1

Temat: VPN PPTP brak gui na kliencie

Witam
Mam serwer VPN na routerze z Tomato na protokole PPTP.
Podłączyłem się zdalnie routerem z OpenWRT jako klient do tego serwera i teraz z komputera (w sieci za routerem z Tomato) mam dostęp do klienta poprzez SSH ale nie mogę dostać się do gui (LuCI) przez www.

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd35:8d7c:5092::/48'

config interface 'lan'
        option ifname 'eth0'
        option force_link '1'
        option type 'bridge'
        option proto 'dhcp'
        option ipaddr '192.168.0.54'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'VPN'
        option proto 'pptp'
        option password 'xxxxx'
        option username 'radar1'
        option buffering '1'
        option server 'xxx.xxx.x.x'
        option peerdns '0'
        option defaultroute '0'
        option delegate '0'

config interface 'wwan'
        option proto 'dhcp'
        option _orig_ifname 'wlan0'
        option _orig_bridge 'true'

config route
        option interface 'VPN'
        option target '192.168.0.0'
        option netmask '255.255.255.0'

2

Odp: VPN PPTP brak gui na kliencie

Otwórz port 80 na interfejsie VPN, tak samo jak dla 22 zrobiłeś?

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

3

Odp: VPN PPTP brak gui na kliencie

Nie otwierałem portu 22.
Po otwarciu portu 80 dalej nie mogę dostać się do gui.

4

Odp: VPN PPTP brak gui na kliencie

Pokaż wyniki poleceń:

