Configurando o cliente openvpn por trás do roteador

Question

Eu tenho um roteador dlink dir-645 que está conectado ao modem cisco. Meu laptop (Ubuntu 15.10) está conectado a este roteador via wi-fi.

Eu tenho um problema com a conexão openvpn. Quando o laptop é conectado diretamente ao modem, a conexão funciona bem. Quando está atrás do roteador, alguns segundos depois de se conectar com o openvpn, a Internet pára de funcionar (não é possível pingar nem o ip nem o nome do dns). Eu pensei que é problema de configuração do roteador, mas depois de instalar o cliente openvpn para windows eu era capaz de estabelecer conexão usando o mesmo arquivo de configuração openvpn como no Ubuntu.

O que estou perdendo?

Minha versão openvpn: 2.3.7 x86_64 Estou tentando conectar usando o plugin do gerenciador de rede, bem como usando a linha cmd.

Registro de conexão:

Thu Mar 17 16:13:18 2016 OpenVPN 2.3.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jul 8 2015
Thu Mar 17 16:13:18 2016 library versions: OpenSSL 1.0.2d 9 Jul 2015, LZO 2.08
Thu Mar 17 16:13:18 2016 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Thu Mar 17 16:13:18 2016 Control Channel Authentication: using '/etc/openvpn/vpn/ta.key' as a OpenVPN static key file
Thu Mar 17 16:13:18 2016 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Thu Mar 17 16:13:18 2016 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Thu Mar 17 16:13:18 2016 Socket Buffers: R=[212992->131072] S=[212992->131072]
Thu Mar 17 16:13:19 2016 UDPv4 link local: [undef]
Thu Mar 17 16:13:19 2016 UDPv4 link remote: [AF_INET]x.x.x.x:1194 <- usunięte
Thu Mar 17 16:13:19 2016 TLS: Initial packet from [AF_INET]x.x.x.x:1194, sid=18f6d2a7 029e6b8e
Thu Mar 17 16:13:20 2016 VERIFY OK: usunięte
Thu Mar 17 16:13:20 2016 VERIFY OK: nsCertType=SERVER
Thu Mar 17 16:13:20 2016 VERIFY OK: usunięte
Thu Mar 17 16:13:25 2016 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Mar 17 16:13:25 2016 Data Channel Encrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Thu Mar 17 16:13:25 2016 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Mar 17 16:13:25 2016 Data Channel Decrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Thu Mar 17 16:13:25 2016 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
Thu Mar 17 16:13:25 2016 [usunięte] Peer Connection Initiated with [AF_INET]x.x.x.x:1194
Thu Mar 17 16:13:27 2016 SENT CONTROL [usunięte]: 'PUSH_REQUEST' (status=1)
Thu Mar 17 16:13:32 2016 SENT CONTROL [usunięte]: 'PUSH_REQUEST' (status=1)
Thu Mar 17 16:13:34 2016 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route 192.168.6.0 255.255.255.0,route 192.168.200.0 255.255.255.0,route 10.0.0.0 255.255.0.0,dhcp-option DNS 192.168.1.1,dhcp-option DOMAIN usunięte,route 10.0.254.1,topology net30,ping 10,ping-restart 60,ifconfig 10.0.254.22 10.0.254.21'
Thu Mar 17 16:13:34 2016 OPTIONS IMPORT: timers and/or timeouts modified
Thu Mar 17 16:13:34 2016 OPTIONS IMPORT: --ifconfig/up options modified
Thu Mar 17 16:13:34 2016 OPTIONS IMPORT: route options modified
Thu Mar 17 16:13:34 2016 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Mar 17 16:13:34 2016 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 IFACE=wlan0 HWADDR=a4:34:d9:51:f0:a9
Thu Mar 17 16:13:34 2016 TUN/TAP device tun0 opened
Thu Mar 17 16:13:34 2016 TUN/TAP TX queue length set to 100
Thu Mar 17 16:13:34 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Mar 17 16:13:34 2016 /sbin/ip link set dev tun0 up mtu 1500
Thu Mar 17 16:13:34 2016 /sbin/ip addr add dev tun0 local 10.0.254.22 peer 10.0.254.21
Thu Mar 17 16:13:34 2016 /etc/openvpn/update-resolv-conf tun0 1500 1569 10.0.254.22 10.0.254.21 init
dhcp-option DNS 192.168.1.1
dhcp-option DOMAIN usunięte
Thu Mar 17 16:13:37 2016 /sbin/ip route add 192.168.1.0/24 via 10.0.254.21
Thu Mar 17 16:13:37 2016 /sbin/ip route add 192.168.6.0/24 via 10.0.254.21
Thu Mar 17 16:13:37 2016 /sbin/ip route add 192.168.200.0/24 via 10.0.254.21
Thu Mar 17 16:13:37 2016 /sbin/ip route add 10.0.0.0/16 via 10.0.254.21
Thu Mar 17 16:13:37 2016 /sbin/ip route add 10.0.254.1/32 via 10.0.254.21
Thu Mar 17 16:13:37 2016 Initialization Sequence Completed
Thu Mar 17 16:15:00 2016 [usunięte] Inactivity timeout (--ping-restart), restarting
Thu Mar 17 16:15:00 2016 SIGUSR1[soft,ping-restart] received, process restarting
Thu Mar 17 16:15:00 2016 Restart pause, 2 second(s)
Thu Mar 17 16:15:02 2016 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Thu Mar 17 16:15:02 2016 Socket Buffers: R=[212992->131072] S=[212992->131072]
Thu Mar 17 16:16:23 2016 RESOLVE: Cannot resolve host address: home.absilion.com: Temporary failure in name resolution
Thu Mar 17 16:17:38 2016 RESOLVE: signal received during DNS resolution attempt
Thu Mar 17 16:17:38 2016 /sbin/ip route del 10.0.254.1/32
Thu Mar 17 16:17:38 2016 /sbin/ip route del 10.0.0.0/16
Thu Mar 17 16:17:38 2016 /sbin/ip route del 192.168.200.0/24
Thu Mar 17 16:17:38 2016 /sbin/ip route del 192.168.6.0/24
Thu Mar 17 16:17:38 2016 /sbin/ip route del 192.168.1.0/24
Thu Mar 17 16:17:38 2016 Closing TUN/TAP interface
Thu Mar 17 16:17:38 2016 /sbin/ip addr del dev tun0 local 10.0.254.22 peer 10.0.254.21
Thu Mar 17 16:17:38 2016 /etc/openvpn/update-resolv-conf tun0 1500 1569 10.0.254.22 10.0.254.21 init
Thu Mar 17 16:17:38 2016 SIGTERM[hard,init_instance] received, process exiting 

