Здравствуйте! Настраиваю VPN для доступа к корпоративной сети удаленно и получаю ошибку при подключении.
Вводные:
1. Белый айпи на роутере 77.77.77.77 2. OpenVPN и easyrsa на Ubuntu Server 3. Клиентская машина на Win10 4. WinServer на который пихаю маршрутыОшибка при отключении TLS:
VERIFY ERROR: depth=1, error=self-signed certificate in certificate chain: C=TW, ST=TW, L=Taipei, O=ASUS, CN=RT00, emailAddress=me@myhost.mydomain Sent fatal SSL alert: unknown CA OpenSSL: error:0A000086:SSL routines::certificate verify failed: TLS_ERROR: BIO read tls_read_plaintext error TLS Error: TLS object -> incoming plaintext read error TLS Error: TLS handshake failed
Ошибка при включении TLS:
TLS Error: cannot locate HMAC in incoming packet from [AF_INET]77.77.77.77:1194
Конфигурация сервера:
port 1194 proto udp4 dev tun ca ca.crt cert server.crt key server.key dh dh.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist /var/log/openvpn/ipp.txt push «route 10.8.0.0 255.255.255.0» push «route 192.168.10.0 255.255.255.0» push «dhcp-option DNS 192.168.10.1» push «dhcp-option DNS 192.168.10.2» push «dhcp-option DOMAIN site.ru» keepalive 10 120 tls-auth ta.key 0 cipher AES-256-GCM auth SHA256 persist-key persist-tun status /var/log/openvpn/openvpn-status.log verb 3 explicit-exit-notify 1
Конфигурация клиента:
client dev tun proto udp remote 77.77.77.77 1194 resolv-retry infinite nobind persist-key persist-tun ca ca.crt cert putilovpavel.crt key putilovpavel.key remote-cert-tls server tls-auth ta.key 1 cipher AES-256-GCM auth SHA256 verb 3
Лог сервера: 2024-08-23 09:49:11 OpenVPN 2.5.9 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jun 27 2024 2024-08-23 09:49:11 library versions: OpenSSL 3.0.2 15 Mar 2022, LZO 2.10 2024-08-23 09:49:11 net_route_v4_best_gw query: dst 0.0.0.0 2024-08-23 09:49:11 net_route_v4_best_gw result: via 192.168.10.2 dev eth0 2024-08-23 09:49:11 Diffie-Hellman initialized with 2048 bit key 2024-08-23 09:49:11 net_route_v4_best_gw query: dst 0.0.0.0 2024-08-23 09:49:11 net_route_v4_best_gw result: via 192.168.10.2 dev eth0 2024-08-23 09:49:11 ROUTE_GATEWAY 192.168.10.2/255.255.255.0 IFACE=eth0 HWADDR=00:15:55:00:c1:0a 2024-08-23 09:49:11 TUN/TAP device tun0 opened 2024-08-23 09:49:11 net_iface_mtu_set: mtu 1500 for tun0 2024-08-23 09:49:11 net_iface_up: set tun0 up 2024-08-23 09:49:11 net_addr_ptp_v4_add: 10.8.0.1 peer 10.8.0.2 dev tun0 2024-08-23 09:49:11 net_route_v4_add: 10.8.0.0/24 via 10.8.0.2 dev [NULL] table 0 metric -1 2024-08-23 09:49:11 Socket Buffers: R=[212992->212992] S=[212992->212992] 2024-08-23 09:49:11 UDPv4 link local (bound): [AF_INET][undef]:1194 2024-08-23 09:49:11 UDPv4 link remote: [AF_UNSPEC] 2024-08-23 09:49:11 MULTI: multi_init called, r=256 v=256 2024-08-23 09:49:11 IFCONFIG POOL IPv4: base=10.8.0.4 size=62 2024-08-23 09:49:11 IFCONFIG POOL LIST 2024-08-23 09:49:11 Initialization Sequence Completed Лог клиента: 2024-08-23 09:59:30 OpenVPN 2.6.12 [git:v2.6.12/038a94bae57a446c] Windows [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] [DCO] built on Jul 18 2024 2024-08-23 09:59:30 Windows version 10.0 (Windows 10 or greater), amd64 executable 2024-08-23 09:59:30 library versions: OpenSSL 3.3.1 4 Jun 2024, LZO 2.10 2024-08-23 09:59:30 DCO version: 1.2.1 2024-08-23 09:59:30 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25343 2024-08-23 09:59:30 Need hold release from management interface, waiting... 2024-08-23 09:59:30 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:55831 2024-08-23 09:59:30 MANAGEMENT: CMD 'state on' 2024-08-23 09:59:30 MANAGEMENT: CMD 'log on all' 2024-08-23 09:59:30 MANAGEMENT: CMD 'echo on all' 2024-08-23 09:59:30 MANAGEMENT: CMD 'bytecount 5' 2024-08-23 09:59:30 MANAGEMENT: CMD 'state' 2024-08-23 09:59:30 MANAGEMENT: CMD 'hold off' 2024-08-23 09:59:30 MANAGEMENT: CMD 'hold release' 2024-08-23 09:59:30 TCP/UDP: Preserving recently used remote address: [AF_INET]77.77.77.77:1194 2024-08-23 09:59:30 ovpn-dco device [OpenVPN Data Channel Offload] opened 2024-08-23 09:59:30 UDPv4 link local: (not bound) 2024-08-23 09:59:30 UDPv4 link remote: [AF_INET]77.77.77.77:1194 2024-08-23 09:59:30 MANAGEMENT: >STATE:1724389170,WAIT,,,,,, 2024-08-23 09:59:30 MANAGEMENT: >STATE:1724389170,AUTH,,,,,, 2024-08-23 09:59:30 TLS: Initial packet from [AF_INET]77.77.77.77:1194, sid=22fc2c4e 1bec2c81 2024-08-23 09:59:31 VERIFY ERROR: depth=1, error=self-signed certificate in certificate chain: C=TW, ST=TW, L=Taipei, O=ASUS, CN=RT-N00 2024-08-23 09:59:31 Sent fatal SSL alert: unknown CA 2024-08-23 09:59:31 OpenSSL: error:0A000086:SSL routines::certificate verify failed: 2024-08-23 09:59:31 TLS_ERROR: BIO read tls_read_plaintext error 2024-08-23 09:59:31 TLS Error: TLS object -> incoming plaintext read error 2024-08-23 09:59:31 TLS Error: TLS handshake failed 2024-08-23 09:59:31 Closing DCO interface 2024-08-23 09:59:31 SIGUSR1[soft,tls-error] received, process restarting 2024-08-23 09:59:31 MANAGEMENT: >STATE:1724389171,RECONNECTING,tls-error,,,,, 2024-08-23 09:59:31 Restart pause, 1 second(s)
Прошу помочь с решением проблемы, предпринимал различные попытки и рекомендации, но ни к чему это не привело. Примененные настройки:
1. Проброс портов на роутере 2. net.ipv4.ip_forward=1 3. iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