netstat -apn
uci show firewall
iptables -v -L

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

5

Odp: VPN PPTP brak gui na kliencie

root@OpenWrt:~# netstat -apn
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      999/uhttpd
tcp        0      0 0.0.0.0:53              0.0.0.0:*               LISTEN      1151/dnsmasq
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      960/dropbear
tcp        0   3573 192.168.0.101:22        192.168.0.38:62674      LAST_ACK    -
tcp        0    300 192.168.43.189:22       192.168.43.51:62816     ESTABLISHED 1736/dropbear
tcp        0      0 192.168.43.189:58419    83.9.164.233:1723       ESTABLISHED 1326/pppd
tcp        0   3677 192.168.0.101:22        192.168.0.38:62691      LAST_ACK    -
tcp        0      0 :::80                   :::*                    LISTEN      999/uhttpd
tcp        0      0 :::53                   :::*                    LISTEN      1151/dnsmasq
tcp        0      0 :::22                   :::*                    LISTEN      960/dropbear
udp        0      0 0.0.0.0:53              0.0.0.0:*                           1151/dnsmasq
udp        0      0 :::53                   :::*                                1151/dnsmasq
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags       Type       State         I-Node PID/Program name    Path
unix  2      [ ACC ]     STREAM     LISTENING        279 498/ubusd           /var/run/ubus.sock
unix  7      [ ]         DGRAM                      1076 873/logd            /dev/log
unix  2      [ ACC ]     STREAM     LISTENING       3810 1326/pppd           /var/run/pptp/83.9.164.233:1
unix  2      [ ]         DGRAM                      2031 1202/wpa_supplicant /var/run/wpa_supplicant/wlan0
unix  3      [ ]         STREAM     CONNECTED        304 498/ubusd           /var/run/ubus.sock
unix  3      [ ]         STREAM     CONNECTED        303 1/procd
unix  2      [ ]         DGRAM                      1866 1151/dnsmasq
unix  3      [ ]         STREAM     CONNECTED       1078 873/logd
unix  3      [ ]         STREAM     CONNECTED       1159 498/ubusd           /var/run/ubus.sock
unix  3      [ ]         STREAM     CONNECTED       3922 1326/pppd           /var/run/pptp/83.9.164.233:1
unix  3      [ ]         STREAM     CONNECTED       1158 915/netifd
unix  3      [ ]         STREAM     CONNECTED       1079 498/ubusd           /var/run/ubus.sock
unix  3      [ ]         STREAM     CONNECTED       1429 999/uhttpd
unix  2      [ ]         DGRAM                      1231 960/dropbear
unix  2      [ ]         DGRAM                      1469 915/netifd
unix  2      [ ]         DGRAM                      1509 915/netifd
unix  2      [ ]         DGRAM                      3765 1324/pppd
unix  3      [ ]         STREAM     CONNECTED       1430 498/ubusd           /var/run/ubus.sock
unix  3      [ ]         STREAM     CONNECTED       1095 882/rpcd
unix  2      [ ]         DGRAM                      1170 1/procd
unix  3      [ ]         STREAM     CONNECTED       3772 1324/pppd
unix  3      [ ]         STREAM     CONNECTED       1096 498/ubusd           /var/run/ubus.sock
root@OpenWrt:~# uci show firewall
firewall.@defaults[0]=defaults
firewall.@defaults[0].syn_flood='1'
firewall.@defaults[0].input='ACCEPT'
firewall.@defaults[0].output='ACCEPT'
firewall.@defaults[0].forward='ACCEPT'
firewall.@zone[0]=zone
firewall.@zone[0].name='lan'
firewall.@zone[0].input='ACCEPT'
firewall.@zone[0].output='ACCEPT'
firewall.@zone[0].forward='ACCEPT'
firewall.@zone[0].network='lan'
firewall.@zone[1]=zone
firewall.@zone[1].name='wan'
firewall.@zone[1].input='ACCEPT'
firewall.@zone[1].output='ACCEPT'
firewall.@zone[1].forward='ACCEPT'
firewall.@zone[1].masq='1'
firewall.@zone[1].mtu_fix='1'
firewall.@zone[1].network='wan wan6 wwan'
firewall.@rule[0]=rule
firewall.@rule[0].name='Allow-DHCP-Renew'
firewall.@rule[0].src='wan'
firewall.@rule[0].proto='udp'
firewall.@rule[0].dest_port='68'
firewall.@rule[0].target='ACCEPT'
firewall.@rule[0].family='ipv4'
firewall.@rule[1]=rule
firewall.@rule[1].name='Allow-Ping'
firewall.@rule[1].src='wan'
firewall.@rule[1].proto='icmp'
firewall.@rule[1].icmp_type='echo-request'
firewall.@rule[1].family='ipv4'
firewall.@rule[1].target='ACCEPT'
firewall.@rule[2]=rule
firewall.@rule[2].name='Allow-IGMP'
firewall.@rule[2].src='wan'
firewall.@rule[2].proto='igmp'
firewall.@rule[2].family='ipv4'
firewall.@rule[2].target='ACCEPT'
firewall.@rule[3]=rule
firewall.@rule[3].name='Allow-DHCPv6'
firewall.@rule[3].src='wan'
firewall.@rule[3].proto='udp'
firewall.@rule[3].src_ip='fe80::/10'
firewall.@rule[3].src_port='547'
firewall.@rule[3].dest_ip='fe80::/10'
firewall.@rule[3].dest_port='546'
firewall.@rule[3].family='ipv6'
firewall.@rule[3].target='ACCEPT'
firewall.@rule[4]=rule
firewall.@rule[4].name='Allow-MLD'
firewall.@rule[4].src='wan'
firewall.@rule[4].proto='icmp'
firewall.@rule[4].src_ip='fe80::/10'
firewall.@rule[4].icmp_type='130/0' '131/0' '132/0' '143/0'
firewall.@rule[4].family='ipv6'
firewall.@rule[4].target='ACCEPT'
firewall.@rule[5]=rule
firewall.@rule[5].name='Allow-ICMPv6-Input'
firewall.@rule[5].src='wan'
firewall.@rule[5].proto='icmp'
firewall.@rule[5].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type' 'router-solicitation' 'neighbour-solicitation' 'router-advertisement' 'neighbour-advertisement'
firewall.@rule[5].limit='1000/sec'
firewall.@rule[5].family='ipv6'
firewall.@rule[5].target='ACCEPT'
firewall.@rule[6]=rule
firewall.@rule[6].name='Allow-ICMPv6-Forward'
firewall.@rule[6].src='wan'
firewall.@rule[6].dest='*'
firewall.@rule[6].proto='icmp'
firewall.@rule[6].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type'
firewall.@rule[6].limit='1000/sec'
firewall.@rule[6].family='ipv6'
firewall.@rule[6].target='ACCEPT'
firewall.@include[0]=include
firewall.@include[0].path='/etc/firewall.user'
firewall.@rule[7]=rule
firewall.@rule[7].src='wan'
firewall.@rule[7].dest='lan'
firewall.@rule[7].proto='esp'
firewall.@rule[7].target='ACCEPT'
firewall.@rule[8]=rule
firewall.@rule[8].src='wan'
firewall.@rule[8].dest='lan'
firewall.@rule[8].dest_port='500'
firewall.@rule[8].proto='udp'
firewall.@rule[8].target='ACCEPT'
firewall.@zone[2]=zone
firewall.@zone[2].input='ACCEPT'
firewall.@zone[2].forward='ACCEPT'
firewall.@zone[2].output='ACCEPT'
firewall.@zone[2].name='vpnZone'
firewall.@zone[2].network='VPN'
firewall.@zone[2].mtu_fix='1'
firewall.@zone[2].log='1'
firewall.@zone[2].log_limit='60'
firewall.@forwarding[0]=forwarding
firewall.@forwarding[0].dest='wan'
firewall.@forwarding[0].src='lan'
firewall.@rule[9]=rule
firewall.@rule[9].enabled='1'
firewall.@rule[9].target='ACCEPT'
firewall.@rule[9].proto='tcp'
firewall.@rule[9].dest_port='80'
firewall.@rule[9].name='HTTP'
firewall.@rule[9].src='*'
firewall.@forwarding[1]=forwarding
firewall.@forwarding[1].dest='lan'
firewall.@forwarding[1].src='vpnZone'
firewall.@forwarding[2]=forwarding
firewall.@forwarding[2].dest='wan'
firewall.@forwarding[2].src='vpnZone'
firewall.@forwarding[3]=forwarding
firewall.@forwarding[3].dest='vpnZone'
firewall.@forwarding[3].src='lan'
firewall.@forwarding[4]=forwarding
firewall.@forwarding[4].dest='vpnZone'
firewall.@forwarding[4].src='wan'
firewall.@redirect[0]=redirect
firewall.@redirect[0].target='DNAT'
firewall.@redirect[0].src='vpnZone'
firewall.@redirect[0].dest='vpnZone'
firewall.@redirect[0].proto='tcp'
firewall.@redirect[0].src_dport='80'
firewall.@redirect[0].dest_port='80'
firewall.@redirect[0].name='HTTP'
root@OpenWrt:~# iptables -v -L
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    4   272 delegate_input  all  --  any    any     anywhere             anywhere

