[問答] OPENVPN 設定問題

作者: ando5566 (風雲變色)   2021-10-02 12:30:30
最近在win10架設了openVPN server, 使用中華電信非固定制ip申請固定ip
透過wifi撥號連線
另外找了一台win10電腦當client
設置好後發現client可以連線到server, 但實際去測where my ip
並非從VPN server的ip出去
以下是連線的log
2021-10-02 12:14:53 Initialization Sequence Completed
2021-10-02 12:14:53 MANAGEMENT:
>STATE:1633148093,CONNECTED,SUCCESS,10.8.0.1,,,114.32.191.84,1194
2021-10-02 12:15:29 203.74.156.241:49862 Outgoing Control Channel
Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2021-10-02 12:15:29 203.74.156.241:49862 Incoming Control Channel
Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2021-10-02 12:15:29 203.74.156.241:49862 TLS: Initial packet from
[AF_INET]203.74.156.241:49862, sid=4eeccd2a 1c02051c
2021-10-02 12:15:29 203.74.156.241:49862 VERIFY OK: depth=0, CN=client1
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_VER=3.git::98bf7f7f
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_PLAT=win
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_NCP=2
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_TCPNL=1
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_PROTO=30
2021-10-02 12:15:29 203.74.156.241:49862 peer info:
IV_CIPHERS=AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-256-CBC
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_AUTO_SESS=1
2021-10-02 12:15:29 203.74.156.241:49862 peer info:
IV_GUI_VER=OCWindows_3.3.1-2222
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_SSO=openurl,crtext
2021-10-02 12:15:29 203.74.156.241:49862 Control Channel: TLSv1.3, cipher
TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
2021-10-02 12:15:29 203.74.156.241:49862 [client1] Peer Connection Initiated
with [AF_INET]203.74.156.241:49862
2021-10-02 12:15:29 client1/203.74.156.241:49862 MULTI_sva: pool returned
IPv4=10.8.0.6, IPv6=(Not enabled)
2021-10-02 12:15:29 client1/203.74.156.241:49862 MULTI: Learn: 10.8.0.6 ->
client1/203.74.156.241:49862
2021-10-02 12:15:29 client1/203.74.156.241:49862 MULTI: primary virtual IP
for client1/203.74.156.241:49862: 10.8.0.6
2021-10-02 12:15:29 client1/203.74.156.241:49862 Data Channel: using
negotiated cipher 'AES-256-GCM'
2021-10-02 12:15:29 client1/203.74.156.241:49862 Outgoing Data Channel:
Cipher 'AES-256-GCM' initialized with 256 bit key
2021-10-02 12:15:29 client1/203.74.156.241:49862 Incoming Data Channel:
Cipher 'AES-256-GCM' initialized with 256 bit key
2021-10-02 12:15:29 client1/203.74.156.241:49862 SENT CONTROL [client1]:
'PUSH_REPLY,route 10.8.0.0 255.255.255.0,redirect-gateway def1
bypass-dhcp,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig
10.8.0.6 10.8.0.5,peer-id 0,cipher AES-256-GCM' (status=1)
2021-10-02 12:15:29 client1/203.74.156.241:49862 PUSH: Received control
message: 'PUSH_REQUEST'
作者: ando5566 (風雲變色)   2021-10-02 12:32:00
謝謝回答
作者: deadwood (T_T)   2021-10-02 14:00:00
你沒設定full-tunnel吧,route 10.8.0.0 255.255.255.0這就表示只有10.8.0.0/24的流量會進VPN還有,你的server如何把VPN 進來的流量NAT出去?windows 10可不像 windows server可以直接設定NAT
作者: ando5566 (風雲變色)   2021-10-03 17:15:00
我用Ubuntu 架設server,是否能避免此問題?
作者: deadwood (T_T)   2021-10-03 22:16:00
應該可以,畢竟linux內建iptables可以做NAT不過我建議用softether vpn在windows上架VPN比較簡單VPN server軟體內建NAT功能,也支援openvpn client連線

Links booklink

Contact Us: admin [ a t ] ucptt.com