[問答] OPENVPN 設定問題

看板Network作者 (販賣夢想的人)時間2年前 (2021/10/02 12:30), 編輯推噓0(009)
留言9則, 2人參與, 2年前最新討論串1/1
最近在win10架設了openVPN server, 使用中華電信非固定制ip申請固定ip 透過wifi撥號連線 另外找了一台win10電腦當client 設置好後發現client可以連線到server, 但實際去測where my ip 並非從VPN server的ip出去 以下是連線的log 2021-10-02 12:14:53 Initialization Sequence Completed 2021-10-02 12:14:53 MANAGEMENT: >STATE:1633148093,CONNECTED,SUCCESS,10.8.0.1,,,114.32.191.84,1194 2021-10-02 12:15:29 203.74.156.241:49862 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication 2021-10-02 12:15:29 203.74.156.241:49862 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication 2021-10-02 12:15:29 203.74.156.241:49862 TLS: Initial packet from [AF_INET]203.74.156.241:49862, sid=4eeccd2a 1c02051c 2021-10-02 12:15:29 203.74.156.241:49862 VERIFY OK: depth=0, CN=client1 2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_VER=3.git::98bf7f7f 2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_PLAT=win 2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_NCP=2 2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_TCPNL=1 2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_PROTO=30 2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-256-CBC 2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_AUTO_SESS=1 2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_GUI_VER=OCWindows_3.3.1-2222 2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_SSO=openurl,crtext 2021-10-02 12:15:29 203.74.156.241:49862 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA 2021-10-02 12:15:29 203.74.156.241:49862 [client1] Peer Connection Initiated with [AF_INET]203.74.156.241:49862 2021-10-02 12:15:29 client1/203.74.156.241:49862 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled) 2021-10-02 12:15:29 client1/203.74.156.241:49862 MULTI: Learn: 10.8.0.6 -> client1/203.74.156.241:49862 2021-10-02 12:15:29 client1/203.74.156.241:49862 MULTI: primary virtual IP for client1/203.74.156.241:49862: 10.8.0.6 2021-10-02 12:15:29 client1/203.74.156.241:49862 Data Channel: using negotiated cipher 'AES-256-GCM' 2021-10-02 12:15:29 client1/203.74.156.241:49862 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 2021-10-02 12:15:29 client1/203.74.156.241:49862 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 2021-10-02 12:15:29 client1/203.74.156.241:49862 SENT CONTROL [client1]: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,redirect-gateway def1 bypass-dhcp,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5,peer-id 0,cipher AES-256-GCM' (status=1) 2021-10-02 12:15:29 client1/203.74.156.241:49862 PUSH: Received control message: 'PUSH_REQUEST' -- ※ 發信站: 批踢踢實業坊(ptt.cc), 來自: 114.32.191.84 (臺灣) ※ 文章網址: https://www.ptt.cc/bbs/Network/M.1633149032.A.9DA.html

10/02 12:32, 2年前 , 1F
謝謝回答
10/02 12:32, 1F

10/02 14:00, 2年前 , 2F
你沒設定full-tunnel吧,route 10.8.0.0 255.255.255.0
10/02 14:00, 2F

10/02 14:01, 2年前 , 3F
這就表示只有10.8.0.0/24的流量會進VPN
10/02 14:01, 3F

10/02 14:04, 2年前 , 4F
還有,你的server如何把VPN 進來的流量NAT出去?
10/02 14:04, 4F

10/02 14:05, 2年前 , 5F
windows 10可不像 windows server可以直接設定NAT
10/02 14:05, 5F

10/03 17:15, 2年前 , 6F
我用Ubuntu 架設server,是否能避免此問題?
10/03 17:15, 6F

10/03 22:16, 2年前 , 7F
應該可以,畢竟linux內建iptables可以做NAT
10/03 22:16, 7F

10/03 22:17, 2年前 , 8F
不過我建議用softether vpn在windows上架VPN比較簡單
10/03 22:17, 8F

10/03 22:17, 2年前 , 9F
VPN server軟體內建NAT功能,也支援openvpn client連線
10/03 22:17, 9F
文章代碼(AID): #1XL-1edQ (Network)
文章代碼(AID): #1XL-1edQ (Network)