Não consigo trabalhar com o OpenVPN (no Raspberry Pi B com o Raspian 4.9.24-v7 +). Posso estabelecer a conexão, posso fazer o ping do IP do dispositivo na sub-rede local (192.168.201.246), mas não consigo pingar mais nada nessa sub-rede nem alcançar nenhum outro host na Internet, nem mesmo DNS. Eu estou usando o OpenVPN 2.3.4.
Meu server.conf parece (dados confidenciais substituídos por "%"):
port %%%%%
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 120
tls-auth ta.key 0 # This file is secret
key-direction 0
cipher AES-128-CBC # AES
auth SHA256
comp-lzo
max-clients 10
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append /var/log/openvpn.log
verb 3
net.ipv4.ip_forward=1 está definido em /etc/sysctl.conf
client1-test.ovpn :
client
dev tun
proto udp
remote 84.%%.%%%.%% %%%%%
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
remote-cert-tls server
cipher AES-128-CBC
auth SHA256
key-direction 1
comp-lzo
verb 3
...
Com um cliente conectado (no caso dos arquivos de log a seguir, uma Lubuntu VM), recebo esta informação route :
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.0.2.0 0.0.0.0 255.255.255.0 U 100 0 0 enp0s3
10.8.0.1 10.8.0.5 255.255.255.255 UGH 0 0 0 tun0
10.8.0.5 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
84.%%.%%%.%% 10.0.2.2 255.255.255.255 UGH 0 0 0 enp0s3
e este ifconfig :
enp0s3: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.0.2.15 netmask 255.255.255.0 broadcast 10.0.2.255
inet6 %%%%::%%%%:%%%%:%%%%:%%%% prefixlen 64 scopeid 0x20<link>
ether 08:00:27:bc:92:fa txqueuelen 1000 (Ethernet)
RX packets 144 bytes 23728 (23.7 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 272 bytes 33595 (33.5 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1 (Local Loopback)
RX packets 379 bytes 29199 (29.1 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 379 bytes 29199 (29.1 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1500
inet 10.8.0.6 netmask 255.255.255.255 destination 10.8.0.5
inet6 %%%%::%%%%:%%%%:%%%:%%%% prefixlen 64 scopeid 0x20<link>
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (UNSPEC)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 3 bytes 144 (144.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
O logfile do cliente openvpn mostra este conteúdo:
Wed Jun 21 22:32:54 2017 OpenVPN 2.3.11 i686-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jun 22 2016
Wed Jun 21 22:32:54 2017 library versions: OpenSSL 1.0.2g 1 Mar 2016, LZO 2.08
Wed Jun 21 22:32:54 2017 Control Channel Authentication: tls-auth using INLINE static key file
Wed Jun 21 22:32:54 2017 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Wed Jun 21 22:32:54 2017 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Wed Jun 21 22:32:54 2017 Socket Buffers: R=[163840->163840] S=[163840->163840]
Wed Jun 21 22:32:54 2017 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Wed Jun 21 22:32:54 2017 UDPv4 link local: [undef]
Wed Jun 21 22:32:54 2017 UDPv4 link remote: [AF_INET]84.%%.%%%.%%:%%%%%
Wed Jun 21 22:32:55 2017 TLS: Initial packet from [AF_INET]84.%%.%%%.%%:%%%%%, sid=6e1bbb5e 017448e9
Wed Jun 21 22:32:55 2017 VERIFY OK: depth=1, C=%%, ST=%%, L=%%%%, O=%%%%%%%%%%, OU=%%%%%, CN=%%%%%%%%%%%%, name=server
Wed Jun 21 22:32:55 2017 Validating certificate key usage
Wed Jun 21 22:32:55 2017 ++ Certificate has key usage 00a0, expects 00a0
Wed Jun 21 22:32:55 2017 VERIFY KU OK
Wed Jun 21 22:32:55 2017 Validating certificate extended key usage
Wed Jun 21 22:32:55 2017 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Wed Jun 21 22:32:55 2017 VERIFY EKU OK
Wed Jun 21 22:32:55 2017 VERIFY OK: depth=0, C=%%, ST=%%, L=%%%%, O=%%%%%%%%%, OU=%%%%%, CN=server, name=server
Wed Jun 21 22:32:55 2017 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Wed Jun 21 22:32:55 2017 Data Channel Encrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Wed Jun 21 22:32:55 2017 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Wed Jun 21 22:32:55 2017 Data Channel Decrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Wed Jun 21 22:32:55 2017 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Jun 21 22:32:55 2017 [server] Peer Connection Initiated with [AF_INET]84.%%.%%%.%%:%%%%%
Wed Jun 21 22:32:57 2017 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Jun 21 22:32:57 2017 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway autolocal,dhcp-option DNS 8.8.8.8,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Wed Jun 21 22:32:57 2017 OPTIONS IMPORT: timers and/or timeouts modified
Wed Jun 21 22:32:57 2017 OPTIONS IMPORT: --ifconfig/up options modified
Wed Jun 21 22:32:57 2017 OPTIONS IMPORT: route options modified
Wed Jun 21 22:32:57 2017 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Jun 21 22:32:57 2017 ROUTE_GATEWAY 10.0.2.2/255.255.255.0 IFACE=enp0s3 HWADDR=%%:%%:%%:%%:%%:%%
Wed Jun 21 22:32:57 2017 TUN/TAP device tun0 opened
Wed Jun 21 22:32:57 2017 TUN/TAP TX queue length set to 100
Wed Jun 21 22:32:57 2017 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Jun 21 22:32:57 2017 /sbin/ip link set dev tun0 up mtu 1500
Wed Jun 21 22:32:57 2017 /sbin/ip addr add dev tun0 local 10.8.0.6 peer 10.8.0.5
Wed Jun 21 22:32:57 2017 ROUTE remote_host is NOT LOCAL
Wed Jun 21 22:32:57 2017 /sbin/ip route add 84.%%.%%%.%%/32 via 10.0.2.2
Wed Jun 21 22:32:57 2017 /sbin/ip route del 0.0.0.0/0
Wed Jun 21 22:32:57 2017 /sbin/ip route add 0.0.0.0/0 via 10.8.0.5
Wed Jun 21 22:32:57 2017 /sbin/ip route add 10.8.0.1/32 via 10.8.0.5
Wed Jun 21 22:32:57 2017 GID set to nogroup
Wed Jun 21 22:32:57 2017 UID set to nobody
Wed Jun 21 22:32:57 2017 Initialization Sequence Completed
A seguinte linha que adicionei a um /etc/firewall-openvpn-rules.sh (no servidor):
iptables -v -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.201.246
É assim que meu / etc / network / interfaces se parece:
source-directory /etc/network/interfaces.d
auto lo
iface lo inet loopback
iface eth0 inet manual
pre-up /etc/firewall-openvpn-rules.sh
allow-hotplug wlan0
iface wlan0 inet manual
wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf
allow-hotplug wlan1
iface wlan1 inet manual
wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf
Alguém tem uma idéia, porque o roteamento através da VPN não funciona corretamente? Não tenho certeza se meu tráfego está bloqueado no firewall raspian (aberto para a porta UDP da VPN) ou se o roteamento está errado. Não sei como posso investigar mais o problema. Gostaria que todo o tráfego passasse pela VPN e usasse minha conexão de internet doméstica.
Eu principalmente segui estes dois guias: