
firewall.@rule[4].name='Allow-MLD'
firewall.@rule[4].src='wan'
firewall.@rule[4].proto='icmp'
firewall.@rule[4].src_ip='fe80::/10'
firewall.@rule[4].icmp_type='130/0' '131/0' '132/0' '143/0'
firewall.@rule[4].family='ipv6'
firewall.@rule[4].target='ACCEPT'
firewall.@rule[5]=rule
firewall.@rule[5].name='Allow-ICMPv6-Input'
firewall.@rule[5].src='wan'
firewall.@rule[5].proto='icmp'
firewall.@rule[5].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type' 'router-solicitation' 'neighbour-solicitation' 'router-advertisement' 'neighbour-advertisement'
firewall.@rule[5].limit='1000/sec'
firewall.@rule[5].family='ipv6'
firewall.@rule[5].target='ACCEPT'
firewall.@rule[6]=rule
firewall.@rule[6].name='Allow-ICMPv6-Forward'
firewall.@rule[6].src='wan'
firewall.@rule[6].dest='*'
firewall.@rule[6].proto='icmp'
firewall.@rule[6].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type'
firewall.@rule[6].limit='1000/sec'
firewall.@rule[6].family='ipv6'
firewall.@rule[6].target='ACCEPT'
firewall.@include[0]=include
firewall.@include[0].path='/etc/firewall.user'
firewall.@rule[7]=rule
firewall.@rule[7].src='wan'
firewall.@rule[7].dest='lan'
firewall.@rule[7].proto='esp'
firewall.@rule[7].target='ACCEPT'
firewall.@rule[8]=rule
firewall.@rule[8].src='wan'
firewall.@rule[8].dest='lan'
firewall.@rule[8].dest_port='500'
firewall.@rule[8].proto='udp'
firewall.@rule[8].target='ACCEPT'
firewall.@forwarding[0]=forwarding
firewall.@forwarding[0].dest='wan'
firewall.@forwarding[0].src='lan'
firewall.@rule[9]=rule
firewall.@rule[9].name='ssh'
firewall.@rule[9].src='wan'
firewall.@rule[9].target='ACCEPT'
firewall.@rule[9].proto='tcp'
firewall.@rule[9].dest_port='5022'
firewall.@rule[10]=rule
firewall.@rule[10].name='gui'
firewall.@rule[10].src='wan'
firewall.@rule[10].target='ACCEPT'
firewall.@rule[10].proto='tcp'
firewall.@rule[10].dest_port='80'
firewall.@zone[2]=zone
firewall.@zone[2].name='vpn'
firewall.@zone[2].input='ACCEPT'
firewall.@zone[2].forward='ACCEPT'
firewall.@zone[2].output='ACCEPT'
firewall.@zone[2].network='vpn'
firewall.@forwarding[1]=forwarding
firewall.@forwarding[1].src='vpn'
firewall.@forwarding[1].dest='wan'
firewall.@rule[11]=rule
firewall.@rule[11].name='OpenVPN'
firewall.@rule[11].target='ACCEPT'
firewall.@rule[11].src='wan'
firewall.@rule[11].proto='udp'
firewall.@rule[11].dest_port='1194'
firewall.@rule[12]=rule
firewall.@rule[12].name='VPN_wan'
firewall.@rule[12].src='wan'
firewall.@rule[12].target='ACCEPT'
firewall.@rule[12].proto='udp'
firewall.@rule[12].dest_port='1194'

root@OpenWrt:~# ps | grep "openvpn"
 1984 root      3232 S    /usr/sbin/openvpn --syslog openvpn(home) --status /v
 3241 root      1360 S    grep openvpn

root@OpenWrt:~# ifconfig | grep "tun"
tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00

