Dotaz: A zase ta VPN

[Ales]

Příloha:

• log.png (40909 bytů)

Dobry den, ze nejsem zadny linuxovy koumak ani nebudu psat, poznate sami. Dva dny jsem sedel nad tutorialy jak zprovoznit VPN tunel na Debianu a po vyzkouseni deseti postupu jsem stale na nule. Totiz na nule ne, vpn se mi spoji, dostanu IP adresu atd. ovsem nedari se mi presmerovat komunikaci pres tunel (typicky vyuziti jako sifrovany pristup na internet na nezabezpecenych wifi). Specifikum je, ze pouzivam port 8080 (ostatni byvaji casto zavrene) a tcp protokol. Naposledy jsem postupoval podle navodu na Linuxexpres (http://www.linuxexpres.cz/praxe/sprava-linuxoveho-serveru-openvpn-server-pokracovani). Nastaveni klienta i serveru je presne podle navodu. Osoby a obsazeni: na serveru debian Squeeze, na klientovi Windows 7 Stav: openvpn klient dostane IP adresu, pingame, modul tun v jadre je, smerovani paketu net.ipv4.ip_forward=1 Firewall mam povolenou komunikaci na portu 8080 NATovani te VPN:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Log z klienta:Tue May 22 20:22:07 2012 OpenVPN 2.1.1 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Dec 11 2009 Tue May 22 20:22:07 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables Tue May 22 20:22:11 2012 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this Tue May 22 20:22:11 2012 LZO compression initialized Tue May 22 20:22:11 2012 Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ] Tue May 22 20:22:11 2012 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ] Tue May 22 20:22:11 2012 Local Options hash (VER=V4): '31fdf004' Tue May 22 20:22:11 2012 Expected Remote Options hash (VER=V4): '3e6d1056' Tue May 22 20:22:11 2012 Attempting to establish TCP connection with 31.31.72.212:8080 Tue May 22 20:22:11 2012 TCP connection established with 31.31.72.212:8080 Tue May 22 20:22:11 2012 Socket Buffers: R=[8192->8192] S=[8192->8192] Tue May 22 20:22:11 2012 TCPv4_CLIENT link local: [undef] Tue May 22 20:22:11 2012 TCPv4_CLIENT link remote: 31.31.72.212:8080 Tue May 22 20:22:11 2012 TLS: Initial packet from 31.31.72.212:8080, sid=ed0ad0e3 d0cac30a Tue May 22 20:22:11 2012 VERIFY OK: depth=1, /C=CZ/ST=Czech_Republic/L=Prague/O=blabla/CN=blabla_CA/emailAddress=webmaster@blabla.cz Tue May 22 20:22:11 2012 VERIFY OK: nsCertType=SERVER Tue May 22 20:22:11 2012 VERIFY OK: depth=0, /C=CZ/ST=Czech_Republic/L=Prague/O=blabla/CN=gaia/emailAddress=webmasterblabla.cz Tue May 22 20:22:12 2012 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key Tue May 22 20:22:12 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Tue May 22 20:22:12 2012 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key Tue May 22 20:22:12 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Tue May 22 20:22:12 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA Tue May 22 20:22:12 2012 [gaia] Peer Connection Initiated with 31.31.72.212:8080 Tue May 22 20:22:14 2012 SENT CONTROL [gaia]: 'PUSH_REQUEST' (status=1) Tue May 22 20:22:14 2012 PUSH: Received control message: 'PUSH_REPLY,route-gateway 10.45.42.1,redirect-gateway def1,dhcp-option DNS 8.8.8.8,ping 10,ping-restart 20,ifconfig 10.45.42.2 255.255.255.0' Tue May 22 20:22:14 2012 OPTIONS IMPORT: timers and/or timeouts modified Tue May 22 20:22:14 2012 OPTIONS IMPORT: --ifconfig/up options modified Tue May 22 20:22:14 2012 OPTIONS IMPORT: route options modified Tue May 22 20:22:14 2012 OPTIONS IMPORT: route-related options modified Tue May 22 20:22:14 2012 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified Tue May 22 20:22:14 2012 ROUTE default_gateway=10.9.5.1 Tue May 22 20:22:14 2012 TAP-WIN32 device [OpenVPN] opened: \\.\Global\{B5F8962E-72A3-4370-A5AD-BEF4FB36DEF7}.tap Tue May 22 20:22:14 2012 TAP-Win32 Driver Version 9.6 Tue May 22 20:22:14 2012 TAP-Win32 MTU=1500 Tue May 22 20:22:14 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.45.42.2/255.255.255.0 on interface {B5F8962E-72A3-4370-A5AD-BEF4FB36DEF7} [DHCP-serv: 10.45.42.0, lease-time: 31536000] Tue May 22 20:22:14 2012 NOTE: FlushIpNetTable failed on interface [20] {B5F8962E-72A3-4370-A5AD-BEF4FB36DEF7} (status=5) : Přístup byl odepřen. Tue May 22 20:22:19 2012 TEST ROUTES: 1/1 succeeded len=0 ret=1 a=0 u/d=up Tue May 22 20:22:19 2012 C:\WINDOWS\system32\route.exe ADD 31.31.72.212 MASK 255.255.255.255 10.9.5.1 Tue May 22 20:22:19 2012 ROUTE: route addition failed using CreateIpForwardEntry: Přístup byl odepřen. [status=5 if_index=16] Tue May 22 20:22:19 2012 Route addition via IPAPI failed [adaptive] Tue May 22 20:22:19 2012 Route addition fallback to route.exe Tue May 22 20:22:19 2012 ERROR: Windows route add command failed [adaptive]: returned error code 1 Tue May 22 20:22:19 2012 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.45.42.1 Tue May 22 20:22:19 2012 ROUTE: route addition failed using CreateIpForwardEntry: Přístup byl odepřen. [status=5 if_index=20] Tue May 22 20:22:19 2012 Route addition via IPAPI failed [adaptive] Tue May 22 20:22:19 2012 Route addition fallback to route.exe Tue May 22 20:22:19 2012 ERROR: Windows route add command failed [adaptive]: returned error code 1 Tue May 22 20:22:19 2012 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.45.42.1 Tue May 22 20:22:19 2012 ROUTE: route addition failed using CreateIpForwardEntry: Přístup byl odepřen. [status=5 if_index=20] Tue May 22 20:22:19 2012 Route addition via IPAPI failed [adaptive] Tue May 22 20:22:19 2012 Route addition fallback to route.exe Tue May 22 20:22:19 2012 ERROR: Windows route add command failed [adaptive]: returned error code 1 Tue May 22 20:22:19 2012 Initialization Sequence Completed Log ze serveru by tady nekde mel byt jako obrazek. Diky moc za pomoc. Uz se mnou mlati vztek. Ales

---

---

Odpovědi

[Senux]

Ahoj

Mal som kedysi problem s vpn pri windows 7,system si nenastavil route zo servera pokial nemala openvpn na win7 administratorske prava.

A tiez si skontroluj ci mas v konfiguracii servera push pre default route

[Ales]

Výborně. Pomohlo! Díky moc. Škoda těch dvou dnů co jsem nad tím seděl. Už jsem proklínal Debian a on za to nemohl :)

Aleš