OpenVPN туннель— LinuxForum.Fans

20.09.2010 08:03 · отредактировано #81253

Добрый день.

Сразу начну с описани я ситуации.
Есть 2 офиса в 1 городе. В первом офисе сеть 192.168.2.0/24 во 2м - 192.168.4.0/24.
В каждом офисе установленны по маршрутизатору на Debian.
Их надо объеденить. Я поднял тунель через OpenVPN. В первом офисе сервер имеет адрес 10.10.0.1, во 2м - 10.10.0.6.
Вот так выглядят таблицы маршрутизации на серверах:

1-й сервер:

text


nixon:~# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.55.44   172.25.4.1      255.255.255.255 UGH   0      0        0 eth1
192.168.55.47   172.25.4.1      255.255.255.255 UGH   0      0        0 eth1
192.168.55.46   172.25.4.1      255.255.255.255 UGH   0      0        0 eth1
10.0.0.1        0.0.0.0         255.255.255.255 UH    0      0        0 ppp0
192.168.55.57   172.25.4.1      255.255.255.255 UGH   0      0        0 eth1
192.168.55.41   172.25.4.1      255.255.255.255 UGH   0      0        0 eth1
192.168.55.56   172.25.4.1      255.255.255.255 UGH   0      0        0 eth1
192.168.55.43   172.25.4.1      255.255.255.255 UGH   0      0        0 eth1
192.168.55.42   172.25.4.1      255.255.255.255 UGH   0      0        0 eth1
192.168.55.53   172.25.4.1      255.255.255.255 UGH   0      0        0 eth1
192.168.55.52   172.25.4.1      255.255.255.255 UGH   0      0        0 eth1
192.168.55.55   172.25.4.1      255.255.255.255 UGH   0      0        0 eth1
192.168.55.54   172.25.4.1      255.255.255.255 UGH   0      0        0 eth1
192.168.55.49   172.25.4.1      255.255.255.255 UGH   0      0        0 eth1
192.168.55.48   172.25.4.1      255.255.255.255 UGH   0      0        0 eth1
192.168.55.51   172.25.4.1      255.255.255.255 UGH   0      0        0 eth1
192.168.55.50   172.25.4.1      255.255.255.255 UGH   0      0        0 eth1
192.168.4.0     10.10.0.6       255.255.255.0   UG    0      0        0 tun0
192.168.2.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
10.10.0.0       0.0.0.0         255.255.255.0   U     0      0        0 tun0
172.25.4.0      0.0.0.0         255.255.255.0   U     0      0        0 eth1
0.0.0.0         0.0.0.0         0.0.0.0         U     0      0        0 ppp0

2-й сервер:

text


obama:~# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.55.44   192.168.104.1   255.255.255.255 UGH   0      0        0 eth1
192.168.55.47   192.168.104.1   255.255.255.255 UGH   0      0        0 eth1
192.168.55.46   192.168.104.1   255.255.255.255 UGH   0      0        0 eth1
10.0.0.1        0.0.0.0         255.255.255.255 UH    0      0        0 ppp0
192.168.55.57   192.168.104.1   255.255.255.255 UGH   0      0        0 eth1
192.168.55.41   192.168.104.1   255.255.255.255 UGH   0      0        0 eth1
192.168.55.56   192.168.104.1   255.255.255.255 UGH   0      0        0 eth1
192.168.55.43   192.168.104.1   255.255.255.255 UGH   0      0        0 eth1
192.168.55.42   192.168.104.1   255.255.255.255 UGH   0      0        0 eth1
192.168.55.53   192.168.104.1   255.255.255.255 UGH   0      0        0 eth1
192.168.55.52   192.168.104.1   255.255.255.255 UGH   0      0        0 eth1
192.168.55.55   192.168.104.1   255.255.255.255 UGH   0      0        0 eth1
192.168.55.49   192.168.104.1   255.255.255.255 UGH   0      0        0 eth1
192.168.55.48   192.168.104.1   255.255.255.255 UGH   0      0        0 eth1
192.168.55.51   192.168.104.1   255.255.255.255 UGH   0      0        0 eth1
192.168.55.50   192.168.104.1   255.255.255.255 UGH   0      0        0 eth1
192.168.55.0    192.168.104.1   255.255.255.0   UG    0      0        0 eth1
192.168.4.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.2.0     10.10.0.1       255.255.255.0   UG    0      0        0 tun0
10.10.0.0       0.0.0.0         255.255.255.0   U     0      0        0 tun0
79.134.0.0      192.168.104.1   255.255.255.0   UG    0      0        0 eth1
192.168.104.0   0.0.0.0         255.255.255.0   U     0      0        0 eth1
0.0.0.0         0.0.0.0         0.0.0.0         U     0      0        0 ppp0

