Temat: VPN client porty
Cześć
mam dwa problemy:
1) jak uruchomiony jest openvpn to brak dostępu do routera z zewnątrz ssh czylu http co wydaje się ok, po wyłączeniu vpna wszystko jest ok czyli dostęp jest. Co i gdzie należy dopisać aby podczas działania vpna można było połączyć się z routerem?
2) do routera z VPNem podłączony jest linux na którym uruchomiony jest serwer FTP (10.1.1.10) do którego nie można dostać się z 192.168.1.x, co i gdzie trzeba dopisać ?
Siec wygląda tak:
Router dostawcy internetu 192.168.1.1 >> router na którym pracuje VPN 192.168.1.4 (WAN) na tym routerze dwie sieci LAN 192.168.2.1 oraz GUEST 10.1.1.1
Jeżeli chodzi o pliki konfiguracyjne to wyglądają one tak:
network
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd32:0685:8ac9::/48'
config interface 'lan'
option type 'bridge'
option ifname 'eth0.1'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '60'
option ipaddr '192.168.2.1'
config device 'lan_dev'
option name 'eth0.1'
option macaddr 'b0:39:56:53:b3:28'
config interface 'wan'
option ifname 'eth0.2'
option proto 'dhcp'
config device 'wan_dev'
option name 'eth0.2'
option macaddr 'b0:39:56:53:b3:29'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '0 1 2 3 6t'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '4 6t'
config interface 'Guest'
option proto 'static'
option netmask '255.255.255.0'
option type 'bridge'
option ipaddr '10.1.1.1'
config interface 'NORD'
option proto 'none'
option auto '1'
option delegate '0'
option ifname 'tun0'oraz firewall
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option network 'lan'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'wan'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
config zone
option name 'quest'
option forward 'REJECT'
option output 'ACCEPT'
option network 'Guest'
option input 'REJECT'
config forwarding
option dest 'wan'
option src 'quest'
config rule
option target 'ACCEPT'
option proto 'tcp udp'
option dest_port '53'
option name 'Guest DNS'
option src 'quest'
config rule
option target 'ACCEPT'
option proto 'udp'
option dest_port '67-68'
option name 'Guest DHCP'
option src 'quest'
config zone
option output 'ACCEPT'
option name 'NORDZONE'
option masq '1'
option mtu_fix '1'
option network 'NORD'
option input 'REJECT'
option forward 'REJECT'
config forwarding
option dest 'NORDZONE'
option src 'lan'
config forwarding
option dest 'NORDZONE'
option src 'quest'
config rule
option target 'ACCEPT'
option src 'wan'
option proto 'tcp'
option dest_port '22'
option name 'ssh'
config rule
option target 'ACCEPT'
option src 'wan'
option proto 'tcp'
option dest_port '443'
option name 'https'Pomijam fakt o przekierowaniu portów na routerze dostawcy, co jest oczywiste.
Dzięki za ewentualne odpowiedzi i podpowiedzi.