root@OpenWrt:~# cat /tmp/openvpn.log
Thu Feb  4 16:07:12 2016 OpenVPN 2.3.6 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jul 25 2015
Thu Feb  4 16:07:12 2016 library versions: OpenSSL 1.0.2e 3 Dec 2015, LZO 2.08
Thu Feb  4 16:07:12 2016 WARNING: --keepalive option is missing from server config
Thu Feb  4 16:07:13 2016 Diffie-Hellman initialized with 2048 bit key
Thu Feb  4 16:07:13 2016 Socket Buffers: R=[163840->131072] S=[163840->131072]
Thu Feb  4 16:07:13 2016 TUN/TAP device tun0 opened
Thu Feb  4 16:07:13 2016 TUN/TAP TX queue length set to 100
Thu Feb  4 16:07:13 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Feb  4 16:07:13 2016 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Thu Feb  4 16:07:13 2016 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Thu Feb  4 16:07:13 2016 UDPv4 link local (bound): [undef]
Thu Feb  4 16:07:13 2016 UDPv4 link remote: [undef]
Thu Feb  4 16:07:13 2016 MULTI: multi_init called, r=256 v=256
Thu Feb  4 16:07:13 2016 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Thu Feb  4 16:07:13 2016 Initialization Sequence Completed

Port odblokowany. Ja się już poddałem. Proszę o przeanalizowanie bo być może jakaś pierdoła dla kogoś a ja dopiero od niedawna siedzę w tym temacie.
Dzięki.

2 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,615

Odp: OpenVPN i brak połączenia z Windows 7

Serwer ci działa, pokaż pełne logi klienta.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

3 Odpowiedź przez andrzej99 (edytowany przez andrzej99 2016-02-05 09:08:51)

  • Zarejestrowany: 2016-02-04
  • Posty: 29

Odp: OpenVPN i brak połączenia z Windows 7

To w takim razie coś nie tak jest na klientach. Sprawdzałem na dwóch komputerach i w obydwóch jest brak połączenia i tym samym nie ma żadnych wpisów w logu.
Plik konfiguracji klienta:

dev tun
proto udp

log openvpn.log
verb 3

ca c:\Program Files\OpenVPN\certyfikaty\ca.crt
cert c:\Program Files\OpenVPN\certyfikaty\andrzej.crt
key c:\Program Files\OpenVPN\certyfikaty\andrzej.key

client
# remote-cert-tls server
remote xxx 1194

Oczywiści xxx to mój zewnętrzny IP.
Dziękuję.

Sprawdziłem na jakimś gotowcu z UK i łączę się....

4 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,615

Odp: OpenVPN i brak połączenia z Windows 7

Uruchamiasz to jako administrator? Pokaż te logi klienta w końcu.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

5 Odpowiedź przez andrzej99 (edytowany przez andrzej99 2016-02-05 09:25:06)

  • Zarejestrowany: 2016-02-04
  • Posty: 29

Odp: OpenVPN i brak połączenia z Windows 7

Zawsze uruchamiam w trybie administratora, zmieniałem tryby zgodności, nawet zainstalowałem starszą wersję. Zmieniłem udp na tcp, bez zmiany. Przed chwilą sprawdziłem jakiś inny vpn i łączy się bez problemu.
W moim przypadku nie ma żadnej oznaki łączenia się z routerem, tak jak pisałem, nie ma żadnego loga, po prostu po kilku sekundach jest informacja że połączenie się nie powiodło.
Na sieci ciężko cokolwiek znaleźć na ten temat. Może to problem z firewalem na routerze....?

6 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,615

Odp: OpenVPN i brak połączenia z Windows 7

Właśnie, a czasami nie masz tego portu zablokowanego na routerze?

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

7 Odpowiedź przez andrzej99 (edytowany przez andrzej99 2016-02-05 09:10:33)

  • Zarejestrowany: 2016-02-04
  • Posty: 29

Odp: OpenVPN i brak połączenia z Windows 7

Podaję nowe dane:

root@OpenWrt:~# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
delegate_input  all  --  0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP)
target     prot opt source               destination
delegate_forward  all  --  0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
delegate_output  all  --  0.0.0.0/0            0.0.0.0/0

Chain delegate_forward (1 references)
target     prot opt source               destination
forwarding_rule  all  --  0.0.0.0/0            0.0.0.0/0            /* user chain for forwarding */
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
zone_lan_forward  all  --  0.0.0.0/0            0.0.0.0/0
zone_wan_forward  all  --  0.0.0.0/0            0.0.0.0/0
zone_vpn_forward  all  --  0.0.0.0/0            0.0.0.0/0
reject     all  --  0.0.0.0/0            0.0.0.0/0

