Odp: OPENVPN - połączenie sieci
Równie dobrze daj klientom 127.0.0.* a potem sprawdzaj co się dzieje jak nie masz zamiaru posłuchać kolegi wyżej.
Strony Poprzednia 1 2 3
Zaloguj się lub zarejestruj by napisać odpowiedź
Nie jesteś zalogowany. Proszę się zalogować lub zarejestrować.
OPENVPN - połączenie sieci (Strona 3 z 3)
eko.one.pl → Oprogramowanie / Software → OPENVPN - połączenie sieci
Posty: 51 do 62 z 62
51 2016-06-07 11:29:08 (edytowany przez g0f3r 2016-06-07 11:32:51)
- g0f3r
- Użytkownik
- Nieaktywny
Odp: OPENVPN - połączenie sieci
Oczywiście mogę zmienić sieci, jednak wymaga to dość sporo pracy gdyż mam w lokalizacjach sporo urządzeń i ich przekonfigurowanie będzie wymagało czasu.
Pytanie tylko czy to może być faktycznie problemem? Jak wcześniej wspominałem sieć VPN działa. Mnie tylko niepokoją logi wskazujące na cykliczne rozłączanie i podłączanie klientów.
W sieci głównej mam 192.168.00.XXX . W sieciach klienckich zastosować zatem 192.168.1.xxx i 192.168.2.xxx ?
DuDuS
53 2016-06-07 12:04:48 (edytowany przez khain 2016-06-07 12:06:21)
Odp: OPENVPN - połączenie sieci
Wystarczy, że zmienisz w konfigu servera opcje route na prawidłowe. Nie musisz od razu zmieniać adresacji tych podsieci (najwyżej przez jakiś czas klienci vpn nie bedą mieli trasy do tych podsieci), a czy w tym jest problem to Ty nam powiesz.
Logi są potrzebne z klienta, obojętnie już w jakiej formie (tekst, zdjęcie, itp.)
TP-Link TL-WDR3600 v1.5 - OpenWrt Chaos Calmer 15.05.1 with Luci +Microsoft LifeCam VX-3000
RaspberryPi 2 - OMV Stone Burner 2.0.15 +Creative SB Play +Medion OR24V +DVB-T Media-Tech MT4163 +MP00202AC +3xDS18B20 +HIH-4000-002 +MPXHZ6115A +Samsung SPF-85H +D-Link DUB-H7
RaspberryPi 2 - OMV Stone Burner 2.0.15 +Creative SB Play +Medion OR24V +DVB-T Media-Tech MT4163 +MP00202AC +3xDS18B20 +HIH-4000-002 +MPXHZ6115A +Samsung SPF-85H +D-Link DUB-H7
Odp: OPENVPN - połączenie sieci
Ja mam w konfiguracji serwera jak poniżej:
option server '10.8.0.0 255.255.255.0'
list route '192.169.0.0 255.255.255.0'
list route '192.170.0.0 255.255.255.0'
list push 'route 10.8.0.0 255.255.255.0'
list push 'route 192.168.0.0 255.255.255.0'
list push 'route 192.169.0.0 255.255.255.0'
list push 'route 192.170.0.0 255.255.255.0'
Oraz w podkatalogu CCD pliki dla poszczególnych klientów:
Client1:
ifconfig-push 10.8.0.5 10.8.0.6
iroute 192.169.0.0 255.255.255.0
Client2:
ifconfig-push 10.8.0.9 10.8.0.10
iroute 192.170.0.0 255.255.255.0
55 2016-06-07 12:39:21 (edytowany przez khain 2016-06-07 12:41:51)
Odp: OPENVPN - połączenie sieci
To już wiemy dlaczego masz błąd dodania trasy - podwójny wpis w server.conf i w ccd (iroute). I musisz zdecydować czy te podsieci są za serwerem (opcja list push) czy to serwer ma mieć trasy do tych podsieci (opcja list route). Czekam na logi klienta.
