作者ando5566 (贩卖梦想的人)
看板Network
标题[问答] OPENVPN 设定问题
时间Sat Oct 2 12:30:30 2021
最近在win10架设了openVPN server, 使用中华电信非固定制ip申请固定ip
透过wifi拨号连线
另外找了一台win10电脑当client
设置好後发现client可以连线到server, 但实际去测where my ip
并非从VPN server的ip出去
以下是连线的log
2021-10-02 12:14:53 Initialization Sequence Completed
2021-10-02 12:14:53 MANAGEMENT:
>STATE:1633148093,CONNECTED,SUCCESS,10.8.0.1,,,114.32.191.84,1194
2021-10-02 12:15:29 203.74.156.241:49862 Outgoing Control Channel
Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2021-10-02 12:15:29 203.74.156.241:49862 Incoming Control Channel
Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2021-10-02 12:15:29 203.74.156.241:49862 TLS: Initial packet from
[AF_INET]203.74.156.241:49862, sid=4eeccd2a 1c02051c
2021-10-02 12:15:29 203.74.156.241:49862 VERIFY OK: depth=0, CN=client1
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_VER=3.git::98bf7f7f
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_PLAT=win
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_NCP=2
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_TCPNL=1
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_PROTO=30
2021-10-02 12:15:29 203.74.156.241:49862 peer info:
IV_CIPHERS=AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-256-CBC
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_AUTO_SESS=1
2021-10-02 12:15:29 203.74.156.241:49862 peer info:
IV_GUI_VER=OCWindows_3.3.1-2222
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_SSO=openurl,crtext
2021-10-02 12:15:29 203.74.156.241:49862 Control Channel: TLSv1.3, cipher
TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
2021-10-02 12:15:29 203.74.156.241:49862 [client1] Peer Connection Initiated
with [AF_INET]203.74.156.241:49862
2021-10-02 12:15:29 client1/203.74.156.241:49862 MULTI_sva: pool returned
IPv4=10.8.0.6, IPv6=(Not enabled)
2021-10-02 12:15:29 client1/203.74.156.241:49862 MULTI: Learn: 10.8.0.6 ->
client1/203.74.156.241:49862
2021-10-02 12:15:29 client1/203.74.156.241:49862 MULTI: primary virtual IP
for client1/203.74.156.241:49862: 10.8.0.6
2021-10-02 12:15:29 client1/203.74.156.241:49862 Data Channel: using
negotiated cipher 'AES-256-GCM'
2021-10-02 12:15:29 client1/203.74.156.241:49862 Outgoing Data Channel:
Cipher 'AES-256-GCM' initialized with 256 bit key
2021-10-02 12:15:29 client1/203.74.156.241:49862 Incoming Data Channel:
Cipher 'AES-256-GCM' initialized with 256 bit key
2021-10-02 12:15:29 client1/203.74.156.241:49862 SENT CONTROL [client1]:
'PUSH_REPLY,route 10.8.0.0 255.255.255.0,redirect-gateway def1
bypass-dhcp,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig
10.8.0.6 10.8.0.5,peer-id 0,cipher AES-256-GCM' (status=1)
2021-10-02 12:15:29 client1/203.74.156.241:49862 PUSH: Received control
message: 'PUSH_REQUEST'
--
※ 发信站: 批踢踢实业坊(ptt.cc), 来自: 114.32.191.84 (台湾)
※ 文章网址: https://webptt.com/cn.aspx?n=bbs/Network/M.1633149032.A.9DA.html
1F：→ ando5566: 谢谢回答 10/02 12:32
2F：→ deadwood: 你没设定full-tunnel吧,route 10.8.0.0 255.255.255.0 10/02 14:00
3F：→ deadwood: 这就表示只有10.8.0.0/24的流量会进VPN 10/02 14:01
4F：→ deadwood: 还有，你的server如何把VPN 进来的流量NAT出去? 10/02 14:04
5F：→ deadwood: windows 10可不像 windows server可以直接设定NAT 10/02 14:05
6F：→ ando5566: 我用Ubuntu 架设server，是否能避免此问题？ 10/03 17:15
7F：→ deadwood: 应该可以，毕竟linux内建iptables可以做NAT 10/03 22:16
8F：→ deadwood: 不过我建议用softether vpn在windows上架VPN比较简单 10/03 22:17
9F：→ deadwood: VPN server软体内建NAT功能，也支援openvpn client连线 10/03 22:17