Добрый день!
Прошу подсказки, уже всё перерыл и застрял!
Имею сервер с OpenVPN с двумя интерфейсами.
В локальной сети eno2 192.168.5.5,
внешний enp23s0 XX.XX.XXX.XXX
За сервером локальная сеть 192.168.5.0 (23)
Сервер на Debian 11.0, openvpn - 2.5.1-3
Есть внешний сотрудник (Windows 11, OpenVPN 2.6.3) с IP 37.208.60.170, который должен подключаться по RDP к компьютерам в локальной сети.
При подключении VPN канал создается, на стороне клиента ошибок нет, но к локальными компьютерам подключения нет - не видит локальной сети.
В логе на сервере openvpn.log валятся записи:
…
RwRwRwRwRwRwRwRwRwRRama/37.208.60.170:49972 MULTI: bad source address from client [::], packet dropped
RwRRama/37.208.60.170:49972 MULTI: bad source address from client [], packet dropped
Подключение производится по TCP, но вначале пробовал подключаться по UDP - проблема одинаковая.
Не могу понять почему, что ему не нравится в адресе клиента.
Пинги со стороны клиента идут до 10.8.0.1
Конфиг на севере server.conf
port 1194
proto tcp-server
dev tun
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/issued/server.crt
key /etc/openvpn/server/private/server.key
remote-cert-tls client
tls-auth /etc/openvpn/server/ta.key 0
dh /etc/openvpn/server/dh.pem
topology subnet
server 10.8.0.0 255.255.255.0
push «route 192.168.5.0 255.255.254.0»
push «redirect-gateway def1 bypass-dhcp»
;push «dhcp-option DNS 192.168.5.1»
;push «dhcp-option DNS 192.168.5.2»
ifconfig-pool-persist /var/log/openvpn/ipp.txt
keepalive 10 120
;duplicate-cn
cipher AES-256-GCM
auth SHA256
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log /var/log/openvpn/openvpn.log
verb 5
Конфиг клиента ama.ovpn
client
dev tun
proto tcp-client
remote XX.XX.XXX.XXX 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca «C:\Program Files\OpenVPN\config\ca.crt»
cert «C:\Program Files\OpenVPN\config\ama.crt»
key «C:\Program Files\OpenVPN\config\ama.key»
remote-cert-tls server
chiper AES-256-GCM
auth SHA512
verb 3
key-direction 1
auth-nocache
iptables
-A INPUT -p tcp -m tcp –dport 1194 -j ACCEPT
-A FORWARD -i eno2 -o tun0 -j ACCEPT
-A FORWARD -i tun0 -o eno2 -j ACCEPT
-A POSTROUTING -o enp23s0 -j MASQUERADE
лог openvpn.log
…
MULTI: TCP INIT maxclients=1024 maxevents=1028
Initialization Sequence Completed
MULTI: multi_create_instance called
Re-using SSL/TLS context
Outgoing Control Channel Authentication: Using 256 bit message hash ‘SHA256’ for HMAC authentication
Incoming Control Channel Authentication: Using 256 bit message hash ‘SHA256’ for HMAC authentication
Control Channel MTU parms [ L:1623 D:1170 EF:80 EB:0 ET:0 EL:3 ]
Data Channel MTU parms [ L:1623 D:1450 EF:123 EB:406 ET:0 EL:3 ]
Local Options String (VER=V4): ‘V4,dev-type tun,link-mtu 1551,tun-mtu 1500,proto TCPv4_SERVER,keydir 0,cipher AES-256-GCM,auth [null-digest],keysize 256,tls-auth,key-method 2,tls-server’
Expected Remote Options String (VER=V4): ‘V4,dev-type tun,link-mtu 1551,tun-mtu 1500,proto TCPv4_CLIENT,keydir 1,cipher AES-256-GCM,auth [null-digest],keysize 256,tls-auth,key-method 2,tls-client’
TCP connection established with [AF_INET]37.208.60.170:58304
TCPv4_SERVER link local: (not bound)
TCPv4_SERVER link remote: [AF_INET]37.208.60.170:58304
R37.208.60.170:58304 TLS: Initial packet from [AF_INET]37.208.60.170:58304, sid=357eb922 ba42e775
WRWWWWRRRWR37.208.60.170:58304 VERIFY OK: depth=1, CN=Easy-RSA CA
37.208.60.170:58304 VERIFY KU OK
37.208.60.170:58304 Validating certificate extended key usage
37.208.60.170:58304 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
37.208.60.170:58304 VERIFY EKU OK
37.208.60.170:58304 VERIFY OK: depth=0, CN=ama
WR37.208.60.170:58304 peer info: IV_VER=2.6.3
37.208.60.170:58304 peer info: IV_PLAT=win
37.208.60.170:58304 peer info: IV_TCPNL=1
37.208.60.170:58304 peer info: IV_MTU=1600
37.208.60.170:58304 peer info: IV_NCP=2
37.208.60.170:58304 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305
37.208.60.170:58304 peer info: IV_PROTO=990
37.208.60.170:58304 peer info: IV_GUI_VER=OpenVPN_GUI_11
37.208.60.170:58304 peer info: IV_SSO=openurl,webauth,crtext
WRR37.208.60.170:58304 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
37.208.68.171:58304 [ama] Peer Connection Initiated with [AF_INET]37.208.60.170:58304
ama/37.208.60.170:58304 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
ama/37.208.60.170:58304 MULTI: Learn: 10.8.0.2 -> ama/37.208.60.170:58304
ama/37.208.60.170:58304 MULTI: primary virtual IP for ama37.208.60.170:58304: 10.8.0.2
ama/37.208.60.170:58304 Outgoing Data Channel: Cipher ‘AES-256-GCM’ initialized with 256 bit key
ama/37.208.60.170:58304 Incoming Data Channel: Cipher ‘AES-256-GCM’ initialized with 256 bit key
ama/37.208.60.170:58304 SENT CONTROL [ama]: ‘PUSH_REPLY,route 192.168.5.0 255.255.254.0,redirect-gateway def1 bypass-dhcp,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM’ (status=1)
WRRRama/37.208.60.170:58304 MULTI: bad source address from client [::], packet dropped
RRRRRRRRRRRRRRRRRRRwRwRRwRwRwRRRwRRRwRwRwRwRwRRama/37.208.60.170:58304 MULTI: bad source address from client [], packet dropped
RwRwRwRwRwRwRwRwRwRwRwR
…