TP-Link TL-WDR3600 v1.5 - OpenWrt Chaos Calmer 15.05.1 with Luci +Microsoft LifeCam VX-3000
RaspberryPi 2 - OMV Stone Burner 2.0.15 +Creative SB Play +Medion OR24V +DVB-T Media-Tech MT4163 +MP00202AC +3xDS18B20 +HIH-4000-002 +MPXHZ6115A +Samsung SPF-85H +D-Link DUB-H7
RaspberryPi 2 - OMV Stone Burner 2.0.15 +Creative SB Play +Medion OR24V +DVB-T Media-Tech MT4163 +MP00202AC +3xDS18B20 +HIH-4000-002 +MPXHZ6115A +Samsung SPF-85H +D-Link DUB-H7
56 2016-06-07 21:33:18 (edytowany przez woma1 2016-06-07 21:41:03)
Odp: OPENVPN - połączenie sieci
HIw,
Co za przypadek. Mamy tyle samo postów, po 93:-)
Nie jestem specjalistą od sieci. Zajmuję się rozwiązaniami mobilnymi. Możesz mi przybliżyć różnicę między list push i list route? Ja bym chciał aby wszystkie komputery oraz urządzenia w sieci serwera, clienta1 i clienta2 mogły się wzajemnie widzieć i odwoływać do swoich zasobów. Jak poprawić wyżej cytowane konfiguracje?
Log Client1. Ta sekwencja powtarza się cyklicznie więc nie wysyłam wszystkich kilkunastu tysięcy linii:
Tue Jun 7 22:26:49 2016 [server] Inactivity timeout (--ping-restart), restarting
Tue Jun 7 22:26:49 2016 /sbin/route del -net 192.170.0.0 netmask 255.255.255.0
Tue Jun 7 22:26:49 2016 /sbin/route del -net 192.168.0.0 netmask 255.255.255.0
Tue Jun 7 22:26:49 2016 /sbin/route del -net 10.8.0.0 netmask 255.255.255.0
Tue Jun 7 22:26:49 2016 Closing TUN/TAP interface
Tue Jun 7 22:26:49 2016 /sbin/ifconfig tun0 0.0.0.0
Tue Jun 7 22:26:49 2016 SIGUSR1[soft,ping-restart] received, process restarting
Tue Jun 7 22:26:49 2016 Restart pause, 2 second(s)
Tue Jun 7 22:26:51 2016 WARNING: file '/etc/openvpn/office/client1.key' is group or others accessible
Tue Jun 7 22:26:51 2016 Socket Buffers: R=[163840->131072] S=[163840->131072]
Tue Jun 7 22:26:51 2016 UDPv4 link local (bound): [undef]
Tue Jun 7 22:26:51 2016 UDPv4 link remote: [AF_INET]XXX.XXX.XXX.XXX:1194
Tue Jun 7 22:26:51 2016 TLS: Initial packet from [AF_INET]XXX.XXX.XXX.XXX:1194, sid=21216207 71c94d60
Tue Jun 7 22:26:51 2016 VERIFY OK: depth=1, C=PL, ST=MALOPOLSKA, L=KRAKOW, O=MAYER S.C., OU=changeme, CN=server, name=changeme, emailAddress=mayer@mayer.com.pl
Tue Jun 7 22:26:51 2016 Validating certificate key usage
Tue Jun 7 22:26:51 2016 ++ Certificate has key usage 00a0, expects 00a0
Tue Jun 7 22:26:51 2016 VERIFY KU OK
Tue Jun 7 22:26:51 2016 Validating certificate extended key usage
Tue Jun 7 22:26:51 2016 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Jun 7 22:26:51 2016 VERIFY EKU OK
Tue Jun 7 22:26:51 2016 VERIFY OK: depth=0, C=PL, ST=MALOPOLSKA, L=KRAKOW, O=MAYER S.C., OU=changeme, CN=server, name=changeme, emailAddress=mayer@mayer.com.pl
Tue Jun 7 22:26:52 2016 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jun 7 22:26:52 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jun 7 22:26:52 2016 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jun 7 22:26:52 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jun 7 22:26:52 2016 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Jun 7 22:26:52 2016 [server] Peer Connection Initiated with [AF_INET]XXX.XXX.XXX.XXX:1194
Tue Jun 7 22:26:55 2016 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Tue Jun 7 22:26:55 2016 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,route 192.168.0.0 255.255.255.0,route 192.170.0.0 255.255.255.0,route 10.8.0.0 255.255.255.0,topology net30,ifconfig 10.8.0.5 10.8.0.6'
Tue Jun 7 22:26:55 2016 OPTIONS IMPORT: --ifconfig/up options modified
Tue Jun 7 22:26:55 2016 OPTIONS IMPORT: route options modified
Tue Jun 7 22:26:55 2016 TUN/TAP device tun0 opened
Tue Jun 7 22:26:55 2016 TUN/TAP TX queue length set to 100
Tue Jun 7 22:26:55 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Jun 7 22:26:55 2016 /sbin/ifconfig tun0 10.8.0.5 pointopoint 10.8.0.6 mtu 1500
