OpenWRT + Debian OpenVPN server подключается, но даже не пингуется

0

1

Поставил на 740N OpenWRT с OpenVPN на борту, создал интерфейс, настроил сервер на машине с дебианом в tun, ключи создал, закинул в роутер, подключился, в логах все хорошо(тут небольшое отступление - в ccd

ifconfig-push 10.1.1.3 10.1.1.2

), но я не могу даже пропинговать сервер и с сервера клиента внутри туннеля. С OpenWRT плохо получается дружить - он хоть и на дебиане основан, но я в сетях профан. Подскажите, друзья, как заставить роутер стать клиентом VPN сети, прокинуть пару портов на нём внутрь локалки, в которую он будет воткнут и забыть как страшный сон? Спасибо!

cat /etc/config/openvpn

config openvpn 'sample_client'
        option client '1'
        option dev 'tun'
        option proto 'udp'
        option resolv_retry 'infinite'
        option persist_key '1'
        option persist_tun '1'
        option comp_lzo '1'
        option verb '3'
        option enabled '1'
        option remote 'host.freedns 1194'
        option ca '/lib/uci/upload/cbid.openvpn.sample_client.ca'
        option cert '/lib/uci/upload/cbid.openvpn.sample_client.cert'
        option key '/lib/uci/upload/cbid.openvpn.sample_client.key'

cat /etc/config/network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config interface 'lan'
        option ifname 'eth0'
        option type 'bridge'
        option proto 'static'
        option ipaddr '192.168.1.99'
        option netmask '255.255.255.0'
        option gateway '192.168.1.1'
        option dns '192.168.1.1'

config interface 'wan'
        option ifname 'eth1'
        option proto 'dhcp'

config switch
        option name 'eth0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'eth0'
        option vlan '1'
        option ports '0t 1t 2t 3t 4t'
        option vid '1'

config interface 'TUN'
        option proto 'none'
        option ifname 'tun0'

cat /etc/config/firewall

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'
        option mtu_fix '1'

config zone
        option name 'wan'
        option network 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'
        option src '*'
        option dest '*'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fe80::/10'
        option src_port '547'
        option dest_ip 'fe80::/10'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config include
        option path '/etc/firewall.user'

config zone
        option output 'ACCEPT'
        option name 'tunzone'
        option masq '1'
        option mtu_fix '1'
        option network 'TUN'
        option input 'ACCEPT'
        option forward 'ACCEPT'

config forwarding
        option dest 'wan'
        option src 'lan'

config forwarding
        option dest 'lan'
        option src 'tunzone'

config forwarding
        option dest 'tunzone'
        option src 'lan'

cat /etc/openvpn.conf

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
server 10.1.1.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
verb 3
tun-mtu 1500
fragment 1400

Кусочек логов: сервер:

Sep  6 21:27:33 server ovpn-server[11444]: router/IP:13549 SENT CONTROL [router]: 'PUSH_REPLY,route 10.1.1.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.1.1.3 10.1.1.2' (status=1)
Sep  6 21:27:43 server ovpn-server[11444]: router/IP:13549 FRAG_IN error flags=0xfa2a187b: FRAG_TEST not implemented
Sep  6 21:27:54 server ovpn-server[11444]: router/IP:13549 FRAG_IN error flags=0xfa2a187b: FRAG_TEST not implemented
Sep  6 21:28:03 server ovpn-server[11444]: router/IP:13549 FRAG_IN error flags=0xfa2a187b: FRAG_TEST not implemented
Sep  6 21:28:13 server ovpn-server[11444]: router/IP:13549 FRAG_IN error flags=0xfa2a187b: FRAG_TEST not implemented
Sep  6 21:28:23 server ovpn-server[11444]: router/IP:13549 FRAG_IN error flags=0xfa2a187b: FRAG_TEST not implemented
Sep  6 21:28:34 server ovpn-server[11444]: router/IP:13549 FRAG_IN error flags=0xfa2a187b: FRAG_TEST not implemented
Sep  6 21:28:44 server ovpn-server[11444]: router/IP:13549 FRAG_IN error flags=0xfa2a187b: FRAG_TEST not implemented

клиент:

Sep  6 15:27:32 OpenWrt daemon.notice openvpn(sample_client)[7280]: PUSH: Received control message: 'PUSH_REPLY,route 10.1.1.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.1.1.3 10.1.1.2'
Sep  6 15:27:32 OpenWrt daemon.notice openvpn(sample_client)[7280]: OPTIONS IMPORT: timers and/or timeouts modified
Sep  6 15:27:32 OpenWrt daemon.notice openvpn(sample_client)[7280]: OPTIONS IMPORT: --ifconfig/up options modified
Sep  6 15:27:32 OpenWrt daemon.notice openvpn(sample_client)[7280]: OPTIONS IMPORT: route options modified
Sep  6 15:27:32 OpenWrt daemon.notice netifd: Interface 'TUN' is now up
Sep  6 15:27:32 OpenWrt daemon.notice openvpn(sample_client)[7280]: TUN/TAP device tun0 opened
Sep  6 15:27:32 OpenWrt daemon.notice openvpn(sample_client)[7280]: TUN/TAP TX queue length set to 100
Sep  6 15:27:32 OpenWrt daemon.notice openvpn(sample_client)[7280]: /sbin/ifconfig tun0 10.1.1.3 pointopoint 10.1.1.2 mtu 1500
Sep  6 15:27:32 OpenWrt daemon.info dnsmasq[3163]: reading /tmp/resolv.conf.auto
Sep  6 15:27:32 OpenWrt daemon.info dnsmasq[3163]: using nameserver 192.168.1.1#53
Sep  6 15:27:32 OpenWrt daemon.info dnsmasq[3163]: using local addresses only for domain lan
Sep  6 15:27:32 OpenWrt daemon.notice openvpn(sample_client)[7280]: /sbin/route add -net 10.1.1.0 netmask 255.255.255.0 gw 10.1.1.2
Sep  6 15:27:32 OpenWrt daemon.notice openvpn(sample_client)[7280]: Initialization Sequence Completed
Sep  6 15:27:32 OpenWrt user.notice ifup: Enabling Router Solicitations on TUN (tun0)
Sep  6 15:27:33 OpenWrt user.info firewall: adding TUN (tun0) to zone tunzone

Ссылка

Похожие темы