Chain delegate_input (1 references)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
input_rule  all  --  0.0.0.0/0            0.0.0.0/0            /* user chain for input */
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
syn_flood  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp flags:0x17/0x02
zone_lan_input  all  --  0.0.0.0/0            0.0.0.0/0
zone_wan_input  all  --  0.0.0.0/0            0.0.0.0/0
zone_vpn_input  all  --  0.0.0.0/0            0.0.0.0/0

Chain delegate_output (1 references)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
output_rule  all  --  0.0.0.0/0            0.0.0.0/0            /* user chain for output */
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
zone_lan_output  all  --  0.0.0.0/0            0.0.0.0/0
zone_wan_output  all  --  0.0.0.0/0            0.0.0.0/0
zone_vpn_output  all  --  0.0.0.0/0            0.0.0.0/0

Chain forwarding_lan_rule (1 references)
target     prot opt source               destination

Chain forwarding_rule (1 references)
target     prot opt source               destination

Chain forwarding_vpn_rule (1 references)
target     prot opt source               destination

Chain forwarding_wan_rule (1 references)
target     prot opt source               destination

Chain input_lan_rule (1 references)
target     prot opt source               destination

Chain input_rule (1 references)
target     prot opt source               destination

Chain input_vpn_rule (1 references)
target     prot opt source               destination

Chain input_wan_rule (1 references)
target     prot opt source               destination

Chain output_lan_rule (1 references)
target     prot opt source               destination

Chain output_rule (1 references)
target     prot opt source               destination

Chain output_vpn_rule (1 references)
target     prot opt source               destination

Chain output_wan_rule (1 references)
target     prot opt source               destination

Chain reject (3 references)
target     prot opt source               destination
REJECT     tcp  --  0.0.0.0/0            0.0.0.0/0            reject-with tcp-reset
REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

Chain syn_flood (1 references)
target     prot opt source               destination
RETURN     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp flags:0x17/0x02 limit: avg 25/sec burst 50
DROP       all  --  0.0.0.0/0            0.0.0.0/0

Chain zone_lan_dest_ACCEPT (4 references)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0

Chain zone_lan_forward (1 references)
target     prot opt source               destination
forwarding_lan_rule  all  --  0.0.0.0/0            0.0.0.0/0            /* user chain for forwarding */
zone_wan_dest_ACCEPT  all  --  0.0.0.0/0            0.0.0.0/0            /* forwarding lan -> wan */
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate DNAT /* Accept port forwards */
zone_lan_dest_ACCEPT  all  --  0.0.0.0/0            0.0.0.0/0

Chain zone_lan_input (1 references)
target     prot opt source               destination
input_lan_rule  all  --  0.0.0.0/0            0.0.0.0/0            /* user chain for input */
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate DNAT /* Accept port redirections */
zone_lan_src_ACCEPT  all  --  0.0.0.0/0            0.0.0.0/0

Chain zone_lan_output (1 references)
target     prot opt source               destination
output_lan_rule  all  --  0.0.0.0/0            0.0.0.0/0            /* user chain for output */
zone_lan_dest_ACCEPT  all  --  0.0.0.0/0            0.0.0.0/0

Chain zone_lan_src_ACCEPT (1 references)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0

Chain zone_vpn_dest_ACCEPT (2 references)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0

Chain zone_vpn_forward (1 references)
target     prot opt source               destination
forwarding_vpn_rule  all  --  0.0.0.0/0            0.0.0.0/0            /* user chain for forwarding */
zone_wan_dest_ACCEPT  all  --  0.0.0.0/0            0.0.0.0/0            /* forwarding vpn -> wan */
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate DNAT /* Accept port forwards */
zone_vpn_dest_ACCEPT  all  --  0.0.0.0/0            0.0.0.0/0

Chain zone_vpn_input (1 references)
target     prot opt source               destination
input_vpn_rule  all  --  0.0.0.0/0            0.0.0.0/0            /* user chain for input */
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate DNAT /* Accept port redirections */
zone_vpn_src_ACCEPT  all  --  0.0.0.0/0            0.0.0.0/0