Tue Jun 7 22:26:55 2016 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.6
Tue Jun 7 22:26:55 2016 /sbin/route add -net 192.168.0.0 netmask 255.255.255.0 gw 10.8.0.6
Tue Jun 7 22:26:55 2016 /sbin/route add -net 192.170.0.0 netmask 255.255.255.0 gw 10.8.0.6
Tue Jun 7 22:26:55 2016 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.6
route: SIOCADDRT: File exists
Tue Jun 7 22:26:55 2016 ERROR: Linux route add command failed: external program exited with error status: 1
Tue Jun 7 22:26:55 2016 Initialization Sequence Completed
Tue Jun 7 22:28:56 2016 [server] Inactivity timeout (--ping-restart), restarting
Tue Jun 7 22:28:56 2016 /sbin/route del -net 192.170.0.0 netmask 255.255.255.0
Tue Jun 7 22:28:56 2016 /sbin/route del -net 192.168.0.0 netmask 255.255.255.0
Tue Jun 7 22:28:56 2016 /sbin/route del -net 10.8.0.0 netmask 255.255.255.0
Tue Jun 7 22:28:56 2016 Closing TUN/TAP interface
Tue Jun 7 22:28:56 2016 /sbin/ifconfig tun0 0.0.0.0
Tue Jun 7 22:28:56 2016 SIGUSR1[soft,ping-restart] received, process restarting
Tue Jun 7 22:28:56 2016 Restart pause, 2 second(s)
Tue Jun 7 22:28:58 2016 WARNING: file '/etc/openvpn/office/client1.key' is group or others accessible
Tue Jun 7 22:28:58 2016 Socket Buffers: R=[163840->131072] S=[163840->131072]
Tue Jun 7 22:28:58 2016 UDPv4 link local (bound): [undef]
Tue Jun 7 22:28:58 2016 UDPv4 link remote: [AF_INET]XXX.XXX.XXX.XXX:1194
Tue Jun 7 22:28:58 2016 TLS: Initial packet from [AF_INET]XXX.XXX.XXX.XXX:1194, sid=b060cd1e cee274e5
Tue Jun 7 22:28:58 2016 VERIFY OK: depth=1, C=PL, ST=MALOPOLSKA, L=KRAKOW, O=MAYER S.C., OU=changeme, CN=server, name=changeme, emailAddress=mayer@mayer.com.pl
Tue Jun 7 22:28:58 2016 Validating certificate key usage
Tue Jun 7 22:28:58 2016 ++ Certificate has key usage 00a0, expects 00a0
Tue Jun 7 22:28:58 2016 VERIFY KU OK
Tue Jun 7 22:28:58 2016 Validating certificate extended key usage
Tue Jun 7 22:28:58 2016 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Jun 7 22:28:58 2016 VERIFY EKU OK
Tue Jun 7 22:28:58 2016 VERIFY OK: depth=0, C=PL, ST=MALOPOLSKA, L=KRAKOW, O=MAYER S.C., OU=changeme, CN=server, name=changeme, emailAddress=mayer@mayer.com.pl
Tue Jun 7 22:28:59 2016 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jun 7 22:28:59 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jun 7 22:28:59 2016 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jun 7 22:28:59 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jun 7 22:28:59 2016 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Jun 7 22:28:59 2016 [server] Peer Connection Initiated with [AF_INET]XXX.XXX.XXX.XXX:1194
Tue Jun 7 22:29:01 2016 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Tue Jun 7 22:29:01 2016 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,route 192.168.0.0 255.255.255.0,route 192.170.0.0 255.255.255.0,route 10.8.0.0 255.255.255.0,topology net30,ifconfig 10.8.0.5 10.8.0.6'
Tue Jun 7 22:29:01 2016 OPTIONS IMPORT: --ifconfig/up options modified
Tue Jun 7 22:29:01 2016 OPTIONS IMPORT: route options modified
Tue Jun 7 22:29:01 2016 TUN/TAP device tun0 opened
Tue Jun 7 22:29:01 2016 TUN/TAP TX queue length set to 100
Tue Jun 7 22:29:01 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Jun 7 22:29:01 2016 /sbin/ifconfig tun0 10.8.0.5 pointopoint 10.8.0.6 mtu 1500
Tue Jun 7 22:29:01 2016 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.6
Tue Jun 7 22:29:01 2016 /sbin/route add -net 192.168.0.0 netmask 255.255.255.0 gw 10.8.0.6
Tue Jun 7 22:29:01 2016 /sbin/route add -net 192.170.0.0 netmask 255.255.255.0 gw 10.8.0.6
Tue Jun 7 22:29:01 2016 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.6
route: SIOCADDRT: File exists
