Administrace komentářů

Dobrý den, řeším problém s OpenVPN na serveru Debian Etch a klientem Win XP SP3. Pro připojení na server používám OpenVPN v. 2.0.9 GUI v. 1.0.3 Problém byl s přiřazením IP adres pro TAP zařízení ve Windows, to jsem vyřešil restartoaním služby DHCP klienta a poté dostanu IP adresu i masku ale nedostanu bránu. V konfiguraci serveru jsem nic neměnil nebo si toho nejsem vědom a do teď vše běželo v pořádku

Log klienta

Mon Nov 09 20:46:44 2009 us=27392   mode = 0
Mon Nov 09 20:46:44 2009 us=27415   show_ciphers = DISABLED
Mon Nov 09 20:46:44 2009 us=27439   show_digests = DISABLED
Mon Nov 09 20:46:44 2009 us=27461   show_engines = DISABLED
Mon Nov 09 20:46:44 2009 us=27484   genkey = DISABLED
Mon Nov 09 20:46:44 2009 us=27507   key_pass_file = '[UNDEF]'
Mon Nov 09 20:46:44 2009 us=27531   show_tls_ciphers = DISABLED
Mon Nov 09 20:46:44 2009 us=27553   proto = 0
Mon Nov 09 20:46:44 2009 us=27575 NOTE: --mute triggered...
Mon Nov 09 20:46:44 2009 us=27629 178 variation(s) on previous 10 message(s) suppressed by --mute
Mon Nov 09 20:46:44 2009 us=27663 OpenVPN 2.0.9 Win32-MinGW [SSL] [LZO] built on Oct  1 2006
Mon Nov 09 20:46:44 2009 us=27918 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Mon Nov 09 20:46:44 2009 us=36950 LZO compression initialized
Mon Nov 09 20:46:44 2009 us=37682 Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Nov 09 20:46:44 2009 us=58259 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Mon Nov 09 20:46:44 2009 us=58424 Local Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mon Nov 09 20:46:44 2009 us=58455 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mon Nov 09 20:46:44 2009 us=58552 Local Options hash (VER=V4): 'd79ca330'
Mon Nov 09 20:46:44 2009 us=58598 Expected Remote Options hash (VER=V4): 'f7df56b8'
Mon Nov 09 20:46:44 2009 us=58680 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Nov 09 20:46:44 2009 us=58847 UDPv4 link local (bound): [undef]:1194
Mon Nov 09 20:46:44 2009 us=58912 UDPv4 link remote: xx.xxx.xxx.xxx:1194
Mon Nov 09 20:46:44 2009 us=119068 TLS: Initial packet from xx.xxx.xxx.xxx:1194, sid=e905e8d1 e45ce564
Mon Nov 09 20:46:44 2009 us=455934 VERIFY OK: depth=1, /C=KG/ST=NA/L=BISHKEK/O=OpenVPN-TEST/emailAddress=me@myhost.mydomain
Mon Nov 09 20:46:44 2009 us=457440 VERIFY OK: nsCertType=SERVER
Mon Nov 09 20:46:44 2009 us=457476 VERIFY OK: depth=0, /C=KG/ST=NA/O=OpenVPN-TEST/CN=Test-Server/emailAddress=me@myhost.mydomain
Mon Nov 09 20:46:44 2009 us=865731 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Nov 09 20:46:44 2009 us=865811 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Nov 09 20:46:44 2009 us=866008 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Nov 09 20:46:44 2009 us=866047 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Nov 09 20:46:44 2009 us=866287 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mon Nov 09 20:46:44 2009 us=866361 [Test-Server] Peer Connection Initiated with xx.xxx.xxx.xxx:1194
Mon Nov 09 20:46:45 2009 us=875267 SENT CONTROL [Test-Server]: 'PUSH_REQUEST' (status=1)
