VPN server beállitás és elérés

Linux-haladó

Sziasztok! egy kisebb gonddal küzdök VPN terén, már mindent megnéztem és nem tudok rájönni hol a hiba, csatlakozom a hálózathoz de mégsem látom, mi lehet a probléma találkozott vki ezzel.

SERVER.CONF
port 1194
proto udp
dev tun0
ca keys/server-ca/ca.crt
cert keys/server-ca/server1.crt
key keys/server-ca/server1.key
dh keys/server-ca/dh2048.pem
server 192.168.1.0 255.255.255.0
crl-verify keys/server-ca/crl.pem
ifconfig-pool-persist servers/server-1/logs/ipp.txt
cipher AES-128-CBC
user nobody
group nogroup
status servers/server-1/logs/openvpn-status.log
log-append servers/server-1/logs/openvpn.log
verb 2
mute 20
max-clients 100
keepalive 10 120
client-config-dir /etc/openvpn/servers/server-1/ccd
client-to-client
comp-lzo
persist-key
persist-tun
ccd-exclusive
route 192.168.1.100 255.255.255.0
push "route 192.168.1.100 255.255.252.0"
push "dhcp-option DNS 192.168.1.0"
client-to-client

CLIENT.CONF
client
proto udp
dev tun
ca ca.crt
dh dh2048.pem
cert client1.crt
key client1.key
remote minta.domain.hu 1194
cipher AES-128-CBC
user nobody
group nogroup
verb 2
mute 20
keepalive 10 120
comp-lzo
persist-key
persist-tun
float
resolv-retry infinite
nobind

Előre is köszönöm a válaszokat.

  • 6640 megtekintés

( Skuzzy | 2013. 05. 20., h – 12:22 )

Szerintem vagy bridge módot kellene konfolni, ha a vpn ugyanaz a tartomány, mint a belső hálód (192.168.1.0), vagy a server sorban egy külön tartomány kell, az lesz a vpn hálód, ahhoz csatlakoznak a kliensek és tudod push-olni nekik a belső hálódat. De ha kicsit szájbarágósabban kifejted, mit értesz azon, hogy csatlakozol a hálózathoz és hogy mégsem látod, tisztább lenne a kép.

Szia, a hálózat a következőképpen épül fel, egy DSL modem mögött router-en a 1194 port nyitva ez továbbítja a forgalmat egy másik router-net amin belül van ez a szerver 192.168.1.100 IP-vel, mindenhol a port forwarding be van állítva.

a következőek vannak a logban:
Mon May 20 11:59:49 2013 ERROR: Linux route delete command failed: external program exited with error status: 7
Mon May 20 11:59:49 2013 Closing TUN/TAP interface
Mon May 20 11:59:49 2013 /sbin/ifconfig tun0 0.0.0.0
SIOCSIFADDR: Permission denied
SIOCSIFFLAGS: Permission denied
Mon May 20 11:59:49 2013 Linux ip addr del failed: external program exited with error status: 255
Mon May 20 11:59:49 2013 RESOLVE: Cannot parse IP address: 1992.168.1.100
Options error: error parsing --server parameters
Use --help for more information.
Mon May 20 11:59:49 2013 SIGTERM[hard,] received, process exiting
Mon May 20 12:05:15 2013 OpenVPN 2.1.3 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Feb 21 2012
Mon May 20 12:05:15 2013 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Mon May 20 12:05:15 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon May 20 12:05:15 2013 WARNING: file 'keys/server-ca/server1.key' is group or others accessible
Mon May 20 12:05:15 2013 /usr/bin/openssl-vulnkey -q -b 2048 -m
Mon May 20 12:05:15 2013 TLS-Auth MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon May 20 12:05:15 2013 WARNING: potential TUN/TAP adapter subnet conflict between local LAN [192.168.1.0/255.255.255.0] and remote VPN [192.168.1.1/255.255.255.255]
Mon May 20 12:05:15 2013 TUN/TAP device tun0 opened
Mon May 20 12:05:15 2013 /sbin/ifconfig tun0 192.168.1.1 pointopoint 192.168.1.2 mtu 1500
Mon May 20 12:05:15 2013 WARNING: potential route subnet conflict between local LAN [192.168.1.0/255.255.255.0] and remote VPN [192.168.1.0/255.255.255.0]
route: netmask doesn't match route address
Usage: route [-nNvee] [-FC] [] List kernel routing tables
route [-v] [-FC] {add|del|flush} ... Modify routing table for AF.

route {-h|--help} [] Detailed usage syntax for specified AF.
route {-V|--version} Display version/author and exit.