Arquivo de configuração do OpenVPN:

# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client

# enable openvpn running scripts (enable to update resolv.conf)
script-security 2

# fix DNS via VPN connection
;up /etc/openvpn/update-resolv-conf
;down /etc/openvpn/update-resolv-conf

# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun

# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote HOST 1194

# Keep trying indefinitely to resolve the
# host name of the OpenVPN server.  Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nobody


# For MS Windows
route-method exe
route-delay 2

# Try to preserve some state across restarts.
persist-key
persist-tun

# Wireless networks often produce a lot
# of duplicate packets.  Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings

# SSL/TLS parms.
# See the server config file for more
# description.  It's best to use
# a separate .crt/.key file pair
# for each client.  A single ca
# file can be used for all clients.
ca cacert.pem
cert clientcert.pem
key clientkey.pem

# avoid sha1
auth sha256

# TLS-Auth, makes portscanning and DOS-attacks harder for the bad guys.
tls-auth ta.key 1

# Decent default
cipher AES-256-CBC

# Only connect to nodes with a certificate tagged as server.
ns-cert-type server

# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
;comp-lzo

# Set log file verbosity.
verb 3

# Silence repeating messages
mute 20

    

Answer 1

O problema aqui é evidente nesta linha de registro:

% bl0ck_qu0te%

Openvpn fazendo com que o tráfego da sua LAN local seja roteado através da interface do túnel. A seguinte linha de log mostra que 10.0.254.21 é o final remoto da sua conexão de túnel:

% bl0ck_qu0te%

Presumivelmente, um comando "push route" na sua configuração do servidor openvpn está fazendo com que a rota para 192.168.1.0/24 seja configurada. Veja esta seção da página man:

% bl0ck_qu0te%

A solução mais simples, se possível, seria alterar o espaço de endereços IP da sua LAN, ou seja, configurar o servidor DHCP no seu roteador para 192.168.2.0/255, por exemplo. Talvez seja isso que o seu modem estava fazendo antes de adicionar o dispositivo roteador ao mix? Essa solução é a melhor se houver uma LAN remota no intervalo de endereços 192.168.1.0/24 com o qual você deseja se conectar através do túnel VPN.

Se você não precisa acessar a rede remota 192.168.1.0/24 e não deseja renumerar sua LAN, você tem algumas outras opções. Se você puder controlar a configuração do servidor openvpn por cliente, poderá remover o comando "push route" para 192.168.1.0/24. Consulte o Openvpn Community HOWTO , na seção que menciona o diretório "ccd".

Outra possibilidade é sobrescrever o servidor no arquivo de configuração local openvpn. Como ponto de partida, você pode adicionar "route-nopull" ao seu arquivo de configuração e configurar as rotas manualmente. Ou seja, deixe o openvpn conectar e digite:

/sbin/ip route add 192.168.6.0/24 via 10.0.254.21
/sbin/ip route add 192.168.200.0/24 via 10.0.254.21
/sbin/ip route add 10.0.0.0/16 via 10.0.254.21
/sbin/ip route add 10.0.254.1/32 via 10.0.254.21