1 (edytowany przez goldi11 2024-02-19 13:30:08)

Temat: OpenVPN TUN

Cześć,
ustawiłem sobie tunel VPN miedzy dwoma openWRT luci. Tunel działa, z routera w domu widzę urządzenia za routerem na działce, ale brakuje mi jeszcze abym widział z komputera za routerem w domu inne urządzenia za routerem na działce.


co zrobiłem:
DOM
uci set network.vpn=interface
uci set network.vpn.device=tun0
uci set network.vpn.proto=none
uci commit

uci add firewall zone
uci set firewall.@zone[-1].name=vpn
uci set firewall.@zone[-1].input=ACCEPT
uci set firewall.@zone[-1].forward=ACCEPT
uci set firewall.@zone[-1].output=ACCEPT
uci set firewall.@zone[-1].network=vpn
uci add firewall forwarding
uci set firewall.@forwarding[-1].src='vpn'
uci set firewall.@forwarding[-1].dest='wan'
uci add firewall rule
uci set firewall.@rule[-1].name=OpenVPN
uci set firewall.@rule[-1].target=ACCEPT
uci set firewall.@rule[-1].src=wan
uci set firewall.@rule[-1].proto=tcp
uci set firewall.@rule[-1].dest_port=1194
uci commit firewall

uci set openvpn.home=openvpn
uci set openvpn.home.enabled=1
uci set openvpn.home.dev=tun0
uci set openvpn.home.port=1194
uci set openvpn.home.proto=udp
uci set openvpn.home.log=/tmp/openvpn.log
uci set openvpn.home.verb=3
uci set openvpn.home.ca=/etc/openvpn/ca.crt
uci set openvpn.home.cert=/etc/openvpn/serwer.crt
uci set openvpn.home.key=/etc/openvpn/serwer.key
uci set openvpn.home.server='10.8.0.0 255.255.255.0'
uci set openvpn.home.topology=subnet
uci set openvpn.home.dh=/etc/openvpn/dh.pem
uci commit openvpn
reboot

uci add_list openvpn.home.route='192.168.2.0 255.255.255.0'
uci add_list openvpn.home.push='route 192.168.2.0 255.255.255.0'
uci set openvpn.home.client_to_client='1'
uci set openvpn.home.client_config_dir='/etc/openvpn/ccd'
mkdir -p /etc/openvpn/ccd
echo "iroute 192.168.2.0 255.255.255.0" >> /etc/openvpn/ccd/malgosia
uci commit
/etc/init.d/openvpn restart


Klient
uci set openvpn.dzialka=openvpn
uci set openvpn.dzialka.enabled=1
uci set openvpn.dzialka.dev=tun0
uci set openvpn.dzialka.proto=tcp
uci set openvpn.dzialka.log=/tmp/openvpn.log               
uci set openvpn.dzialka.verb=3
uci set openvpn.dzialka.ca=/etc/openvpn/ca.crt
uci set openvpn.dzialka.cert=/etc/openvpn/dzialka.crt
uci set openvpn.dzialka.key=/etc/openvpn/dzialka.key
uci set openvpn.dzialka.client=1
uci set openvpn.dzialka.remote_cert_tls=server
uci set openvpn.dzialka.remote="80.xxxx.xxx.7 1194"
uci commit openvpn
/etc/init.d/openvpn enable
/etc/init.d/openvpn start

uci set network.vpn=interface
uci set network.vpn.ifname=tun0
uci set network.vpn.proto=none
uci commit

uci add firewall zone
uci set firewall.@zone[-1].name=vpn
uci set firewall.@zone[-1].input=ACCEPT
uci set firewall.@zone[-1].forward=ACCEPT
uci set firewall.@zone[-1].output=ACCEPT
uci set firewall.@zone[-1].network=vpn
uci set firewall.@zone[-1].masq=1
uci add firewall forwarding
uci set firewall.@forwarding[-1].src='vpn'
uci set firewall.@forwarding[-1].dest='lan'
uci commit
reboot

próbowalem dodać strefę FW na routerze w domu
uci add firewall zone
uci set firewall.@zone[-1].name=vpn
uci set firewall.@zone[-1].input=ACCEPT
uci set firewall.@zone[-1].forward=ACCEPT
uci set firewall.@zone[-1].output=ACCEPT
uci set firewall.@zone[-1].network=vpn
uci set firewall.@zone[-1].masq=1
uci add firewall forwarding
uci set firewall.@forwarding[-1].src='lan'
uci set firewall.@forwarding[-1].dest='vpn'
uci commit
ale to nie to.

