Temat: VPN na HMA

Uruchomiłem chyba nawet prawidłowo HMA na gargoyle-1.5.9.9-ar71xx-tl-wr1043nd-v1-squashfs-factory.bin


root@Debowo:/etc/openvpn# openvpn --config NY14.TCP.ovpn
Sat May  4 02:23:29 2013 OpenVPN 2.2.2 mips-openwrt-linux [SSL] [LZO2] [EPOLL] built on Mar 12 2013
Enter Auth Username:userpoufny
Enter Auth Password:
Sat May  4 02:23:40 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sat May  4 02:23:40 2013 Control Channel MTU parms [ L:1543 D:140 EF:40 EB:0 ET:0 EL:0 ]
Sat May  4 02:23:40 2013 Socket Buffers: R=[87380->131072] S=[16384->131072]
Sat May  4 02:23:40 2013 Data Channel MTU parms [ L:1543 D:1450 EF:43 EB:4 ET:0 EL:0 ]
Sat May  4 02:23:40 2013 Attempting to establish TCP connection with 64.120.46.218:443 [nonblock]
Sat May  4 02:23:41 2013 TCP connection established with 64.120.46.218:443
Sat May  4 02:23:41 2013 TCPv4_CLIENT link local: [undef]
Sat May  4 02:23:41 2013 TCPv4_CLIENT link remote: 64.120.46.218:443
Sat May  4 02:23:41 2013 TLS: Initial packet from 64.120.46.218:443, sid=90e8e5b8 c2193434
Sat May  4 02:23:41 2013 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sat May  4 02:23:44 2013 VERIFY OK: depth=1, /C=UK/ST=NR/L=Attleborough/O=Hide_My_Ass__Pro/OU=VPN/CN=vpn.hidemyass.com/emailAddress=ca@hidemyass.com
Sat May  4 02:23:44 2013 VERIFY OK: nsCertType=SERVER
Sat May  4 02:23:44 2013 VERIFY OK: depth=0, /C=UK/ST=NR/L=Attleborough/O=Hide_My_Ass__Pro/OU=VPN/CN=server/emailAddress=vpn@hidemyass.com
Sat May  4 02:23:50 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat May  4 02:23:50 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat May  4 02:23:50 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat May  4 02:23:50 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat May  4 02:23:50 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sat May  4 02:23:50 2013 [server] Peer Connection Initiated with 64.120.46.218:443
Sat May  4 02:23:52 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat May  4 02:23:52 2013 PUSH: Received control message: 'PUSH_REPLY,topology subnet,route-gateway 10.200.0.1,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,redirect-gateway def1,ifconfig 10.200.3.171 255.255.252.0'
Sat May  4 02:23:52 2013 OPTIONS IMPORT: --ifconfig/up options modified
Sat May  4 02:23:52 2013 OPTIONS IMPORT: route options modified
Sat May  4 02:23:52 2013 OPTIONS IMPORT: route-related options modified
Sat May  4 02:23:52 2013 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sat May  4 02:23:52 2013 TUN/TAP device tun0 opened
Sat May  4 02:23:52 2013 TUN/TAP TX queue length set to 100
Sat May  4 02:23:52 2013 /sbin/ifconfig tun0 10.200.3.171 netmask 255.255.252.0 mtu 1500 broadcast 10.200.3.255
Sat May  4 02:23:52 2013 /sbin/route add -net 64.120.46.218 netmask 255.255.255.255 gw 192.168.241.254
Sat May  4 02:23:52 2013 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.200.0.1
Sat May  4 02:23:52 2013 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.200.0.1
Sat May  4 02:23:52 2013 Initialization Sequence Completed

Po uruchomieniu na routerze niestety nie działa net.
Przed uruchomieniem i po przerwaniu openvpn działa ok.

Pewnie brakuje konfiguracji w firewall albo network ale nie mogę dojść co dołożyć.
Proszę o pomoc !

2 (edytowany przez KrzysiekP 2013-05-04 03:03:58)

Odp: VPN na HMA

Dodatkowo

konfig firewalla
==========

config defaults
    option syn_flood '1'
    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'REJECT'

config zone
    option name 'lan'
    option network 'lan'
    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'REJECT'

config zone
    option name 'wan'
    option network 'wan'
    option input 'REJECT'
    option output 'ACCEPT'
    option forward 'REJECT'
    option masq '1'
    option mtu_fix '1'

config forwarding
    option src 'lan'
    option dest 'wan'

config rule
    option name 'Allow-DHCP-Renew'
    option src 'wan'
    option proto 'udp'
    option dest_port '68'
    option target 'ACCEPT'
    option family 'ipv4'

config rule
    option name 'Allow-Ping'
    option src 'wan'
    option proto 'icmp'
    option icmp_type 'echo-request'
    option family 'ipv4'
    option target 'ACCEPT'

config rule
    option name 'Allow-DHCPv6'
    option src 'wan'
    option proto 'udp'
    option src_ip 'fe80::/10'
    option src_port '547'
    option dest_ip 'fe80::/10'
    option dest_port '546'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-ICMPv6-Input'
    option src 'wan'
    option proto 'icmp'
    list icmp_type 'echo-request'
    list icmp_type 'echo-reply'
    list icmp_type 'destination-unreachable'
    list icmp_type 'packet-too-big'
    list icmp_type 'time-exceeded'
    list icmp_type 'bad-header'
    list icmp_type 'unknown-header-type'
    list icmp_type 'router-solicitation'
    list icmp_type 'neighbour-solicitation'
    list icmp_type 'router-advertisement'
    list icmp_type 'neighbour-advertisement'
    option limit '1000/sec'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-ICMPv6-Forward'
    option src 'wan'
    option dest '*'
    option proto 'icmp'
    list icmp_type 'echo-request'
    list icmp_type 'echo-reply'
    list icmp_type 'destination-unreachable'
    list icmp_type 'packet-too-big'
    list icmp_type 'time-exceeded'
    list icmp_type 'bad-header'
    list icmp_type 'unknown-header-type'
    option limit '1000/sec'
    option family 'ipv6'
    option target 'ACCEPT'

config include
    option path '/etc/firewall.user'

config include
    option path '/usr/lib/gargoyle_firewall_util/gargoyle_additions.firewall'

config include 'openvpn_include_file'
    option path '/etc/openvpn.firewall'

config remote_accept 'ra_22_22'
    option local_port '22'
    option remote_port '22'
    option proto 'tcp'
    option zone 'wan'


konfig network
==========

config interface 'loopback'
    option ifname 'lo'
    option proto 'static'
    option ipaddr '127.0.0.1'
    option netmask '255.0.0.0'

config interface 'lan'
    option ifname 'eth0.1'
    option type 'bridge'
    option proto 'static'
    option netmask '255.255.255.0'
    option ipaddr '192.168.100.254'
    option dns '192.168.100.254'

config interface 'wan'
    option ifname 'eth0.2'
    option proto 'dhcp'

config switch
    option name 'rtl8366rb'
    option reset '1'
    option enable_vlan '1'

config switch_vlan
    option device 'rtl8366rb'
    option vlan '1'
    option ports '1 2 3 4 5t'

config switch_vlan
    option device 'rtl8366rb'
    option vlan '2'
    option ports '0 5t'