Administrace komentářů

Ahoj, mam problem s nasledujici konfiguraci openvpn:

       Staticky tunel OVPN     
               |            
srv1---fw1<--------->fw2--srv2---srv3
                           | 
                           |--OpenVPN tunel
                           |
                      Road Warrior

Mezi fw1 a srv2 mam staticky openvpn tunel, ktery bez problemu funguje. Dopingnu se ze srv1 na fw2,srv2 i srv3 a naopak.

Problem nastava kdyz se chci z road warriora dopingnout do site za fw1. Dopingnu se na fw2, srv2 i srv3, ale kdyz si chci pingnout na cokoliv za statickym tunelem, tak pakety skonci na br0(virtualni rozhrani vpn serveru.)

Nejzvlastnejsi je, že ze srv1 se pohodlne dopingnu uplne vsude i na ip adresu road warriora.

Konfigurace fw1:

#mode p2p
port 3194
proto udp
dev tun1
remote ver.jna.ip.srv2 

ifconfig 10.1.1.2 10.1.1.1
route 192.168.2.0 255.255.255.0 10.1.1.1 #sit za fw2

float
secret /etc/openvpn/kl94

#tls-client
#ca /etc/openvpn/ca1.crt
#cert /etc/openvpn/fw1.crt
#key /etc/openvpn/fw1.key
#dh /etc/openvpn/dh1024_1.pem

persist-key
persist-tun
keepalive 10 120
log-append /var/log/openvpn_deu-dde.log
status /var/run/openvpn/vpn_dde-deu.status 10
mute 5

user openvpn
group openvpn
comp-lzo
verb 3

Konfigurace srv2:

#mode p2p
port 3194
proto udp
dev tun1

remote vere.jna.ip.srv2
ifconfig 10.1.1.1 10.1.1.2
route 192.168.3.0 255.255.255.0 10.1.1.2 #sit za fw2

float
secret /etc/openvpn/kl94

#tls-server
#ca /etc/openvpn/ca.crt
#cert /etc/openvpn/server.crt
#key /etc/openvpn/server.key
#dh /etc/openvpn/dh1024.pem

persist-key
#persist-tun
keepalive 10 120

log-append /var/log/openvpn
status /var/run/openvpn/vpn.status 10
mute 15

comp-lzo
verb 3

Konfigurace vpn serveru pro road warriory:

up /etc/openvpn/bridge-start
down /etc/openvpn/bridge-stop
mode server
tls-server
crl-verify crl.pem
port 1194
proto tcp-server
dev tap0
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
ifconfig-pool-persist ipp.txt
server-bridge 192.168.3.254 255.255.255.0 192.168.3.50 192.168.3.89
push "route 192.168.2.0 255.255.255.0 vpn_gateway" 
client-config-dir ccd
push "dhcp-option DNS 192.168.3.145"
push "dhcp-option DNS 192.168.3.149"
push "dhcp-option WINS 192.168.3.145"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log-append  /var/log/openvpn.log
verb 3
mute 15

Diky moc za nakopnuti spravnym smerem.