Связь из 2го офиса в первый через тунель работает отлично. Компьютеры пингуются, RDP работает.
Связь из 1го офиса во второй через тунель работает только до сервера. Т.е. я могу пинговать только хост 10.10.0.6. Хосты из сети 192.168.4.0/24 не пингуются. Нет даже ответа что хост не доступен.

text

nixon:~# ping 192.168.4.13
PING 192.168.4.13 (192.168.4.13) 56(84) bytes of data.
^C
--- 192.168.4.13 ping statistics ---
252 packets transmitted, 0 received, 100% packet loss, time 251003ms

tcpdump на 2м сервере во время пинга видит вот такую картину:

text


obama:~# tcpdump -ni tun0 | grep -iv '\.22'
tcpdump: WARNING: arptype 65534 not supported by libpcap - falling back to cooked socket
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode              
listening on tun0, link-type LINUX_SLL (Linux cooked), capture size 96 bytes            
09:51:15.300805 IP 10.10.0.6.1046 > 192.168.2.153.161:  GetRequest(62)  .1.3.6.1.2.1.25.3.2.1.5.1 .1.3.6.1.2.1[|snmp]
09:51:16.426831 IP 10.10.0.6.1051 > 192.168.2.153.9100: S 1331660893:1331660893(0) win 65535 <mss 1460,nop,nop,sackOK>
09:51:18.303785 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.153 unreachable, length 113                             
09:51:18.304094 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.153 unreachable, length 56                              
09:51:19.271957 IP 10.10.0.6.1051 > 192.168.2.153.9100: S 1331660893:1331660893(0) win 65535 <mss 1460,nop,nop,sackOK>
09:51:21.776090 IP 10.10.0.6.1046 > 192.168.2.153.161:  GetRequest(62)  .1.3.6.1.2.1.25.3.2.1.5.1 .1.3.6.1.2.1[|snmp] 
09:51:22.275106 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.153 unreachable, length 56                              
09:51:22.275367 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.153 unreachable, length 113                             
09:51:25.309102 IP 10.10.0.6.1051 > 192.168.2.153.9100: S 1331660893:1331660893(0) win 65535 <mss 1460,nop,nop,sackOK>
09:51:27.775954 IP 10.10.0.6.1046 > 192.168.2.153.161:  GetRequest(62)  .1.3.6.1.2.1.25.3.2.1.5.1 .1.3.6.1.2.1[|snmp] 
09:51:28.316132 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.153 unreachable, length 56                              
09:51:28.316383 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.153 unreachable, length 113                             
09:51:33.776233 IP 10.10.0.6.1046 > 192.168.2.153.161:  GetRequest(62)  .1.3.6.1.2.1.25.3.2.1.5.1 .1.3.6.1.2.1[|snmp] 
09:51:36.788792 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.153 unreachable, length 113                             
09:51:42.308803 IP 10.10.0.6.1056 > 192.168.2.153.9100: S 2408154993:2408154993(0) win 65535 <mss 1460,nop,nop,sackOK>
09:51:45.313591 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.153 unreachable, length 56                              
09:51:45.323868 IP 10.10.0.6.1056 > 192.168.2.153.9100: S 2408154993:2408154993(0) win 65535 <mss 1460,nop,nop,sackOK>
09:51:48.328817 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.153 unreachable, length 56                              
09:51:51.359067 IP 10.10.0.6.1056 > 192.168.2.153.9100: S 2408154993:2408154993(0) win 65535 <mss 1460,nop,nop,sackOK>
09:51:54.364683 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.153 unreachable, length 56                              
09:52:08.329495 IP 10.10.0.6.1060 > 192.168.2.153.9100: S 787689763:787689763(0) win 65535 <mss 1460,nop,nop,sackOK>  
09:52:11.174610 IP 10.10.0.6.1060 > 192.168.2.153.9100: S 787689763:787689763(0) win 65535 <mss 1460,nop,nop,sackOK>  
09:52:11.334895 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.153 unreachable, length 56
09:52:11.335134 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.153 unreachable, length 56
09:52:17.209827 IP 10.10.0.6.1060 > 192.168.2.153.9100: S 787689763:787689763(0) win 65535 <mss 1460,nop,nop,sackOK>
09:52:20.214389 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.153 unreachable, length 56
09:52:29.214284 IP 10.10.0.6.1046 > 192.168.2.153.161:  GetRequest(62)  .1.3.6.1.2.1.25.3.2.1.5.1 .1.3.6.1.2.1[|snmp]
09:52:32.217340 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.153 unreachable, length 113
