Есть openvpn-сервер на Centos 7. Его конфиг:
cat /etc/openvpn/server.conf
port 11000
proto udp
dev tun
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/VPN-October.crt
key /etc/openvpn/server/VPN-October.key
dh /etc/openvpn/server/dh2048.pem
tls-auth /etc/openvpn/server/ta.key 0
tls-server
tls-timeout 120
cipher AES-256-CBC
server 10.0.0.0 255.255.255.0
route 192.168.1.1 255.255.255.0
ifconfig-pool-persist ipp.txt
client-to-client
client-config-dir /usr/local/etc/ccd
keepalive 10 120
comp-lzo
tun-mtu 1500
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log /var/log/openvpn/openvpn.log
verb 3
user nobody
group nobodyВ директорию с клиентскими настройками лежит файл с адресом для конкретного клиента:
cat /usr/local/etc/ccd/client
ifconfig-push 10.0.0.10 10.0.0.09Сертификаты и ключи из конфига лежат в указанных местах.
Есть клиент на винде, его конфиг:
client
proto udp
remote-cert-tls server
tls-auth ta.key 1
dev tun
remote XX.XX.XX.XXX
port 11000
cipher AES-256-CBC
auth-nocache
verb 2
mute 20
keepalive 10 120
comp-lzo
persist-key
persist-tun
float
resolv-retry infinite
nobindКлиент замечательно подключается к серверу. Но IP-адрес - только ближайший 10.0.0.6. Лог при этом такой:
Tue Oct 23 20:41:56 2018 OpenVPN 2.4.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Sep 26 2017
Tue Oct 23 20:41:56 2018 Windows version 6.1 (Windows 7) 64bit
Tue Oct 23 20:41:56 2018 library versions: OpenSSL 1.0.2l 25 May 2017, LZO 2.10
Enter Management Password:
Tue Oct 23 20:41:57 2018 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct 23 20:41:57 2018 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct 23 20:41:57 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]XX.XX.XX.XXX:11000
Tue Oct 23 20:41:57 2018 UDP link local: (not bound)
Tue Oct 23 20:41:57 2018 UDP link remote: [AF_INET]XX.XX.XX.XXX:11000
Tue Oct 23 20:41:57 2018 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=EasyRSA, emailAddress=me@myhost.mydomain
Tue Oct 23 20:41:57 2018 VERIFY KU OK
Tue Oct 23 20:41:57 2018 Validating certificate extended key usage
Tue Oct 23 20:41:57 2018 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Oct 23 20:41:57 2018 VERIFY EKU OK
Tue Oct 23 20:41:57 2018 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=VPN-October, name=EasyRSA, emailAddress=me@myhost.mydomain
Tue Oct 23 20:41:57 2018 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue Oct 23 20:41:57 2018 [VPN-October] Peer Connection Initiated with [AF_INET]XX.XX.XX.XXX:11000
Tue Oct 23 20:41:58 2018 Data Channel: using negotiated cipher 'AES-256-GCM'
Tue Oct 23 20:41:58 2018 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Oct 23 20:41:58 2018 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Oct 23 20:41:58 2018 open_tun
Tue Oct 23 20:41:58 2018 TAP-WIN32 device [Подключение по локальной сети 2] opened: \\.\Global\{7C109FB5-CF23-4F63-B80A-F75CD14A6BAB}.tap
Tue Oct 23 20:41:58 2018 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.0.0.6/255.255.255.252 on interface {7C109FB5-CF23-4F63-B80A-F75CD14A6BAB} [DHCP-serv: 10.0.0.5, lease-time: 31536000]
Tue Oct 23 20:41:58 2018 Successful ARP Flush on interface [20] {7C109FB5-CF23-4F63-B80A-F75CD14A6BAB}
Tue Oct 23 20:41:58 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Tue Oct 23 20:42:03 2018 Initialization Sequence CompletedНа точно таком же сервере до этого работало присвоение статичного IP на виндовом клиенте (этом же), сейчас - нет. Конфиги делаю одинаковыми, результат - разный.
Пробовала сделать еще один сертификат для линуксовского клиента, создаем сертификат, добавляем в /usr/local/etc/ccd/client2018092107 запись, замечательно подключается с указанным IP. Логи подключения:
окт 23 21:03:50 client-centos openvpn[10700]: Tue Oct 23 21:03:50 2018 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
окт 23 21:03:50 client-centos openvpn[10700]: Tue Oct 23 21:03:50 2018 [VPN-October] Peer Connection Initiated with [AF_INET]XX.XX.XX.XXX:11000
окт 23 21:03:51 client-centos openvpn[10700]: Tue Oct 23 21:03:51 2018 Data Channel: using negotiated cipher 'AES-256-GCM'
окт 23 21:03:51 client-centos openvpn[10700]: Tue Oct 23 21:03:51 2018 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
окт 23 21:03:51 client-centos openvpn[10700]: Tue Oct 23 21:03:51 2018 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
окт 23 21:03:51 client-centos openvpn[10700]: Tue Oct 23 21:03:51 2018 TUN/TAP device tun0 opened
окт 23 21:03:51 client-centos openvpn[10700]: Tue Oct 23 21:03:51 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
окт 23 21:03:51 client-centos openvpn[10700]: Tue Oct 23 21:03:51 2018 /sbin/ip link set dev tun0 up mtu 1500
окт 23 21:03:51 client-centos openvpn[10700]: Tue Oct 23 21:03:51 2018 /sbin/ip addr add dev tun0 local 10.0.0.14 peer 10.0.0.13
окт 23 21:03:51 client-centos openvpn[10700]: Tue Oct 23 21:03:51 2018 Initialization Sequence CompletedКонфиг сентосного клиента:
# cat /etc/openvpn/client-centos.conf
client
proto udp
remote-cert-tls server
tls-auth ta.key 1
dev tun
remote XX.XX.XX.XXX 11000
cipher AES-256-CBC
auth-nocache
verb 2
mute 20
keepalive 10 120
comp-lzo
persist-key
persist-tun
float
resolv-retry infinite
nobind Куда посмотреть, чтобы найти косяк?