Chain zone_vpn_output (1 references)
target     prot opt source               destination
output_vpn_rule  all  --  0.0.0.0/0            0.0.0.0/0            /* user chain for output */
zone_vpn_dest_ACCEPT  all  --  0.0.0.0/0            0.0.0.0/0

Chain zone_vpn_src_ACCEPT (1 references)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0

Chain zone_wan_dest_ACCEPT (3 references)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0

Chain zone_wan_dest_REJECT (1 references)
target     prot opt source               destination
reject     all  --  0.0.0.0/0            0.0.0.0/0

Chain zone_wan_forward (1 references)
target     prot opt source               destination
forwarding_wan_rule  all  --  0.0.0.0/0            0.0.0.0/0            /* user chain for forwarding */
zone_lan_dest_ACCEPT  esp  --  0.0.0.0/0            0.0.0.0/0            /* @rule[7] */
zone_lan_dest_ACCEPT  udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:500 /* @rule[8] */
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate DNAT /* Accept port forwards */
zone_wan_dest_REJECT  all  --  0.0.0.0/0            0.0.0.0/0

Chain zone_wan_input (1 references)
target     prot opt source               destination
input_wan_rule  all  --  0.0.0.0/0            0.0.0.0/0            /* user chain for input */
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:68 /* Allow-DHCP-Renew */
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 8 /* Allow-Ping */
ACCEPT     2    --  0.0.0.0/0            0.0.0.0/0            /* Allow-IGMP */
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:6022 /* ssh */
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:80 /* gui */
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:1194 /* OpenVPN */
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:1194 /* VPN_wan */
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate DNAT /* Accept port redirections */
zone_wan_src_REJECT  all  --  0.0.0.0/0            0.0.0.0/0

Chain zone_wan_output (1 references)
target     prot opt source               destination
output_wan_rule  all  --  0.0.0.0/0            0.0.0.0/0            /* user chain for output */
zone_wan_dest_ACCEPT  all  --  0.0.0.0/0            0.0.0.0/0

Chain zone_wan_src_REJECT (1 references)
target     prot opt source               destination
reject     all  --  0.0.0.0/0            0.0.0.0/0

Oj, ale jak pisałem wcześniej tak i teraz widać, że port jest otwarty:
1194/udp open|filtered openvpn

8 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,615

Odp: OpenVPN i brak połączenia z Windows 7

iptables -v -L zrób, zobaczysz liczniki na łańcuchach. Po co masz to wpisane dwa razy?

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

9 Odpowiedź przez andrzej99 (edytowany przez andrzej99 2016-02-04 21:28:06)

  • Zarejestrowany: 2016-02-04
  • Posty: 29

Odp: OpenVPN i brak połączenia z Windows 7

Usunąłem powielony wpis.

root@OpenWrt:~# iptables -v -L
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
   58 10523 delegate_input  all  --  any    any     anywhere             anywhere

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
  551 40243 delegate_forward  all  --  any    any     anywhere             anywhere

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
   41  2998 delegate_output  all  --  any    any     anywhere             anywhere

Chain delegate_forward (1 references)
 pkts bytes target     prot opt in     out     source               destination
  551 40243 forwarding_rule  all  --  any    any     anywhere             anywhere             /* user chain for forwarding */
  547 40092 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED
    4   151 zone_lan_forward  all  --  br-lan any     anywhere             anywhere
    0     0 zone_wan_forward  all  --  eth0.2 any     anywhere             anywhere
    0     0 zone_vpn_forward  all  --  tun0   any     anywhere             anywhere
    0     0 reject     all  --  any    any     anywhere             anywhere

Chain delegate_input (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  lo     any     anywhere             anywhere
   58 10523 input_rule  all  --  any    any     anywhere             anywhere             /* user chain for input */
   47  3251 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED
    3   152 syn_flood  tcp  --  any    any     anywhere             anywhere             tcp flags:FIN,SYN,RST,ACK/SYN
    7  5944 zone_lan_input  all  --  br-lan any     anywhere             anywhere
    4  1328 zone_wan_input  all  --  eth0.2 any     anywhere             anywhere
    0     0 zone_vpn_input  all  --  tun0   any     anywhere             anywhere