09:52:32.689505 IP 10.10.0.6.1028 > 192.168.2.247.161:  GetRequest(62)  .1.3.6.1.2.1.25.3.2.1.5.1 .1.3.6.1.2.1[|snmp]
09:52:34.215031 IP 10.10.0.6.1061 > 192.168.2.153.9100: S 3091907350:3091907350(0) win 65535 <mss 1460,nop,nop,sackOK>
09:52:35.696917 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.247 unreachable, length 113
09:52:35.776376 IP 10.10.0.6.1046 > 192.168.2.153.161:  GetRequest(62)  .1.3.6.1.2.1.25.3.2.1.5.1 .1.3.6.1.2.1[|snmp]
09:52:38.771277 IP 10.10.0.6.1028 > 192.168.2.247.161:  GetRequest(62)  .1.3.6.1.2.1.25.3.2.1.5.1 .1.3.6.1.2.1[|snmp]
09:52:40.232569 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.153 unreachable, length 56
09:52:41.776269 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.247 unreachable, length 113
09:52:41.776407 IP 10.10.0.6.1046 > 192.168.2.153.161:  GetRequest(62)  .1.3.6.1.2.1.25.3.2.1.5.1 .1.3.6.1.2.1[|snmp]
09:52:43.161139 IP 10.10.0.6.1061 > 192.168.2.153.9100: S 3091907350:3091907350(0) win 65535 <mss 1460,nop,nop,sackOK>
09:52:44.771156 IP 10.10.0.6.1028 > 192.168.2.247.161:  GetRequest(62)  .1.3.6.1.2.1.25.3.2.1.5.1 .1.3.6.1.2.1[|snmp]
09:52:44.779967 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.153 unreachable, length 113
09:52:44.780183 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.153 unreachable, length 56
09:52:47.776176 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.247 unreachable, length 113
09:52:47.776451 IP 10.10.0.6.1046 > 192.168.2.153.161:  GetRequest(62)  .1.3.6.1.2.1.25.3.2.1.5.1 .1.3.6.1.2.1[|snmp]
09:52:50.771046 IP 10.10.0.6.1028 > 192.168.2.247.161:  GetRequest(62)  .1.3.6.1.2.1.25.3.2.1.5.1 .1.3.6.1.2.1[|snmp]
09:52:50.779919 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.153 unreachable, length 113
09:52:53.775307 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.247 unreachable, length 113
09:53:00.232131 IP 10.10.0.6.1062 > 192.168.2.153.9100: S 1584853898:1584853898(0) win 65535 <mss 1460,nop,nop,sackOK>
09:53:03.177903 IP 10.10.0.6.1062 > 192.168.2.153.9100: S 1584853898:1584853898(0) win 65535 <mss 1460,nop,nop,sackOK>
09:53:03.242159 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.153 unreachable, length 56
09:53:03.242456 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.153 unreachable, length 56
09:53:09.213095 IP 10.10.0.6.1062 > 192.168.2.153.9100: S 1584853898:1584853898(0) win 65535 <mss 1460,nop,nop,sackOK>
09:53:12.217717 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.153 unreachable, length 56
09:53:19.916374 IP 10.10.0.6.1037 > 192.168.2.247.161:  GetRequest(62)  .1.3.6.1.2.1.25.3.2.1.5.1 .1.3.6.1.2.1[|snmp]
09:53:22.920552 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.247 unreachable, length 113
09:53:25.922471 IP 10.10.0.6.1037 > 192.168.2.247.161:  GetRequest(62)  .1.3.6.1.2.1.25.3.2.1.5.1 .1.3.6.1.2.1[|snmp]
09:53:26.183504 IP 10.10.0.6.1064 > 192.168.2.153.9100: S 2707365886:2707365886(0) win 65535 <mss 1460,nop,nop,sackOK>
09:53:28.928366 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.247 unreachable, length 113
09:53:29.129224 IP 10.10.0.6.1064 > 192.168.2.153.9100: S 2707365886:2707365886(0) win 65535 <mss 1460,nop,nop,sackOK>
09:53:29.187947 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.153 unreachable, length 56
09:53:29.188163 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.153 unreachable, length 56
09:53:31.922659 IP 10.10.0.6.1037 > 192.168.2.247.161:  GetRequest(62)  .1.3.6.1.2.1.25.3.2.1.5.1 .1.3.6.1.2.1[|snmp]
09:53:34.696640 IP 10.10.0.6.1048 > 192.168.2.247.161:  GetRequest(63)  .1.3.6.1.2.1.25.3.2.1.5.1 .1.3.6.1.2[|snmp]
09:53:34.928102 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.247 unreachable, length 113
09:53:34.928358 IP 10.10.0.1 > 10.10.0.6: ICMP host 192.168.2.247 unreachable, length 114
09:53:35.063953 IP 10.10.0.6.1064 > 192.168.2.153.9100: S 2707365886:2707365886(0) win 65535 <mss 1460,nop,nop,sackOK>
09:53:35.211467 IP 10.10.0.6.427 > 192.168.2.234.427: UDP, length 44
09:53:37.922289 IP 10.10.0.6.1037 > 192.168.2.247.161:  GetRequest(62)  .1.3.6.1.2.1.25.3.2.1.5.1 .1.3.6.1.2.1[|snmp]
^C113 packets captured
114 packets received by filter
0 packets dropped by kernel