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 delegate_forward  all  --  any    any     anywhere             anywhere

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    3   188 delegate_output  all  --  any    any     anywhere             anywhere

Chain delegate_forward (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 forwarding_rule  all  --  any    any     anywhere             anywhere             /* user chain for forwarding */
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED
    0     0 zone_lan_forward  all  --  br-lan any     anywhere             anywhere
    0     0 zone_wan_forward  all  --  wlan0  any     anywhere             anywhere
    0     0 zone_vpnZone_forward  all  --  pptp-VPN any     anywhere             anywhere

Chain delegate_input (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  lo     any     anywhere             anywhere
    4   272 input_rule  all  --  any    any     anywhere             anywhere             /* user chain for input */
    3   224 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED
    0     0 syn_flood  tcp  --  any    any     anywhere             anywhere             tcp flags:FIN,SYN,RST,ACK/SYN
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:www /* HTTP */
    0     0 zone_lan_input  all  --  br-lan any     anywhere             anywhere
    1    48 zone_wan_input  all  --  wlan0  any     anywhere             anywhere
    0     0 zone_vpnZone_input  all  --  pptp-VPN any     anywhere             anywhere

Chain delegate_output (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  any    lo      anywhere             anywhere
    3   188 output_rule  all  --  any    any     anywhere             anywhere             /* user chain for output */
    2   144 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED
    0     0 zone_lan_output  all  --  any    br-lan  anywhere             anywhere
    1    44 zone_wan_output  all  --  any    wlan0   anywhere             anywhere
    0     0 zone_vpnZone_output  all  --  any    pptp-VPN  anywhere             anywhere

Chain forwarding_lan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain forwarding_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain forwarding_vpnZone_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain forwarding_wan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain input_lan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain input_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain input_vpnZone_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain input_wan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain output_lan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain output_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain output_vpnZone_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain output_wan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain reject (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 REJECT     tcp  --  any    any     anywhere             anywhere             reject-with tcp-reset
    0     0 REJECT     all  --  any    any     anywhere             anywhere             reject-with icmp-port-unreachable

Chain syn_flood (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 RETURN     tcp  --  any    any     anywhere             anywhere             tcp flags:FIN,SYN,RST,ACK/SYN limit: avg 25/sec burst 50
    0     0 DROP       all  --  any    any     anywhere             anywhere

Chain zone_lan_dest_ACCEPT (5 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  any    br-lan  anywhere             anywhere

Chain zone_lan_forward (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 forwarding_lan_rule  all  --  any    any     anywhere             anywhere             /* user chain for forwarding */
    0     0 zone_wan_dest_ACCEPT  all  --  any    any     anywhere             anywhere             /* forwarding lan -> wan */
    0     0 zone_vpnZone_dest_ACCEPT  all  --  any    any     anywhere             anywhere             /* forwarding lan -> vpnZone */
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT /* Accept port forwards */
    0     0 zone_lan_dest_ACCEPT  all  --  any    any     anywhere             anywhere

Chain zone_lan_input (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 input_lan_rule  all  --  any    any     anywhere             anywhere             /* user chain for input */
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT /* Accept port redirections */
    0     0 zone_lan_src_ACCEPT  all  --  any    any     anywhere             anywhere