Tue Jun 7 22:29:01 2016 ERROR: Linux route add command failed: external program exited with error status: 1
Tue Jun 7 22:29:01 2016 Initialization Sequence Completed
Tue Jun 7 22:31:01 2016 [server] Inactivity timeout (--ping-restart), restarting
Tue Jun 7 22:31:01 2016 /sbin/route del -net 192.170.0.0 netmask 255.255.255.0
Tue Jun 7 22:31:01 2016 /sbin/route del -net 192.168.0.0 netmask 255.255.255.0
Tue Jun 7 22:31:01 2016 /sbin/route del -net 10.8.0.0 netmask 255.255.255.0
Tue Jun 7 22:31:01 2016 Closing TUN/TAP interface
Tue Jun 7 22:31:01 2016 /sbin/ifconfig tun0 0.0.0.0
Tue Jun 7 22:31:01 2016 SIGUSR1[soft,ping-restart] received, process restarting
Tue Jun 7 22:31:01 2016 Restart pause, 2 second(s)
Tue Jun 7 22:31:03 2016 WARNING: file '/etc/openvpn/office/client1.key' is group or others accessible
Tue Jun 7 22:31:03 2016 Socket Buffers: R=[163840->131072] S=[163840->131072]
Tue Jun 7 22:31:03 2016 UDPv4 link local (bound): [undef]
Tue Jun 7 22:31:03 2016 UDPv4 link remote: [AF_INET]XXX.XXX.XXX.XXX:1194
Tue Jun 7 22:31:03 2016 TLS: Initial packet from [AF_INET]XXX.XXX.XXX.XXX:1194, sid=e6198c5c 622610d4
Tue Jun 7 22:31:03 2016 VERIFY OK: depth=1, C=PL, ST=MALOPOLSKA, L=KRAKOW, O=MAYER S.C., OU=changeme, CN=server, name=changeme, emailAddress=mayer@mayer.com.pl
Tue Jun 7 22:31:03 2016 Validating certificate key usage
Tue Jun 7 22:31:03 2016 ++ Certificate has key usage 00a0, expects 00a0
Tue Jun 7 22:31:03 2016 VERIFY KU OK
Tue Jun 7 22:31:03 2016 Validating certificate extended key usage
Tue Jun 7 22:31:03 2016 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Jun 7 22:31:03 2016 VERIFY EKU OK
Tue Jun 7 22:31:03 2016 VERIFY OK: depth=0, C=PL, ST=MALOPOLSKA, L=KRAKOW, O=MAYER S.C., OU=changeme, CN=server, name=changeme, emailAddress=mayer@mayer.com.pl
Tue Jun 7 22:31:04 2016 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jun 7 22:31:04 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jun 7 22:31:04 2016 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jun 7 22:31:04 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jun 7 22:31:04 2016 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Jun 7 22:31:04 2016 [server] Peer Connection Initiated with [AF_INET]XXX.XXX.XXX.XXX:1194
Tue Jun 7 22:31:06 2016 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Tue Jun 7 22:31:06 2016 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,route 192.168.0.0 255.255.255.0,route 192.170.0.0 255.255.255.0,route 10.8.0.0 255.255.255.0,topology net30,ifconfig 10.8.0.5 10.8.0.6'
Tue Jun 7 22:31:06 2016 OPTIONS IMPORT: --ifconfig/up options modified
Tue Jun 7 22:31:06 2016 OPTIONS IMPORT: route options modified
Tue Jun 7 22:31:06 2016 TUN/TAP device tun0 opened
Tue Jun 7 22:31:06 2016 TUN/TAP TX queue length set to 100
Tue Jun 7 22:31:06 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Jun 7 22:31:06 2016 /sbin/ifconfig tun0 10.8.0.5 pointopoint 10.8.0.6 mtu 1500
Tue Jun 7 22:31:06 2016 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.6
Tue Jun 7 22:31:06 2016 /sbin/route add -net 192.168.0.0 netmask 255.255.255.0 gw 10.8.0.6
Tue Jun 7 22:31:06 2016 /sbin/route add -net 192.170.0.0 netmask 255.255.255.0 gw 10.8.0.6
Tue Jun 7 22:31:06 2016 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.6
route: SIOCADDRT: File exists
Tue Jun 7 22:31:06 2016 ERROR: Linux route add command failed: external program exited with error status: 1
Tue Jun 7 22:31:06 2016 Initialization Sequence Completed
Odp: OPENVPN - połączenie sieci
Wstaw opcję do konfigu serwera
keepalive 25 180 Dzięki temu klienci będą sprawdzać co 25 sekund czy serwer odpowiada(pingiem). Jeśli serwer nie odpowie w czasie 180 sekund to nastąpi ponowna próba połączenia klienta do serwera. Być może trzeba zmienić te wartości, jeśli nadal będą problemy z rozłączaniem.