Linksys WRT300n
Asus N18U

2

Odp: OpenVPN TUN

Mało zrobiłeś. I na serwerze i na kliencie robisz strefy w firewallu, na obu robisz masq 1 i robisz push'a router/irouter obu klas adresowych. Masz to opisne:

https://eko.one.pl/?p=openwrt-openvpntu … zaserwerem
https://eko.one.pl/?p=openwrt-openvpntu … lanklienta

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

3 (edytowany przez goldi11 2024-02-19 13:27:07)

Odp: OpenVPN TUN

Pozwolę sobie odświeżyć temat po roku, bo w międzyczasie musiałem zmienić router i tunel przestał mi działać. Niestety zmieniłem router na ASUS RT-AX56U który nie jest wspierany przez OpenWRT i mam małe problemy z przywróceniem tunelu. Na routerzez jest zainstalowane oprogramowanie Merlin, wszsytko klikam w GUI.
Aktualnie jak to u mnie wygląda:

Działka - internet mobilny:

root@OpenWrt:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.2.2     0.0.0.0         UG    0      0        0 eth0
10.8.0.0        *               255.255.255.0   U     0      0        0 tun0
192.168.1.0     10.8.0.1        255.255.255.0   UG    0      0        0 tun0
192.168.1.0     10.8.0.1        255.255.255.0   UG    500    0        0 tun0
192.168.2.0     *               255.255.255.0   U     0      0        0 eth0
192.168.10.0    *               255.255.255.0   U     0      0        0 br-lan

root@OpenWrt:~# cat /etc/config/openvpn

config openvpn 'custom_config'
    option config '/etc/openvpn/my-vpn.conf'

config openvpn 'sample_server'
    option port '1194'
    option proto 'udp'
    option dev 'tun'
    option ca '/etc/openvpn/ca.crt'
    option cert '/etc/openvpn/server.crt'
    option key '/etc/openvpn/server.key'
    option dh '/etc/openvpn/dh1024.pem'
    option server '10.8.0.0 255.255.255.0'
    option ifconfig_pool_persist '/tmp/ipp.txt'
    option keepalive '10 120'
    option compress 'lzo'
    option persist_key '1'
    option persist_tun '1'
    option user 'nobody'
    option status '/tmp/openvpn-status.log'
    option verb '3'

config openvpn 'sample_client'
    option client '1'
    option dev 'tun'
    option proto 'udp'
    list remote 'my_server_1 1194'
    option resolv_retry 'infinite'
    option nobind '1'
    option persist_key '1'
    option persist_tun '1'
    option user 'nobody'
    option ca '/etc/openvpn/ca.crt'
    option cert '/etc/openvpn/client.crt'
    option key '/etc/openvpn/client.key'
    option compress 'lzo'
    option verb '3'

config openvpn 'Gotowyplik'
    option config '/etc/openvpn/Gotowyplik.ovpn'
    option enabled '1'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
    option syn_flood '1'
    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'REJECT'

config zone
    option name 'lan'
    list network 'lan'
    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'ACCEPT'

config zone
    option name 'wan'
    list network 'wan'
    list network 'wan6'
    option input 'REJECT'
    option output 'ACCEPT'
    option forward 'REJECT'
    option masq '1'
    option mtu_fix '1'

config forwarding
    option src 'lan'
    option dest 'wan'

config rule
    option name 'Allow-DHCP-Renew'
    option src 'wan'
    option proto 'udp'
    option dest_port '68'
    option target 'ACCEPT'
    option family 'ipv4'

config rule
    option name 'Allow-Ping'
    option src 'wan'
    option proto 'icmp'
    option icmp_type 'echo-request'
    option family 'ipv4'
    option target 'ACCEPT'

config rule
    option name 'Allow-IGMP'
    option src 'wan'
    option proto 'igmp'
    option family 'ipv4'
    option target 'ACCEPT'

config rule
    option name 'Allow-DHCPv6'
    option src 'wan'
    option proto 'udp'
    option src_ip 'fc00::/6'
    option dest_ip 'fc00::/6'
    option dest_port '546'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-MLD'
    option src 'wan'
    option proto 'icmp'
    option src_ip 'fe80::/10'
    list icmp_type '130/0'
    list icmp_type '131/0'
    list icmp_type '132/0'
    list icmp_type '143/0'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-ICMPv6-Input'
    option src 'wan'
    option proto 'icmp'
    list icmp_type 'echo-request'
    list icmp_type 'echo-reply'
    list icmp_type 'destination-unreachable'
    list icmp_type 'packet-too-big'
    list icmp_type 'time-exceeded'
    list icmp_type 'bad-header'
    list icmp_type 'unknown-header-type'
    list icmp_type 'router-solicitation'
    list icmp_type 'neighbour-solicitation'
    list icmp_type 'router-advertisement'
    list icmp_type 'neighbour-advertisement'
    option limit '1000/sec'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-ICMPv6-Forward'
    option src 'wan'
    option dest '*'
    option proto 'icmp'
    list icmp_type 'echo-request'
    list icmp_type 'echo-reply'
    list icmp_type 'destination-unreachable'
    list icmp_type 'packet-too-big'
    list icmp_type 'time-exceeded'
    list icmp_type 'bad-header'
    list icmp_type 'unknown-header-type'
    option limit '1000/sec'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-IPSec-ESP'
    option src 'wan'
    option dest 'lan'
    option proto 'esp'
    option target 'ACCEPT'

