作者ando5566 (販賣夢想的人)
看板Network
標題[問答] OPENVPN 設定問題
時間Sat Oct 2 12:30:30 2021
最近在win10架設了openVPN server, 使用中華電信非固定制ip申請固定ip
透過wifi撥號連線
另外找了一台win10電腦當client
設置好後發現client可以連線到server, 但實際去測where my ip
並非從VPN server的ip出去
以下是連線的log
2021-10-02 12:14:53 Initialization Sequence Completed
2021-10-02 12:14:53 MANAGEMENT:
>STATE:1633148093,CONNECTED,SUCCESS,10.8.0.1,,,114.32.191.84,1194
2021-10-02 12:15:29 203.74.156.241:49862 Outgoing Control Channel
Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2021-10-02 12:15:29 203.74.156.241:49862 Incoming Control Channel
Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2021-10-02 12:15:29 203.74.156.241:49862 TLS: Initial packet from
[AF_INET]203.74.156.241:49862, sid=4eeccd2a 1c02051c
2021-10-02 12:15:29 203.74.156.241:49862 VERIFY OK: depth=0, CN=client1
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_VER=3.git::98bf7f7f
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_PLAT=win
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_NCP=2
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_TCPNL=1
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_PROTO=30
2021-10-02 12:15:29 203.74.156.241:49862 peer info:
IV_CIPHERS=AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-256-CBC
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_AUTO_SESS=1
2021-10-02 12:15:29 203.74.156.241:49862 peer info:
IV_GUI_VER=OCWindows_3.3.1-2222
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_SSO=openurl,crtext
2021-10-02 12:15:29 203.74.156.241:49862 Control Channel: TLSv1.3, cipher
TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
2021-10-02 12:15:29 203.74.156.241:49862 [client1] Peer Connection Initiated
with [AF_INET]203.74.156.241:49862
2021-10-02 12:15:29 client1/203.74.156.241:49862 MULTI_sva: pool returned
IPv4=10.8.0.6, IPv6=(Not enabled)
2021-10-02 12:15:29 client1/203.74.156.241:49862 MULTI: Learn: 10.8.0.6 ->
client1/203.74.156.241:49862
2021-10-02 12:15:29 client1/203.74.156.241:49862 MULTI: primary virtual IP
for client1/203.74.156.241:49862: 10.8.0.6
2021-10-02 12:15:29 client1/203.74.156.241:49862 Data Channel: using
negotiated cipher 'AES-256-GCM'
2021-10-02 12:15:29 client1/203.74.156.241:49862 Outgoing Data Channel:
Cipher 'AES-256-GCM' initialized with 256 bit key
2021-10-02 12:15:29 client1/203.74.156.241:49862 Incoming Data Channel:
Cipher 'AES-256-GCM' initialized with 256 bit key
2021-10-02 12:15:29 client1/203.74.156.241:49862 SENT CONTROL [client1]:
'PUSH_REPLY,route 10.8.0.0 255.255.255.0,redirect-gateway def1
bypass-dhcp,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig
10.8.0.6 10.8.0.5,peer-id 0,cipher AES-256-GCM' (status=1)
2021-10-02 12:15:29 client1/203.74.156.241:49862 PUSH: Received control
message: 'PUSH_REQUEST'
--
※ 發信站: 批踢踢實業坊(ptt.cc), 來自: 114.32.191.84 (臺灣)
※ 文章網址: https://webptt.com/m.aspx?n=bbs/Network/M.1633149032.A.9DA.html
1F：→ ando5566: 謝謝回答 10/02 12:32
2F：→ deadwood: 你沒設定full-tunnel吧,route 10.8.0.0 255.255.255.0 10/02 14:00
3F：→ deadwood: 這就表示只有10.8.0.0/24的流量會進VPN 10/02 14:01
4F：→ deadwood: 還有，你的server如何把VPN 進來的流量NAT出去? 10/02 14:04
5F：→ deadwood: windows 10可不像 windows server可以直接設定NAT 10/02 14:05
6F：→ ando5566: 我用Ubuntu 架設server，是否能避免此問題？ 10/03 17:15
7F：→ deadwood: 應該可以，畢竟linux內建iptables可以做NAT 10/03 22:16
8F：→ deadwood: 不過我建議用softether vpn在windows上架VPN比較簡單 10/03 22:17
9F：→ deadwood: VPN server軟體內建NAT功能，也支援openvpn client連線 10/03 22:17