Prawidłowa składnia opcji push (na przykładzie route) powinna wyglądać następująco
push "route 192.168.10.0 255.255.255.0 10.8.0.1"Dodaje do tablicy routingu KLIENTA (choć sam wpis robi się w konfigu serwera), że jeśli pakiet ma dotrzeć do podsieci 192.168.10.0 (podsieć za SERWEREM) to musi wyjść przez IP 10.8.0.1 (adres IP serwera w tunelu openvpn - ustawiany za pomocą opcji ifconfig w konfigu serwera).
Prawidłowa składnia opcji route powinna wyglądać następująco:
route 192.168.20.0 255.255.255.0 10.8.0.5Dodaje do tablicy routingu SERWERA (opcja również wpisywana jest w konfigu serwera), że jeśli pakiet ma dotrzeć do podsieci 192.168.20.0 (podsieć za KLIENTEM) to musi wyjść przez IP 10.8.0.5 (adres IP klienta w tunelu openvpn - ustawiany za pomocą opcji ifconfig-push w ccd w konfigu serwera). Musisz ustalić gdzie znajdują się podsieci, które masz (za serwerem czy za klientem) i usunąć zbędne opcje.
Ps.
Opcja ifconfig-push powinna wyglądać następująco
ifconfig-push 10.8.0.5 255.255.255.0TP-Link TL-WDR3600 v1.5 - OpenWrt Chaos Calmer 15.05.1 with Luci +Microsoft LifeCam VX-3000
RaspberryPi 2 - OMV Stone Burner 2.0.15 +Creative SB Play +Medion OR24V +DVB-T Media-Tech MT4163 +MP00202AC +3xDS18B20 +HIH-4000-002 +MPXHZ6115A +Samsung SPF-85H +D-Link DUB-H7
RaspberryPi 2 - OMV Stone Burner 2.0.15 +Creative SB Play +Medion OR24V +DVB-T Media-Tech MT4163 +MP00202AC +3xDS18B20 +HIH-4000-002 +MPXHZ6115A +Samsung SPF-85H +D-Link DUB-H7
Odp: OPENVPN - połączenie sieci
HI
A co z iroute w CCD.
U mnie wygląda to tak, że podsieć za sewerem to 192.168.0.0, za clientem1 to 192.169.0.0 a za clientem2 to 192.170.0.0.
Jeśli to nie będzie zbyt wielki kłopot, to napisz mi proszę co wpisać (oczywiście tylko w kwestii routingu i adresacji) w pliku konfiguracji OPENVPON serwera oraz CCD serwera. Jeśli trzeba coś dodać w pliku konfiguracji OPENVPN klienta to też bardzo proszę o info. Nie chcę błądzić,a nie bardzo się znam na konfiguracji i topologii sieci komputerowych. I tak już walczyłem dość długo żeby zestawić działające VPN. Będę wdzięczny za szczegółowe informacje.
DuDuS
Odp: OPENVPN - połączenie sieci
To się nazywa lenistwo, bo masz podane wszystko na tacy. Cezary napisałby coś w stylu "skonfiguruj i masz", ale że nie mam co robić w pracy.... Opcja iroute robi to samo co route, ale tylko wtedy kiedy dany klient jest podłączony.