config rule
    option name 'Allow-ISAKMP'
    option src 'wan'
    option dest 'lan'
    option dest_port '500'
    option proto 'udp'
    option target 'ACCEPT'

config include
    option path '/etc/firewall.user'

config zone
    option name 'vpn'
    option input 'ACCEPT'
    option forward 'ACCEPT'
    option output 'ACCEPT'
    option network 'vpn'
    option masq '1'

config forwarding
    option src 'vpn'
    option dest 'lan'

config forwarding
    option src 'lan'
    option dest 'vpn'


Dom - stały adres:

admin@RT-AX56U-9240:/# cat tmp/etc/openvpn/server1/config.ovpn
daemon ovpn-server1
topology subnet
server 10.8.0.0 255.255.255.0
proto tcp4
port 1194
dev tun21
txqueuelen 1000
data-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC:CHACHA20-POLY1305
data-ciphers-fallback AES-128-CBC
keepalive 15 60
verb 3
push "route 192.168.1.0 255.255.255.0 vpn_gateway 500"
duplicate-cn
ca ca.crt
dh dh.pem
cert server.crt
key server.key
script-security 2
up 'ovpn-up 1 server'
down 'ovpn-down 1 server'
status-version 2
status status 5

# Custom Configuration
reneg-sec 432000
push "route 192.168.1.0 255.255.255.0"
client-config-dir /jffs/configs/openvpn/ccd1/


admin@RT-AX56U-9240:/# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         ipv4-80-xxx-xxx- 0.0.0.0         UG    0      0        0 eth0
10.8.0.0        *               255.255.255.0   U     0      0        0 tun21
80.xxx.xxx.0     *               255.255.255.128 U     0      0        0 eth0
80.xxx.xxx.1     *               255.255.255.255 UH    0      0        0 eth0
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
188.121.31.151  ipv4-80-xxx-xxx- 255.255.255.255 UGH   1      0        0 eth0
188.121.31.201  ipv4-80-xxx-xxx- 255.255.255.255 UGH   1      0        0 eth0
192.168.1.0     *               255.255.255.0   U     0      0        0 br0
192.168.10.0    10.8.0.2        255.255.255.0   UG    0      0        0 tun21
239.0.0.0       *               255.0.0.0       U     0      0        0 br0
admin@RT-AX56U-9240:/# ifconfig
archer    Link encap:Ethernet  HWaddr 00:00:00:00:00:00
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:6242386 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6249429 errors:0 dropped:8 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:2480006312 (2.3 GiB)  TX bytes:2480392178 (2.3 GiB)

br0       Link encap:Ethernet  HWaddr F0:2F:74:B7:92:40
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:2160227 errors:0 dropped:4 overruns:0 frame:0
          TX packets:4316758 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:1030756268 (983.0 MiB)  TX bytes:5756860768 (5.3 GiB)

eth0      Link encap:Ethernet  HWaddr F0:2F:74:B7:92:40
          inet addr:80.xxx.xxx.7  Bcast:80.xxx.xxx.127  Mask:255.255.255.128
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:4547179 errors:0 dropped:3515 overruns:0 frame:0
          TX packets:2089571 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:5807703373 (5.4 GiB)  TX bytes:1089764728 (1.0 GiB)

eth1      Link encap:Ethernet  HWaddr F0:2F:74:B7:92:40
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:899505 errors:0 dropped:538 overruns:0 frame:0
          TX packets:1829859 errors:0 dropped:2 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:83976097 (80.0 MiB)  TX bytes:1803578089 (1.6 GiB)

eth2      Link encap:Ethernet  HWaddr F0:2F:74:B7:92:40
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:886825 errors:0 dropped:24 overruns:0 frame:0
          TX packets:672195 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:733623601 (699.6 MiB)  TX bytes:52550521 (50.1 MiB)

eth3      Link encap:Ethernet  HWaddr F0:2F:74:B7:92:40
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:928320 errors:0 dropped:200 overruns:0 frame:0
          TX packets:2551202 errors:0 dropped:1179 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:109034024 (103.9 MiB)  TX bytes:3692273204 (3.4 GiB)