-v, --verbose be verbose
-n, --numeric don't resolve names
-e, --extend display other/more information
-F, --fib display Forwarding Information Base (default)
-C, --cache display routing cache instead of FIB

=Use '-A ' or '--'; default: inet
List of possible address families (which support routing):
inet (DARPA Internet) inet6 (IPv6) ax25 (AMPR AX.25)
netrom (AMPR NET/ROM) ipx (Novell IPX) ddp (Appletalk DDP)
x25 (CCITT X.25)
Mon May 20 12:05:15 2013 ERROR: Linux route add command failed: external program exited with error status: 4
Mon May 20 12:05:15 2013 WARNING: potential route subnet conflict between local LAN [192.168.1.0/255.255.255.0] and remote VPN [192.168.1.0/255.255.255.0]
Mon May 20 12:05:15 2013 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Mon May 20 12:05:15 2013 GID set to nogroup
Mon May 20 12:05:15 2013 UID set to nobody
Mon May 20 12:05:15 2013 UDPv4 link local (bound): [undef]
Mon May 20 12:05:15 2013 UDPv4 link remote: [undef]
Mon May 20 12:05:15 2013 Initialization Sequence Completed
Mon May 20 12:47:44 2013 195.130.203.250:17537 Re-using SSL/TLS context
Mon May 20 12:47:44 2013 195.130.203.250:17537 LZO compression initialized
Mon May 20 12:47:44 2013 195.130.203.250:17537 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon May 20 12:47:44 2013 195.130.203.250:17537 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Mon May 20 12:47:44 2013 195.130.203.250:17537 Local Options hash (VER=V4): '691e95c7'
Mon May 20 12:47:44 2013 195.130.203.250:17537 Expected Remote Options hash (VER=V4): '66096c33'
Mon May 20 12:47:45 2013 195.130.203.250:17537 CRL CHECK OK: /C=HU/ST=Budapest/L=Budapest/O=xxx
Mon May 20 12:47:45 2013 195.130.203.250:17537 VERIFY OK: depth=1, /C=HU/ST=Budapest/L=Budapest/O=xxx
Mon May 20 12:47:45 2013 195.130.203.250:17537 CRL CHECK OK: /C=HU/ST=Budapest/L=Budapest/O=xxx
Mon May 20 12:47:45 2013 195.130.203.250:17537 VERIFY OK: depth=0, /C=HU/ST=Budapest/L=Budapest/O=xxx
Mon May 20 12:47:45 2013 195.130.203.250:17537 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Mon May 20 12:47:45 2013 195.130.203.250:17537 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon May 20 12:47:45 2013 195.130.203.250:17537 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Mon May 20 12:47:45 2013 195.130.203.250:17537 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon May 20 12:47:45 2013 195.130.203.250:17537 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon May 20 12:47:45 2013 195.130.203.250:17537 [client1] Peer Connection Initiated with [AF_INET]195.130.203.250:17537
Mon May 20 12:47:47 2013 client1/195.130.203.250:17537 Need IPv6 code in mroute_extract_addr_from_packet

Igen, a server sorba rakjál másik tartományt, mert így összeakad a 192.168.1.0 -ás normál hálód és a VPN-es hálód. Ilyen normál (nem bridge-es) vpn konfignál a vpn szerver és a kliensek vpn-en történő kommunikációja egy külön ip tartományban van és ha a szerveren engedve van a port forward és a pushroute-ok és egyebek, akkor fognak a kliensek belátni a 192.168.1.0-ás tartományba.

Az rendszer debian 6, a konfigurálást webmin-nel végeztem minden érthető, de valahogy nem tudom összehozni a hálózatot, és nem tudom mit kellene még beállítani. A kliens oldalon ez a lóg.