Chain delegate_output (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  any    lo      anywhere             anywhere
   41  2998 output_rule  all  --  any    any     anywhere             anywhere             /* user chain for output */
   41  2998 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED
    0     0 zone_lan_output  all  --  any    br-lan  anywhere             anywhere
    0     0 zone_wan_output  all  --  any    eth0.2  anywhere             anywhere
    0     0 zone_vpn_output  all  --  any    tun0    anywhere             anywhere

Chain forwarding_lan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain forwarding_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain forwarding_vpn_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain forwarding_wan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain input_lan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain input_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain input_vpn_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain input_wan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain output_lan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain output_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain output_vpn_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain output_wan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain reject (3 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 REJECT     tcp  --  any    any     anywhere             anywhere             reject-with tcp-reset
    0     0 REJECT     all  --  any    any     anywhere             anywhere             reject-with icmp-port-unreachable

Chain syn_flood (1 references)
 pkts bytes target     prot opt in     out     source               destination
    3   152 RETURN     tcp  --  any    any     anywhere             anywhere             tcp flags:FIN,SYN,RST,ACK/SYN limit: avg 25/sec burst 50
    0     0 DROP       all  --  any    any     anywhere             anywhere

Chain zone_lan_dest_ACCEPT (4 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  any    br-lan  anywhere             anywhere

Chain zone_lan_forward (1 references)
 pkts bytes target     prot opt in     out     source               destination
    4   151 forwarding_lan_rule  all  --  any    any     anywhere             anywhere             /* user chain for forwarding */
    4   151 zone_wan_dest_ACCEPT  all  --  any    any     anywhere             anywhere             /* forwarding lan -> wan */
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT /* Accept port forwards */
    0     0 zone_lan_dest_ACCEPT  all  --  any    any     anywhere             anywhere

Chain zone_lan_input (1 references)
 pkts bytes target     prot opt in     out     source               destination
    7  5944 input_lan_rule  all  --  any    any     anywhere             anywhere             /* user chain for input */
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT /* Accept port redirections */
    7  5944 zone_lan_src_ACCEPT  all  --  any    any     anywhere             anywhere

Chain zone_lan_output (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 output_lan_rule  all  --  any    any     anywhere             anywhere             /* user chain for output */
    0     0 zone_lan_dest_ACCEPT  all  --  any    any     anywhere             anywhere

Chain zone_lan_src_ACCEPT (1 references)
 pkts bytes target     prot opt in     out     source               destination
    7  5944 ACCEPT     all  --  br-lan any     anywhere             anywhere

Chain zone_vpn_dest_ACCEPT (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  any    tun0    anywhere             anywhere

Chain zone_vpn_forward (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 forwarding_vpn_rule  all  --  any    any     anywhere             anywhere             /* user chain for forwarding */
    0     0 zone_wan_dest_ACCEPT  all  --  any    any     anywhere             anywhere             /* forwarding vpn -> wan */
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT /* Accept port forwards */
    0     0 zone_vpn_dest_ACCEPT  all  --  any    any     anywhere             anywhere

Chain zone_vpn_input (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 input_vpn_rule  all  --  any    any     anywhere             anywhere             /* user chain for input */
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT /* Accept port redirections */
    0     0 zone_vpn_src_ACCEPT  all  --  any    any     anywhere             anywhere

Chain zone_vpn_output (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 output_vpn_rule  all  --  any    any     anywhere             anywhere             /* user chain for output */
    0     0 zone_vpn_dest_ACCEPT  all  --  any    any     anywhere             anywhere

Chain zone_vpn_src_ACCEPT (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  tun0   any     anywhere             anywhere

Chain zone_wan_dest_ACCEPT (3 references)
 pkts bytes target     prot opt in     out     source               destination
    4   151 ACCEPT     all  --  any    eth0.2  anywhere             anywhere

Chain zone_wan_dest_REJECT (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 reject     all  --  any    eth0.2  anywhere             anywhere