eth4      Link encap:Ethernet  HWaddr F0:2F:74:B7:92:40
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:3 overruns:0 frame:0
          TX packets:41387 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:4294967295 (3.9 GiB)  TX bytes:6477506 (6.1 MiB)

eth5      Link encap:Ethernet  HWaddr F0:2F:74:B7:92:40
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:722172 errors:0 dropped:0 overruns:0 frame:223046
          TX packets:236864 errors:641 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:976501259 (931.2 MiB)  TX bytes:38697332 (36.9 MiB)
          Interrupt:38

eth6      Link encap:Ethernet  HWaddr F0:2F:74:B7:92:44
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:87680 errors:0 dropped:0 overruns:0 frame:1845
          TX packets:175424 errors:87 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:27735687 (26.4 MiB)  TX bytes:131901108 (125.7 MiB)
          Interrupt:42

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING MULTICAST  MTU:65536  Metric:1
          RX packets:60201 errors:0 dropped:0 overruns:0 frame:0
          TX packets:60201 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:12908978 (12.3 MiB)  TX bytes:12908978 (12.3 MiB)

lo:0      Link encap:Local Loopback
          inet addr:127.0.1.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING MULTICAST  MTU:65536  Metric:1

spu_ds_dummy Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          UP RUNNING NOARP  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

spu_us_dummy Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          UP RUNNING NOARP  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tun21     Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.1  P-t-P:10.8.0.1  Mask:255.255.255.0
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:551 errors:0 dropped:0 overruns:0 frame:0
          TX packets:931 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:188032 (183.6 KiB)  TX bytes:123418 (120.5 KiB)

wl0.1     Link encap:Ethernet  HWaddr F0:2F:74:B7:92:41
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:11321 errors:0 dropped:0 overruns:0 frame:223046
          TX packets:60786 errors:12 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:1350790 (1.2 MiB)  TX bytes:13108059 (12.5 MiB)

Połączenie się spina, mogę zalogować się na router na adresie vpnowym, ale nie widzę kompletnie nic za routerem na działece.
Czy macie jakiś pomysł co mam jeszcze zmienić lub dodać?

Linksys WRT300n
Asus N18U

4

Odp: OpenVPN TUN

push "route 192.168.10.0 255.255.255.0" chyba chciałeś. I nie pokazałeś zawartości   /jffs/configs/openvpn/ccd1/

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

5 (edytowany przez goldi11 2024-02-19 13:42:49)

Odp: OpenVPN TUN

poprawiełem ten push

admin@RT-AX56U-9240:/tmp/home/root# cat  /jffs/configs/openvpn/ccd1/Remote1
iroute 192.168.10.0 255.255.255.0

Linksys WRT300n
Asus N18U

6

Odp: OpenVPN TUN

Więc ten push popraw.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

7 (edytowany przez goldi11 2024-02-19 13:45:29)

Odp: OpenVPN TUN

root@OpenWrt:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.2.2     0.0.0.0         UG    0      0        0 eth0
10.8.0.0        *               255.255.255.0   U     0      0        0 tun0
192.168.1.0     10.8.0.1        255.255.255.0   UG    500    0        0 tun0
192.168.2.0     *               255.255.255.0   U     0      0        0 eth0
192.168.10.0    10.8.0.1        255.255.255.0   UG    0      0        0 tun0
192.168.10.0    *               255.255.255.0   U     0      0        0 br-lan


niby sie poprawił.

Linksys WRT300n
Asus N18U

8

Odp: OpenVPN TUN

admin@RT-AX56U-9240:/tmp/home/root# ping 192.168.10.1
PING 192.168.10.1 (192.168.10.1): 56 data bytes
^C
--- 192.168.10.1 ping statistics ---
7 packets transmitted, 0 packets received, 100% packet loss



root@OpenWrt:~# ping 192.168.1.1
PING 192.168.1.1 (192.168.1.1): 56 data bytes
64 bytes from 192.168.1.1: seq=0 ttl=64 time=139.913 ms
64 bytes from 192.168.1.1: seq=1 ttl=64 time=50.813 ms
64 bytes from 192.168.1.1: seq=2 ttl=64 time=58.610 ms
^C
--- 192.168.1.1 ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 50.813/83.112/139.913 ms

Linksys WRT300n
Asus N18U

9

Odp: OpenVPN TUN

A tutaj mam dobrze ten gateway?

