Eu configurei o cliente e o servidor OpenVPN entre dois VPS. Eu tenho uma configuração de cliente e servidor, servidor usando 10.8.0.1 e 10.8.0.2 IPs na interface tun e cliente usando 10.8.0.6 e 10.8.0.5 na interface tun. (vps1 é o cliente e vps2 é o servidor.) O cliente pode executar ping no servidor tun IP 10.8.0.1 , mas não em nenhum outro IP. Do servidor, não consigo fazer ping para nenhum dos IPs de tun ou IPs de cliente tun.
conf server:
port 1194
proto udp
dev tun0
ca ca.crt
cert server.crt
key server.key
tls-server
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
verb 3
client conf:
client
dev tun
proto udp
remote 198.168.XXX 1194
nobind
tun-mtu 1500
persist-key
persist-tun
keepalive 14 120
ca ca.crt
cert client.crt
key client.key
comp-lzo
verb 3
De acordo com a conexão de registros, a configuração é bem-sucedida,
Jun 9 13:25:28 vps2 openvpn[6484]: MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Jun 9 13:25:28 vps2 openvpn[6484]: MULTI: Learn: 10.8.0.6 -> vps1.xxx/xxxxx:33012
Jun 9 13:25:28 vps2 openvpn[6484]: MULTI: primary virtual IP for vps1.xxx/xxxxx:33012: 10.8.0.6
Jun 9 13:25:30 vps2 openvpn[6484]: vps1.xxx/xxxxx:33012 PUSH: Received control message: 'PUSH_REQUEST'
Jun 9 13:25:30 vps2 openvpn[6484]: vps1.xxx/xxxxx:33012 send_push_reply(): safe_cap=940
Jun 9 13:25:30 vps2 openvpn[6484]: vps1.xxx/xxxxx:33012 SENT CONTROL [vps1.xxx]: 'PUSH_REPLY,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
E os túneis são estabelecidos nos dois extremos:
Servidor
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:5 errors:0 dropped:0 overruns:0 frame:0
TX packets:28 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:420 (420.0 b) TX bytes:1968 (1.9 KiB)
Cliente
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.6 P-t-P:10.8.0.5 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
O cliente também é capaz de fazer ping e ssh para o servidor através do IP do gateway
root@vps1:~# ping 10.8.0.1
PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=72.6 ms
64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=72.6 ms
64 bytes from 10.8.0.1: icmp_seq=3 ttl=64 time=72.7 ms
^C
--- 10.8.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 72.666/72.691/72.726/0.221 ms
root@vps1:~# ssh 10.8.0.1
[email protected]'s password:
Mas não é possível fazer o ping dos ip opnevpn do servidor e do cliente.
root@vps1:~# ping 10.8.0.2
PING 10.8.0.2 (10.8.0.2) 56(84) bytes of data.
^C
--- 10.8.0.2 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2000ms
root@vps1:~# ping 10.8.0.5
PING 10.8.0.5 (10.8.0.5) 56(84) bytes of data.
Por favor avise.