Помогите разобраться, идеи у самого уже кончились.

20.09.2010 17:16 #81435

Покажите еще пожалуйста конфигурационные файлы openvpn с обоих серверов и настройки файрволов.

21.09.2010 06:32 #81630

1й сервер (10.10.0.1 который):

text


nixon:~# cat /etc/openvpn/server.conf | grep -v '^#.*' | grep -v '^;.*'
management localhost 7505
port 1194
proto udp
dev tun0
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key  # This file should be kept secret
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
server 10.10.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
tun-mtu 1500
nixon:~# iptables -vnL
Chain INPUT (policy ACCEPT 21M packets, 21G bytes)
 pkts bytes target     prot opt in     out     source               destination
Chain FORWARD (policy ACCEPT 34M packets, 25G bytes)
 pkts bytes target     prot opt in     out     source               destination
Chain OUTPUT (policy ACCEPT 20M packets, 5700M bytes)
 pkts bytes target     prot opt in     out     source               destination
nixon:~# iptables -vnL -t nat
Chain PREROUTING (policy ACCEPT 1390K packets, 128M bytes)
 pkts bytes target     prot opt in     out     source               destination
Chain POSTROUTING (policy ACCEPT 10072 packets, 964K bytes)
 pkts bytes target     prot opt in     out     source               destination
 795K   79M MASQUERADE  all  --  *      ppp0    0.0.0.0/0            0.0.0.0/0
    0     0 MASQUERADE  all  --  *      tun0    0.0.0.0/0            0.0.0.0/0
Chain OUTPUT (policy ACCEPT 19108 packets, 1308K bytes)
 pkts bytes target     prot opt in     out     source               destination

2й сервер (10.10.0.6 который)

text


obama:~# cat /etc/openvpn/client.conf | grep -v '^#.*' | grep -v '^;.*'
client
dev tun
proto udp
remote mss2.vpn.mgn.ru 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/obama.crt
key /etc/openvpn/easy-rsa/keys/obama.key
ns-cert-type server
comp-lzo
verb 3
obama:~# iptables -vnL
Chain INPUT (policy ACCEPT 844 packets, 670K bytes)
 pkts bytes target     prot opt in     out     source               destination
Chain FORWARD (policy ACCEPT 662 packets, 617K bytes)
 pkts bytes target     prot opt in     out     source               destination
Chain OUTPUT (policy ACCEPT 762 packets, 136K bytes)
 pkts bytes target     prot opt in     out     source               destination
obama:~# iptables -vnL -t nat
Chain PREROUTING (policy ACCEPT 1547K packets, 138M bytes)
 pkts bytes target     prot opt in     out     source               destination
Chain POSTROUTING (policy ACCEPT 13728 packets, 850K bytes)
 pkts bytes target     prot opt in     out     source               destination
39058 2466K MASQUERADE  all  --  *      ppp0    0.0.0.0/0            0.0.0.0/0
 7368  654K MASQUERADE  all  --  *      tun0    0.0.0.0/0            0.0.0.0/0
Chain OUTPUT (policy ACCEPT 19239 packets, 1308K bytes)
 pkts bytes target     prot opt in     out     source               destination

Форвардинг включен на обоих серверах, они успешно раздают интернет в офисах.

24.09.2010 15:54 #82640

Проблема решилась добавлением В client-ccd файл на первом сервере строки

text

iroute 192.168.4.0 255.255.255.0