admin@RT-AX56U-9240:/tmp/home/root# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         ipv4-80-68-233- 0.0.0.0         UG    0      0        0 eth0
10.8.0.0        *               255.255.255.0   U     0      0        0 tun21
80.68.233.0     *               255.255.255.128 U     0      0        0 eth0
80.68.233.1     *               255.255.255.255 UH    0      0        0 eth0
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
188.121.31.151  ipv4-80-68-233- 255.255.255.255 UGH   1      0        0 eth0
188.121.31.201  ipv4-80-68-233- 255.255.255.255 UGH   1      0        0 eth0
192.168.1.0     *               255.255.255.0   U     0      0        0 br0
192.168.10.0    10.8.0.2        255.255.255.0   UG    0      0        0 tun21
239.0.0.0       *               255.0.0.0       U     0      0        0 br0

Linksys WRT300n
Asus N18U

10

Odp: OpenVPN TUN

Pewnie tak, bo takie masz destination na interfejsie tun21

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

11

Odp: OpenVPN TUN

Czy coś jeszcze widać że mam niepoprawnie lub brakuje? Bo niestety nadal nie widzę nic za routerem na działce.
Próbowałem bazować na twoich instrukcjach i dodałem wszystko co wydało mi sie że trzeba.

Linksys WRT300n
Asus N18U

12

Odp: OpenVPN TUN

Też na razie nie widzę w czym jest problem.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

13

Odp: OpenVPN TUN

client_to_client ma być włączony? bo to chyba nie ten przypadek

Linksys WRT300n
Asus N18U

14

Odp: OpenVPN TUN

Do czegoś mi to było potrzebne, ale nie pamiętam do czego.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

15

Odp: OpenVPN TUN

No dobra, wracamy do tematu. Działa czy nie? Jeżeli nie to jeszcze raz
- pokaż konfig openvpn z serwera
- pokaż routing na serwerze
- pokaż konfig openvpn z klienta
- pokaż routing na kliencie
- pokaż ifconfig na kliencie
- zrób z klienta ping 192.168.x.x hosta w sieci lan klienta
- zrób z serwera  ping 192.168.x.x hosta w sieci lan klienta

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

16

Odp: OpenVPN TUN

konfig openvpn z serwera

admin@RT-AX56U-9240:/tmp/home/root# cat /tmp/etc/openvpn/server1/config.ovpn
daemon ovpn-server1
topology subnet
server 10.8.0.0 255.255.255.0
proto tcp4
port 1194
dev tun21
txqueuelen 1000
data-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC:CHACHA20-POLY1305
data-ciphers-fallback AES-128-CBC
keepalive 15 60
verb 3
push "route 192.168.1.0 255.255.255.0 vpn_gateway 500"
client-config-dir ccd
client-to-client
ca ca.crt
dh dh.pem
cert server.crt
key server.key
script-security 2
up 'ovpn-up 1 server'
down 'ovpn-down 1 server'
status-version 2
status status 5

# Custom Configuration
reneg-sec 432000
push "route 192.168.10.0 255.255.255.0"
client-config-dir /jffs/configs/openvpn/ccd1/


admin@RT-AX56U-9240:/tmp/home/root# cat /jffs/configs/openvpn/ccd1/Remote1
iroute 192.168.10.0 255.255.255.0

routing na serwerze

admin@RT-AX56U-9240:/tmp/home/root# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         ipv4-80-68-233- 0.0.0.0         UG    0      0        0 eth0
10.8.0.0        *               255.255.255.0   U     0      0        0 tun21
80.68.233.0     *               255.255.255.128 U     0      0        0 eth0
80.68.233.1     *               255.255.255.255 UH    0      0        0 eth0
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
188.121.31.151  ipv4-80-68-233- 255.255.255.255 UGH   1      0        0 eth0
188.121.31.201  ipv4-80-68-233- 255.255.255.255 UGH   1      0        0 eth0
192.168.1.0     *               255.255.255.0   U     0      0        0 br0
192.168.10.0    10.8.0.2        255.255.255.0   UG    0      0        0 tun21
239.0.0.0       *               255.0.0.0       U     0      0        0 br0

konfig openvpn z klienta

root@OpenWrt:~# cat /etc/config/openvpn

config openvpn 'custom_config'
    option config '/etc/openvpn/my-vpn.conf'

config openvpn 'sample_server'
    option port '1194'
    option proto 'udp'
    option dev 'tun'
    option ca '/etc/openvpn/ca.crt'
    option cert '/etc/openvpn/server.crt'
    option key '/etc/openvpn/server.key'
    option dh '/etc/openvpn/dh1024.pem'
    option server '10.8.0.0 255.255.255.0'
    option ifconfig_pool_persist '/tmp/ipp.txt'
    option keepalive '10 120'
    option compress 'lzo'
    option persist_key '1'
    option persist_tun '1'
    option user 'nobody'
    option status '/tmp/openvpn-status.log'
    option verb '3'