Wed May 22 14:10:13 2013 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Wed May 22 14:10:13 2013 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Wed May 22 14:10:13 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed May 22 14:10:14 2013 LZO compression initialized
Wed May 22 14:10:14 2013 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed May 22 14:10:14 2013 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Wed May 22 14:10:14 2013 Local Options hash (VER=V4): '66096c33'
Wed May 22 14:10:14 2013 Expected Remote Options hash (VER=V4): '691e95c7'
Wed May 22 14:10:14 2013 UDPv4 link local: [undef]
Wed May 22 14:10:14 2013 UDPv4 link remote: 176.241.0.183:1194
Wed May 22 14:10:14 2013 VERIFY OK: depth=1, /C=HU/ST=Budapest/L=Budapest/O=xxx
Wed May 22 14:10:14 2013 VERIFY OK: depth=0, /C=HU/ST=Budapest/L=Budapest/O=xxx
Wed May 22 14:10:14 2013 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Wed May 22 14:10:14 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed May 22 14:10:14 2013 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Wed May 22 14:10:14 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed May 22 14:10:14 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed May 22 14:10:14 2013 [server1] Peer Connection Initiated with 176.241.0.183:1194
Wed May 22 14:10:16 2013 TAP-WIN32 device [VPN kapcsolat] opened: \\.\Global\{7A083BE2-47F3-468A-96A6-E4BC8CE02D57}.tap
Wed May 22 14:10:16 2013 TAP-Win32 MTU=1500
Wed May 22 14:10:17 2013 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.0.0.6/255.255.255.252 on interface {7A083BE2-47F3-468A-96A6-E4BC8CE02D57} [DHCP-serv: 10.0.0.5, lease-time: 31536000]
Wed May 22 14:10:22 2013 ROUTE: route addition failed using CreateIpForwardEntry: A hozzáférés megtagadva. [status=5 if_index=21]
A k‚rt művelethez magasabb felhaszn l˘i szint szks‚ges.
Wed May 22 14:10:22 2013 ERROR: Windows route add command failed [adaptive]: returned error code 1
Wed May 22 14:10:22 2013 ROUTE: route addition failed using CreateIpForwardEntry: A hozzáférés megtagadva. [status=5 if_index=21]
A k‚rt művelethez magasabb felhaszn l˘i szint szks‚ges.
Wed May 22 14:10:22 2013 ERROR: Windows route add command failed [adaptive]: returned error code 1
Wed May 22 14:10:22 2013 Initialization Sequence Completed

rendszergazdaként futtattam és következő kimenetet kapom.

Wed May 22 15:52:41 2013 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Wed May 22 15:52:41 2013 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Wed May 22 15:52:41 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed May 22 15:52:41 2013 LZO compression initialized
Wed May 22 15:52:41 2013 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed May 22 15:52:41 2013 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Wed May 22 15:52:41 2013 Local Options hash (VER=V4): '66096c33'
Wed May 22 15:52:41 2013 Expected Remote Options hash (VER=V4): '691e95c7'
Wed May 22 15:52:41 2013 UDPv4 link local: [undef]
Wed May 22 15:52:41 2013 UDPv4 link remote: 176.241.0.183:1194
Wed May 22 15:52:41 2013 VERIFY OK: depth=1, /C=HU/ST=Budapest/L=Budapest/O=xxx
Wed May 22 15:52:41 2013 VERIFY OK: depth=0, /C=HU/ST=Budapest/L=Budapest/O=xxx
Wed May 22 15:52:42 2013 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Wed May 22 15:52:42 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed May 22 15:52:42 2013 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Wed May 22 15:52:42 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed May 22 15:52:42 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed May 22 15:52:42 2013 [server1] Peer Connection Initiated with 176.241.0.183:1194
Wed May 22 15:52:44 2013 TAP-WIN32 device [VPN kapcsolat] opened: \\.\Global\{7A083BE2-47F3-468A-96A6-E4BC8CE02D57}.tap
Wed May 22 15:52:44 2013 TAP-Win32 MTU=1500
Wed May 22 15:52:44 2013 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.0.0.6/255.255.255.252 on interface {7A083BE2-47F3-468A-96A6-E4BC8CE02D57} [DHCP-serv: 10.0.0.5, lease-time: 31536000]
Wed May 22 15:52:44 2013 Successful ARP Flush on interface [21] {7A083BE2-47F3-468A-96A6-E4BC8CE02D57}
Wed May 22 15:52:49 2013 ROUTE: route addition failed using CreateIpForwardEntry: Az objektum már létezik. [status=5010 if_index=21]
Az Łtvonal hozz ad sa nem sikerlt: Az objektum m r l‚tezik.
Wed May 22 15:52:49 2013 Initialization Sequence Completed

http://openvpn.net/index.php/open-source/documentation/howto.html alapján dolgoztam. Van benne certificate-tel kapcsolatos dolog is.
A default gateway a kliensen "sudo /bin/ip route add default via 10.8.0.5"
forward a serveren a "/etc/sysctl.conf" fileban állítható.
firewall beállítások tetszés szerint. :)