Mon Nov 09 20:46:47 2009 us=928034 PUSH: Received control message: 'PUSH_REPLY,route 192.168.2.0 255.255.255.0,ping 10,ping-restart 120,ifconfig 192.168.2.50 255.255.255.0'
Mon Nov 09 20:46:47 2009 us=928182 OPTIONS IMPORT: timers and/or timeouts modified
Mon Nov 09 20:46:47 2009 us=928209 OPTIONS IMPORT: --ifconfig/up options modified
Mon Nov 09 20:46:47 2009 us=928231 OPTIONS IMPORT: route options modified
Mon Nov 09 20:46:47 2009 us=942988 OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
Mon Nov 09 20:46:47 2009 us=943046 OpenVPN ROUTE: failed to parse/resolve route for host/network: 192.168.2.0
Mon Nov 09 20:46:47 2009 us=950789 TAP-WIN32 device [openvpn] opened: \\.\Global\{BC3B8A51-B01D-4304-8ADF-51E912FD780E}.tap
Mon Nov 09 20:46:47 2009 us=950885 TAP-Win32 Driver Version 8.4
Mon Nov 09 20:46:47 2009 us=951209 TAP-Win32 MTU=1500
Mon Nov 09 20:46:47 2009 us=951287 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.2.50/255.255.255.0 on interface {BC3B8A51-B01D-4304-8ADF-51E912FD780E} [DHCP-serv: 192.168.2.0, lease-time: 31536000]
Mon Nov 09 20:46:47 2009 us=957886 Successful ARP Flush on interface [262148] {BC3B8A51-B01D-4304-8ADF-51E912FD780E}
Mon Nov 09 20:46:47 2009 us=968684 TEST ROUTES: 0/0 succeeded len=0 ret=0 a=0 u/d=down
Mon Nov 09 20:46:47 2009 us=969029 Route: Waiting for TUN/TAP interface to come up...
Mon Nov 09 20:46:48 2009 us=988064 TEST ROUTES: 0/0 succeeded len=0 ret=0 a=0 u/d=down
Mon Nov 09 20:46:48 2009 us=988130 Route: Waiting for TUN/TAP interface to come up...
Mon Nov 09 20:46:50 2009 us=3568 TEST ROUTES: 0/0 succeeded len=0 ret=0 a=0 u/d=down
Mon Nov 09 20:46:50 2009 us=3633 Route: Waiting for TUN/TAP interface to come up...
Mon Nov 09 20:46:51 2009 us=23929 TEST ROUTES: 0/0 succeeded len=0 ret=0 a=0 u/d=down
Mon Nov 09 20:46:51 2009 us=23998 Route: Waiting for TUN/TAP interface to come up...
Mon Nov 09 20:46:52 2009 us=35107 TEST ROUTES: 0/0 succeeded len=0 ret=0 a=0 u/d=down
Mon Nov 09 20:46:52 2009 us=35170 Route: Waiting for TUN/TAP interface to come up...
Mon Nov 09 20:46:53 2009 us=51100 TEST ROUTES: 0/0 succeeded len=0 ret=0 a=0 u/d=down
Mon Nov 09 20:46:53 2009 us=51166 Route: Waiting for TUN/TAP interface to come up...
Mon Nov 09 20:46:54 2009 us=113146 TEST ROUTES: 0/0 succeeded len=0 ret=1 a=0 u/d=up
Mon Nov 09 20:46:54 2009 us=113215 Initialization Sequence Completed

Zaráží mě řádek:

OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options

Konfigurace klienta

remote xx.xxx.xxx.xxx
tls-client
dev tap
pull
mute 10
key-method 2
ns-cert-type server

ca cacert.pem
cert klient.crt
key client.key

comp-lzo
verb 4

Konfigurace serveru

mode server
tls-server
dev tap0
ifconfig 192.168.2.10 255.255.255.0
ifconfig-pool 192.168.2.50 192.168.2.60 255.255.255.0
duplicate-cn
key-method 2
keepalive 10 120
route 192.168.2.0 255.255.255.0
push "route 192.168.2.0 255.255.255.0"

ca /etc/openvpn/cacert.pem
cert /etc/openvpn/vpnserver.crt
key /etc/openvpn/key.pem
dh /etc/openvpn/dh1024.pem

log-append /var/log/openvpn
status /var/run/openvpn/vpn.status 10

#user openvpn
#group openvpn
comp-lzo
verb 4