config openvpn 'sample_client'
    option client '1'
    option dev 'tun'
    option proto 'udp'
    list remote 'my_server_1 1194'
    option resolv_retry 'infinite'
    option nobind '1'
    option persist_key '1'
    option persist_tun '1'
    option user 'nobody'
    option ca '/etc/openvpn/ca.crt'
    option cert '/etc/openvpn/client.crt'
    option key '/etc/openvpn/client.key'
    option compress 'lzo'
    option verb '3'

config openvpn 'Gotowyplik'
    option config '/etc/openvpn/Gotowyplik.ovpn'
    option enabled '1'


root@OpenWrt:~# cat /etc/openvpn/Gotowyplik.ovpn

# Config generated by Asuswrt-Merlin 388.2, requires OpenVPN 2.4.0 or newer.

client
dev tun
proto tcp-client
remote 80.68.233.7 1194
resolv-retry infinite
nobind
float
ncp-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC:CHACHA20-POLY1305
keepalive 15 60
remote-cert-tls server
<ca>
...

routing na kliencie

root@OpenWrt:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.2.2     0.0.0.0         UG    0      0        0 eth0
10.8.0.0        *               255.255.255.0   U     0      0        0 tun0
192.168.1.0     10.8.0.1        255.255.255.0   UG    500    0        0 tun0
192.168.2.0     *               255.255.255.0   U     0      0        0 eth0
192.168.10.0    10.8.0.1        255.255.255.0   UG    0      0        0 tun0
192.168.10.0    *               255.255.255.0   U     0      0        0 br-lan

ifconfig na kliencie

root@OpenWrt:~# ifconfig
br-lan    Link encap:Ethernet  HWaddr 00:0C:42:9E:49:E6
          inet addr:192.168.10.1  Bcast:192.168.10.255  Mask:255.255.255.0
          inet6 addr: fe80::20c:42ff:fe9e:49e6/64 Scope:Link
          inet6 addr: fdbb:3737:bf9b::1/60 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:77925 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4329 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:6793200 (6.4 MiB)  TX bytes:219919 (214.7 KiB)

eth0      Link encap:Ethernet  HWaddr 00:0C:42:9E:49:E5
          inet addr:192.168.2.101  Bcast:192.168.2.255  Mask:255.255.255.0
          inet6 addr: fd60:aaef:1cc9:6200:20c:42ff:fe9e:49e5/64 Scope:Global
          inet6 addr: fe80::20c:42ff:fe9e:49e5/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:152819 errors:0 dropped:0 overruns:0 frame:0
          TX packets:160387 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:14273345 (13.6 MiB)  TX bytes:28167303 (26.8 MiB)
          Interrupt:5

eth1      Link encap:Ethernet  HWaddr 00:0C:42:9E:49:E6
          inet6 addr: fe80::20c:42ff:fe9e:49e6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:77965 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4390 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:8202057 (7.8 MiB)  TX bytes:291959 (285.1 KiB)
          Interrupt:4

eth1.1    Link encap:Ethernet  HWaddr 00:0C:42:9E:49:E6
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:77925 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4329 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:6793200 (6.4 MiB)  TX bytes:219919 (214.7 KiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:808 errors:0 dropped:0 overruns:0 frame:0
          TX packets:808 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:64945 (63.4 KiB)  TX bytes:64945 (63.4 KiB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.2  P-t-P:10.8.0.2  Mask:255.255.255.0
          inet6 addr: fe80::3144:3a82:2c38:1967/64 Scope:Link
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:113 errors:0 dropped:0 overruns:0 frame:0
          TX packets:28463 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:11117 (10.8 KiB)  TX bytes:2234264 (2.1 MiB)

wlan0     Link encap:Ethernet  HWaddr 00:0C:42:62:ED:38
          inet6 addr: fe80::20c:42ff:fe62:ed38/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:531 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:71198 (69.5 KiB)

z klienta ping 192.168.x.x hosta w sieci lan klienta

root@OpenWrt:~# ping 192.168.1.5
PING 192.168.1.5 (192.168.1.5): 56 data bytes
64 bytes from 192.168.1.5: seq=0 ttl=63 time=105.440 ms
64 bytes from 192.168.1.5: seq=1 ttl=63 time=61.825 ms
64 bytes from 192.168.1.5: seq=2 ttl=63 time=54.494 ms
64 bytes from 192.168.1.5: seq=3 ttl=63 time=54.214 ms

z serwera  ping 192.168.x.x hosta w sieci lan klienta

admin@RT-AX56U-9240:/tmp/home/root# ping 192.168.10.1
PING 192.168.10.1 (192.168.10.1): 56 data bytes
^C
--- 192.168.10.1 ping statistics ---
8 packets transmitted, 0 packets received, 100% packet loss