Do konfigu serwera dodaj
option keepalive '25 180'
option ifconfig '10.8.0.1 255.255.255.0'Wywal wszystkie wpisy list push i list route oprócz
list push 'route 192.168.0.0 255.255.255.0 10.8.0.1'Plik /ccd/client1
ifconfig-push 10.8.0.2 255.255.255.0
iroute 192.169.0.0 255.255.255.0Plik /ccd/client2
ifconfig-push 10.8.0.3 255.255.255.0
iroute 192.170.0.0 255.255.255.0TP-Link TL-WDR3600 v1.5 - OpenWrt Chaos Calmer 15.05.1 with Luci +Microsoft LifeCam VX-3000
RaspberryPi 2 - OMV Stone Burner 2.0.15 +Creative SB Play +Medion OR24V +DVB-T Media-Tech MT4163 +MP00202AC +3xDS18B20 +HIH-4000-002 +MPXHZ6115A +Samsung SPF-85H +D-Link DUB-H7
RaspberryPi 2 - OMV Stone Burner 2.0.15 +Creative SB Play +Medion OR24V +DVB-T Media-Tech MT4163 +MP00202AC +3xDS18B20 +HIH-4000-002 +MPXHZ6115A +Samsung SPF-85H +D-Link DUB-H7
Odp: OPENVPN - połączenie sieci
HI
Wprowadzone zmiany spowodowały że klienci się nie łączą.
STARA KONFIGURACJA SERWERA I CCD, DZIAŁA
OPENVPN
config openvpn 'office'
option port '1194'
option proto 'udp'
option dev 'tun0'
option ca '/etc/openvpn/mayer/ca.crt'
option cert '/etc/openvpn/mayer/server.crt'
option key '/etc/openvpn/mayer/server.key'
option dh '/etc/openvpn/mayer/dh1024.pem'
option server '10.8.0.0 255.255.255.0'
option log '/tmp/openvpn-log.log'
option verb '3'
list route '192.169.0.0 255.255.255.0'
list route '192.170.0.0 255.255.255.0'
list push 'route 10.8.0.0 255.255.255.0'
list push 'route 192.168.0.0 255.255.255.0'
list push 'route 192.169.0.0 255.255.255.0'
list push 'route 192.170.0.0 255.255.255.0'
option client_to_client '1'
option client_config_dir /etc/openvpn/ccd
#option ccd_exclusive
option enabled '1'
CCD/CLIENT1
ifconfig-push 10.8.0.5 10.8.0.6
iroute 192.169.0.0 255.255.255.0
CCD/CLIENT2
ifconfig-push 10.8.0.9 10.8.0.10
iroute 192.170.0.0 255.255.255.0
NOWA KONFIGURACJA SERWERA I CCD, NIE DZIAŁA
OPENVPN
config openvpn 'office'
option port '1194'
option proto 'udp'
option dev 'tun0'
option ca '/etc/openvpn/mayer/ca.crt'
option cert '/etc/openvpn/mayer/server.crt'
option key '/etc/openvpn/mayer/server.key'
option dh '/etc/openvpn/mayer/dh1024.pem'
option server '10.8.0.0 255.255.255.0'
option log '/tmp/openvpn-log.log'
option verb '3'
list push 'route 192.168.0.0 255.255.255.0 10.8.0.1'
option ifconfig '10.8.0.1 255.255.255.0'
option client_to_client '1'
option client_config_dir '/etc/openvpn/ccd'
option keepalive '30 120'
option enabled '1'
CCD/CLIENT1
ifconfig-push 10.8.0.2 255.255.255.0
iroute 192.169.0.0 255.255.255.0
CCD/CLIENT2
ifconfig-push 10.8.0.3 255.255.255.0
iroute 192.170.0.0 255.255.255.0
DuDuS
61 2016-06-08 10:00:42 (edytowany przez woma1 2016-06-08 10:05:59)
Odp: OPENVPN - połączenie sieci
LOG SERWERA
Wed Jun 8 10:55:11 2016 OpenVPN 2.3.6 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jul 25 2015
Wed Jun 8 10:55:11 2016 library versions: OpenSSL 1.0.2d 9 Jul 2015, LZO 2.08
Wed Jun 8 10:55:11 2016 Diffie-Hellman initialized with 1024 bit key
Wed Jun 8 10:55:11 2016 WARNING: file '/etc/openvpn/mayer/server.key' is group or others accessible
Wed Jun 8 10:55:12 2016 Socket Buffers: R=[163840->131072] S=[163840->131072]
Wed Jun 8 10:55:12 2016 TUN/TAP device tun0 opened
Wed Jun 8 10:55:12 2016 TUN/TAP TX queue length set to 100
Wed Jun 8 10:55:12 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Jun 8 10:55:12 2016 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Wed Jun 8 10:55:12 2016 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Wed Jun 8 10:55:12 2016 UDPv4 link local (bound): [undef]
Wed Jun 8 10:55:12 2016 UDPv4 link remote: [undef]
Wed Jun 8 10:55:12 2016 MULTI: multi_init called, r=256 v=256