Chain zone_lan_output (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 output_lan_rule  all  --  any    any     anywhere             anywhere             /* user chain for output */
    0     0 zone_lan_dest_ACCEPT  all  --  any    any     anywhere             anywhere

Chain zone_lan_src_ACCEPT (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  br-lan any     anywhere             anywhere

Chain zone_vpnZone_dest_ACCEPT (4 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  any    pptp-VPN  anywhere             anywhere

Chain zone_vpnZone_forward (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 forwarding_vpnZone_rule  all  --  any    any     anywhere             anywhere             /* user chain for forwarding */
    0     0 zone_lan_dest_ACCEPT  all  --  any    any     anywhere             anywhere             /* forwarding vpnZone -> lan */
    0     0 zone_wan_dest_ACCEPT  all  --  any    any     anywhere             anywhere             /* forwarding vpnZone -> wan */
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT /* Accept port forwards */
    0     0 zone_vpnZone_dest_ACCEPT  all  --  any    any     anywhere             anywhere

Chain zone_vpnZone_input (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 input_vpnZone_rule  all  --  any    any     anywhere             anywhere             /* user chain for input */
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT /* Accept port redirections */
    0     0 zone_vpnZone_src_ACCEPT  all  --  any    any     anywhere             anywhere

Chain zone_vpnZone_output (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 output_vpnZone_rule  all  --  any    any     anywhere             anywhere             /* user chain for output */
    0     0 zone_vpnZone_dest_ACCEPT  all  --  any    any     anywhere             anywhere

Chain zone_vpnZone_src_ACCEPT (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  pptp-VPN any     anywhere             anywhere

Chain zone_wan_dest_ACCEPT (4 references)
 pkts bytes target     prot opt in     out     source               destination
    1    44 ACCEPT     all  --  any    wlan0   anywhere             anywhere

Chain zone_wan_forward (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 forwarding_wan_rule  all  --  any    any     anywhere             anywhere             /* user chain for forwarding */
    0     0 zone_lan_dest_ACCEPT  esp  --  any    any     anywhere             anywhere             /* @rule[7] */
    0     0 zone_lan_dest_ACCEPT  udp  --  any    any     anywhere             anywhere             udp dpt:isakmp /* @rule[8] */
    0     0 zone_vpnZone_dest_ACCEPT  all  --  any    any     anywhere             anywhere             /* forwarding wan -> vpnZone */
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT /* Accept port forwards */
    0     0 zone_wan_dest_ACCEPT  all  --  any    any     anywhere             anywhere

Chain zone_wan_input (1 references)
 pkts bytes target     prot opt in     out     source               destination
    1    48 input_wan_rule  all  --  any    any     anywhere             anywhere             /* user chain for input */
    0     0 ACCEPT     udp  --  any    any     anywhere             anywhere             udp dpt:bootpc /* Allow-DHCP-Renew */
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp echo-request /* Allow-Ping */
    0     0 ACCEPT     igmp --  any    any     anywhere             anywhere             /* Allow-IGMP */
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT /* Accept port redirections */
    1    48 zone_wan_src_ACCEPT  all  --  any    any     anywhere             anywhere

Chain zone_wan_output (1 references)
 pkts bytes target     prot opt in     out     source               destination
    1    44 output_wan_rule  all  --  any    any     anywhere             anywhere             /* user chain for output */
    1    44 zone_wan_dest_ACCEPT  all  --  any    any     anywhere             anywhere

Chain zone_wan_src_ACCEPT (1 references)
 pkts bytes target     prot opt in     out     source               destination
    1    48 ACCEPT     all  --  wlan0  any     anywhere             anywhere

6

Odp: VPN PPTP brak gui na kliencie

Wywal te dnaty z portu 80, skoro ssh działa to i www musi w ten sam sposób, więc one są zbędne.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

7

Odp: VPN PPTP brak gui na kliencie

Po skasowaniu tego dalej nie mogę dostać się do gui.

8

Odp: VPN PPTP brak gui na kliencie

A po ssh nadal możesz?

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

9

Odp: VPN PPTP brak gui na kliencie

Tak, po SSH łącze się

10

Odp: VPN PPTP brak gui na kliencie

Zauważyłem jeszcze jedno, jak wchodzę z komputera na www LuCI (http://192.168.0.101/) to wyskakuje mi napis
"LuCI - Lua Configuration Interface" i dalej jest przekierowanie na http://192.168.0.101/cgi-bin/luci ale właśnie już tam nie wchodzi.

11

Odp: VPN PPTP brak gui na kliencie

Masz luci zainstalowane?

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

12

Odp: VPN PPTP brak gui na kliencie

Tak, bo tam gdzie jest podłączony do internetu klient (router z openwrt), w sieci lan normalnie wchodzę na luci