admin@RT-AX56U-9240:/tmp/home/root# ping 192.168.10.2
PING 192.168.10.2 (192.168.10.2): 56 data bytes
^C
--- 192.168.10.2 ping statistics ---
7 packets transmitted, 0 packets received, 100% packet loss

admin@RT-AX56U-9240:/tmp/home/root# ping 192.168.10.121
PING 192.168.10.121 (192.168.10.121): 56 data bytes
^C
--- 192.168.10.121 ping statistics ---
8 packets transmitted, 0 packets received, 100% packet loss

admin@RT-AX56U-9240:/tmp/home/root# ping 192.168.10.122
PING 192.168.10.122 (192.168.10.122): 56 data bytes
^C
--- 192.168.10.122 ping statistics ---
8 packets transmitted, 0 packets received, 100% packet loss
Linksys WRT300n
Asus N18U

17

Odp: OpenVPN TUN

Masz dwa razy client-config-dir

Sprawdź firewalla na kliencie. Bo drugą stronę (ping 192.168.1.5 w siec serwera) ping działa.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

18

Odp: OpenVPN TUN

Kurcze, na moje oko jest poprawnie..

root@OpenWrt:~# cat /etc/config/firewall

config defaults
    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'REJECT'
    option synflood_protect '1'

config zone
    option name 'lan'
    list network 'lan'
    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'ACCEPT'

config zone
    option name 'vpn'
    option input 'ACCEPT'
    option forward 'ACCEPT'
    option output 'ACCEPT'
    option network 'vpn'
    option masq '1'

config zone
    option name 'wan'
    list network 'wan'
    list network 'wan6'
    option input 'REJECT'
    option output 'ACCEPT'
    option forward 'REJECT'
    option masq '1'
    option mtu_fix '1'

config forwarding
    option src 'lan'
    option dest 'wan'

config rule
    option name 'Allow-DHCP-Renew'
    option src 'wan'
    option proto 'udp'
    option dest_port '68'
    option target 'ACCEPT'
    option family 'ipv4'

config rule
    option name 'Allow-Ping'
    option src 'wan'
    option proto 'icmp'
    option icmp_type 'echo-request'
    option family 'ipv4'
    option target 'ACCEPT'

config rule
    option name 'Allow-IGMP'
    option src 'wan'
    option proto 'igmp'
    option family 'ipv4'
    option target 'ACCEPT'

config rule
    option name 'Allow-DHCPv6'
    option src 'wan'
    option proto 'udp'
    option src_ip 'fc00::/6'
    option dest_ip 'fc00::/6'
    option dest_port '546'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-MLD'
    option src 'wan'
    option proto 'icmp'
    option src_ip 'fe80::/10'
    list icmp_type '130/0'
    list icmp_type '131/0'
    list icmp_type '132/0'
    list icmp_type '143/0'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-ICMPv6-Input'
    option src 'wan'
    option proto 'icmp'
    list icmp_type 'echo-request'
    list icmp_type 'echo-reply'
    list icmp_type 'destination-unreachable'
    list icmp_type 'packet-too-big'
    list icmp_type 'time-exceeded'
    list icmp_type 'bad-header'
    list icmp_type 'unknown-header-type'
    list icmp_type 'router-solicitation'
    list icmp_type 'neighbour-solicitation'
    list icmp_type 'router-advertisement'
    list icmp_type 'neighbour-advertisement'
    option limit '1000/sec'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-ICMPv6-Forward'
    option src 'wan'
    option dest '*'
    option proto 'icmp'
    list icmp_type 'echo-request'
    list icmp_type 'echo-reply'
    list icmp_type 'destination-unreachable'
    list icmp_type 'packet-too-big'
    list icmp_type 'time-exceeded'
    list icmp_type 'bad-header'
    list icmp_type 'unknown-header-type'
    option limit '1000/sec'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-IPSec-ESP'
    option src 'wan'
    option dest 'lan'
    option proto 'esp'
    option target 'ACCEPT'

config rule
    option name 'Allow-ISAKMP'
    option src 'wan'
    option dest 'lan'
    option dest_port '500'
    option proto 'udp'
    option target 'ACCEPT'

config include
    option path '/etc/firewall.user'

config forwarding
    option src 'vpn'
    option dest 'lan'

config forwarding
    option src 'lan'
    option dest 'vpn'
Linksys WRT300n
Asus N18U

19

Odp: OpenVPN TUN

Pokaz

uci show network

z klienta. I wywal z klienta z openvpn te sekcje sample_server i sample_client.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

20

Odp: OpenVPN TUN

Aha, zapomniałem dodać ze router klient stoi za routerem GSM, nie wiem czy to ma jakieś znaczenie.
Założyłem że skoro mogę się po VPN połączyć do routera klient to nie przeszkadza.