Wed Jun 8 10:55:12 2016 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Wed Jun 8 10:55:12 2016 Initialization Sequence Completed
Wed Jun 8 10:58:43 2016 ZZZ.ZZZ.ZZZ.ZZZ:1194 TLS: Initial packet from [AF_INET]ZZZ.ZZZ.ZZZ.ZZZ:1194, sid=b94a16df 6b8f82c9
Wed Jun 8 10:58:44 2016 ZZZ.ZZZ.ZZZ.ZZZ:1194 VERIFY OK: depth=1, C=PL, ST=MALOPOLSKA, L=KRAKOW, O=MAYER S.C., OU=changeme, CN=server, name=changeme, emailAddress=mayer@mayer.com.pl
Wed Jun 8 10:58:44 2016 ZZZ.ZZZ.ZZZ.ZZZ:1194 VERIFY OK: depth=0, C=PL, ST=MALOPOLSKA, L=KRAKOW, O=MAYER S.C., OU=changeme, CN=client1, name=changeme, emailAddress=mayer@mayer.com.pl
Wed Jun 8 10:58:44 2016 ZZZ.ZZZ.ZZZ.ZZZ:1194 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Jun 8 10:58:44 2016 ZZZ.ZZZ.ZZZ.ZZZ:1194 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jun 8 10:58:44 2016 ZZZ.ZZZ.ZZZ.ZZZ:1194 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Jun 8 10:58:44 2016 ZZZ.ZZZ.ZZZ.ZZZ:1194 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jun 8 10:58:44 2016 ZZZ.ZZZ.ZZZ.ZZZ:1194 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Jun 8 10:58:44 2016 ZZZ.ZZZ.ZZZ.ZZZ:1194 [client1] Peer Connection Initiated with [AF_INET]ZZZ.ZZZ.ZZZ.ZZZ:1194
Wed Jun 8 10:58:44 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/client1
Wed Jun 8 10:58:44 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 MULTI: Learn: 10.8.0.2 -> client1/ZZZ.ZZZ.ZZZ.ZZZ:1194
Wed Jun 8 10:58:44 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 MULTI: primary virtual IP for client1/ZZZ.ZZZ.ZZZ.ZZZ:1194: 10.8.0.2
Wed Jun 8 10:58:44 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 MULTI: internal route 192.169.0.0/24 -> client1/ZZZ.ZZZ.ZZZ.ZZZ:1194
Wed Jun 8 10:58:44 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 MULTI: Learn: 192.169.0.0/24 -> client1/ZZZ.ZZZ.ZZZ.ZZZ:1194
Wed Jun 8 10:58:46 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 PUSH: Received control message: 'PUSH_REQUEST'
Wed Jun 8 10:58:46 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 send_push_reply(): safe_cap=940
Wed Jun 8 10:58:46 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 SENT CONTROL [client1]: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0 10.8.0.1,route 10.8.0.0 255.255.255.0,topology net30,ping 30,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0' (status=1)
Wed Jun 8 11:02:46 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 [client1] Inactivity timeout (--ping-restart), restarting
Wed Jun 8 11:02:46 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 SIGUSR1[soft,ping-restart] received, client-instance restarting
Wed Jun 8 11:03:33 2016 ZZZ.ZZZ.ZZZ.ZZZ:1194 TLS: Initial packet from [AF_INET]ZZZ.ZZZ.ZZZ.ZZZ:1194, sid=f604a510 ebfe69c6
Wed Jun 8 11:03:34 2016 ZZZ.ZZZ.ZZZ.ZZZ:1194 VERIFY OK: depth=1, C=PL, ST=MALOPOLSKA, L=KRAKOW, O=MAYER S.C., OU=changeme, CN=server, name=changeme, emailAddress=mayer@mayer.com.pl
Wed Jun 8 11:03:34 2016 ZZZ.ZZZ.ZZZ.ZZZ:1194 VERIFY OK: depth=0, C=PL, ST=MALOPOLSKA, L=KRAKOW, O=MAYER S.C., OU=changeme, CN=client1, name=changeme, emailAddress=mayer@mayer.com.pl
Wed Jun 8 11:03:34 2016 ZZZ.ZZZ.ZZZ.ZZZ:1194 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Jun 8 11:03:34 2016 ZZZ.ZZZ.ZZZ.ZZZ:1194 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jun 8 11:03:34 2016 ZZZ.ZZZ.ZZZ.ZZZ:1194 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Jun 8 11:03:34 2016 ZZZ.ZZZ.ZZZ.ZZZ:1194 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jun 8 11:03:34 2016 ZZZ.ZZZ.ZZZ.ZZZ:1194 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Jun 8 11:03:34 2016 ZZZ.ZZZ.ZZZ.ZZZ:1194 [client1] Peer Connection Initiated with [AF_INET]ZZZ.ZZZ.ZZZ.ZZZ:1194