Chain zone_wan_forward (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 forwarding_wan_rule  all  --  any    any     anywhere             anywhere             /* user chain for forwarding */
    0     0 zone_lan_dest_ACCEPT  esp  --  any    any     anywhere             anywhere             /* @rule[7] */
    0     0 zone_lan_dest_ACCEPT  udp  --  any    any     anywhere             anywhere             udp dpt:isakmp /* @rule[8] */
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT /* Accept port forwards */
    0     0 zone_wan_dest_REJECT  all  --  any    any     anywhere             anywhere

Chain zone_wan_input (1 references)
 pkts bytes target     prot opt in     out     source               destination
    4  1328 input_wan_rule  all  --  any    any     anywhere             anywhere             /* user chain for input */
    4  1328 ACCEPT     udp  --  any    any     anywhere             anywhere             udp dpt:bootpc /* Allow-DHCP-Renew */
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp echo-request /* Allow-Ping */
    0     0 ACCEPT     igmp --  any    any     anywhere             anywhere             /* Allow-IGMP */
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:5022 /* ssh */
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:www /* gui */
    0     0 ACCEPT     udp  --  any    any     anywhere             anywhere             udp dpt:openvpn /* OpenVPN */
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT /* Accept port redirections */
    0     0 zone_wan_src_REJECT  all  --  any    any     anywhere             anywhere

Chain zone_wan_output (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 output_wan_rule  all  --  any    any     anywhere             anywhere             /* user chain for output */
    0     0 zone_wan_dest_ACCEPT  all  --  any    any     anywhere             anywhere

Chain zone_wan_src_REJECT (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 reject     all  --  eth0.2 any     anywhere             anywhere

10 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,615

Odp: OpenVPN i brak połączenia z Windows 7

Wykonaj próbę połączenia i patrz na licznik. Na razie masz tam zero, nic w ogóle nie przyszło na wan routera.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

11 Odpowiedź przez andrzej99 (edytowany przez andrzej99 2016-02-05 09:11:19)

  • Zarejestrowany: 2016-02-04
  • Posty: 29

Odp: OpenVPN i brak połączenia z Windows 7

Można się załamać..... problem znalazłem w:

ca c:\Program Files\OpenVPN\certyfikaty\ca.crt
cert c:\Program Files\OpenVPN\certyfikaty\andrzej.crt
key c:\Program Files\OpenVPN\certyfikaty\andrzej.key

Nie ukośnik lewy a prawy ..

12 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,615

Odp: OpenVPN i brak połączenia z Windows 7

Dla windowsa raczej taki - a nie musisz tej ścieżki dać w " - bo tam jest spacja w nazwie katalogu?

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

13 Odpowiedź przez andrzej99 (edytowany przez andrzej99 2016-02-05 11:27:50)

  • Zarejestrowany: 2016-02-04
  • Posty: 29

Odp: OpenVPN i brak połączenia z Windows 7

A więc tak:
1. rzeczywiście nie może być spacji (zapomniałem napisać, że certyfikaty przeniosłem do "prostego" katalogu.
2. Openvpn zaleca, aby było:
c:\\....\\...\\..\ca.crt
Natomiast ,działa też:
c:/..../.../../ca.rt
Mimo "katalogu bez spacji" nie działa:
c:\....\...\..\ca.crt

Po dołożeniu redirect-gateway def1 mam tracert do 8.8.8.8 ale strony www nie ładują się. Trzeba coś jeszcze odblokować ?

14 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,615

Odp: OpenVPN i brak połączenia z Windows 7

dnsów nie masz ustawionych?

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

15 Odpowiedź przez andrzej99

  • Zarejestrowany: 2016-02-04
  • Posty: 29

Odp: OpenVPN i brak połączenia z Windows 7

Ewidentnie teraz to problem dns-ów. Na win7 wszystko dynamicznie. Zmieniałem też ręcznie. Router ma dns-y multimedii.....

16 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,615

Odp: OpenVPN i brak połączenia z Windows 7

Ustaw sobie dnsy na 8.8.8.8 w kompie i zobacz.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

17 Odpowiedź przez andrzej99 (edytowany przez andrzej99 2016-02-05 17:16:15)

  • Zarejestrowany: 2016-02-04
  • Posty: 29

Odp: OpenVPN i brak połączenia z Windows 7

Faktycznie, należy dopisać dns-y na interfejsie wirtualnym.
Dzięki Cezary. Temat do zamknięcia.