Linksys WRT300n
Asus N18U

21

Odp: OpenVPN TUN

root@OpenWrt:~# uci show network
network.loopback=interface
network.loopback.ifname='lo'
network.loopback.proto='static'
network.loopback.ipaddr='127.0.0.1'
network.loopback.netmask='255.0.0.0'
network.globals=globals
network.globals.ula_prefix='fdbb:3737:bf9b::/48'
network.lan=interface
network.lan.type='bridge'
network.lan.ifname='eth1.1'
network.lan.proto='static'
network.lan.netmask='255.255.255.0'
network.lan.ip6assign='60'
network.lan.ipaddr='192.168.10.1'
network.wan=interface
network.wan.ifname='eth0'
network.wan.proto='dhcp'
network.wan6=interface
network.wan6.ifname='eth0'
network.wan6.proto='dhcpv6'
network.@switch[0]=switch
network.@switch[0].name='switch0'
network.@switch[0].reset='1'
network.@switch[0].enable_vlan='1'
network.@switch_vlan[0]=switch_vlan
network.@switch_vlan[0].device='switch0'
network.@switch_vlan[0].vlan='1'
network.@switch_vlan[0].ports='1 2 5t'
network.vpn=interface
network.vpn.ifname='tun0'
network.vpn.proto='none'
Linksys WRT300n
Asus N18U

22 (edytowany przez goldi11 2024-02-20 11:06:12)

Odp: OpenVPN TUN

Ta opcja  "client-config-dir ccd" jest jakos domyślna, usunąłem ją z configa, ale po restarcie powróciła


dmin@RT-AX56U-9240:/tmp/home/root# cat //tmp/etc/openvpn/server1/config.ovpn
daemon ovpn-server1
topology subnet
server 10.8.0.0 255.255.255.0
proto tcp4
port 1194
dev tun21
txqueuelen 1000
data-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC:CHACHA20-POLY1305
data-ciphers-fallback AES-128-CBC
keepalive 15 60
verb 3
push "route 192.168.1.0 255.255.255.0 vpn_gateway 500"
[color=#FF0000]client-config-dir ccd[/color]
client-to-client
ca ca.crt
dh dh.pem
cert server.crt
key server.key
script-security 2
up 'ovpn-up 1 server'
down 'ovpn-down 1 server'
status-version 2
status status 5

# Custom Configuration
reneg-sec 432000
push "route 192.168.10.0 255.255.255.0"
client-config-dir /jffs/configs/openvpn/ccd1/
route 192.168.10.0 255.255.255.0

Oba pliki zawieraja to samo:


admin@RT-AX56U-9240:/tmp/home/root# find / |grep ccd
/tmp/etc/openvpn/server1/ccd
/tmp/etc/openvpn/server1/ccd/Remote1
/jffs/nvram/vpn_server1_ccd_val
/jffs/nvram/vpn_server2_ccd_val
/jffs/nvram/vpn_server_ccd_val
/jffs/configs/openvpn/ccd1
/jffs/configs/openvpn/ccd1/Remote1

admin@RT-AX56U-9240:/tmp/home/root# cat /tmp/etc/openvpn/server1/ccd/Remote1
iroute 192.168.10.0 255.255.255.0

admin@RT-AX56U-9240:/tmp/home/root# cat /jffs/configs/openvpn/ccd1/Remote1
iroute 192.168.10.0 255.255.255.0

Linksys WRT300n
Asus N18U

23

Odp: OpenVPN TUN

OK, to wywal te dwie zbędne sekcje. To ze klient jest za gsm oczywiście nie ma znaczenia, tak też działa.

ping 10.8.0.2 z serwera do klienta działa, prawda?

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

24 (edytowany przez goldi11 2024-02-20 11:15:41)

Odp: OpenVPN TUN

admin@RT-AX56U-9240:/tmp/home/root# ping 10.8.0.2
PING 10.8.0.2 (10.8.0.2): 56 data bytes
64 bytes from 10.8.0.2: seq=0 ttl=64 time=57.823 ms
64 bytes from 10.8.0.2: seq=1 ttl=64 time=50.341 ms


Usunę:
client-config-dir /jffs/configs/openvpn/ccd1/

Jaką drugą sekcje masz na mysli?


Aha, pewnie te sample_server i sample_client, jeśli tak to już są usunięte.

Linksys WRT300n
Asus N18U

25

Odp: OpenVPN TUN

No nie, tą pierwszą usuń. To na jffs zostaw, bo tam masz dalszy konfig.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.