Wed Jun 8 11:03:34 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/client1
Wed Jun 8 11:03:34 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 MULTI: Learn: 10.8.0.2 -> client1/ZZZ.ZZZ.ZZZ.ZZZ:1194
Wed Jun 8 11:03:34 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 MULTI: primary virtual IP for client1/ZZZ.ZZZ.ZZZ.ZZZ:1194: 10.8.0.2
Wed Jun 8 11:03:34 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 MULTI: internal route 192.169.0.0/24 -> client1/ZZZ.ZZZ.ZZZ.ZZZ:1194
Wed Jun 8 11:03:34 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 MULTI: Learn: 192.169.0.0/24 -> client1/ZZZ.ZZZ.ZZZ.ZZZ:1194
Wed Jun 8 11:03:36 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 PUSH: Received control message: 'PUSH_REQUEST'
Wed Jun 8 11:03:36 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 send_push_reply(): safe_cap=940
Wed Jun 8 11:03:36 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 SENT CONTROL [client1]: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0 10.8.0.1,route 10.8.0.0 255.255.255.0,topology net30,ping 30,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0' (status=1)
Wed Jun 8 11:03:52 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 TLS: new session incoming connection from [AF_INET]ZZZ.ZZZ.ZZZ.ZZZ:1194
Wed Jun 8 11:03:53 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 VERIFY OK: depth=1, C=PL, ST=MALOPOLSKA, L=KRAKOW, O=MAYER S.C., OU=changeme, CN=server, name=changeme, emailAddress=mayer@mayer.com.pl
Wed Jun 8 11:03:53 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 VERIFY OK: depth=0, C=PL, ST=MALOPOLSKA, L=KRAKOW, O=MAYER S.C., OU=changeme, CN=client1, name=changeme, emailAddress=mayer@mayer.com.pl
Wed Jun 8 11:03:53 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Jun 8 11:03:53 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jun 8 11:03:53 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Jun 8 11:03:53 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jun 8 11:03:53 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Wed Jun 8 11:03:53 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 TLS: tls_multi_process: untrusted session promoted to trusted
Wed Jun 8 11:03:53 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Jun 8 11:03:55 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 PUSH: Received control message: 'PUSH_REQUEST'
Wed Jun 8 11:04:01 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 PUSH: Received control message: 'PUSH_REQUEST'
Wed Jun 8 11:04:06 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 PUSH: Received control message: 'PUSH_REQUEST'
Wed Jun 8 11:04:06 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 send_push_reply(): safe_cap=940
Wed Jun 8 11:04:06 2016 client1/ZZZ.ZZZ.ZZZ.ZZZ:1194 SENT CONTROL [client1]: 'PUSH_REPLY,route 192.168.0.0 255.255.255.0 10.8.0.1,route 10.8.0.0 255.255.255.0,topology net30,ping 30,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0' (status=1)
Odp: OPENVPN - połączenie sieci
HI
Wróciłem do starej konfiguracji i dodałem tylko po obu stronach parametr:
option keepalive '30 120'
Wszystko ponownie działa i z logu klienta zniknęły wpisy o cyklicznym rozłączaniu i podłączaniu, co stanowło sedno całej sprawy i problemu.
Dzięki za pomoc.
DuDuS
Posty: 51 do 62 z 62
Strony Poprzednia 1 2 3
Zaloguj się lub zarejestruj by napisać odpowiedź
eko.one.pl → Oprogramowanie / Software → OPENVPN - połączenie sieci
Forum oparte o PunBB, wspierane przez Informer Technologies, Inc