Заранее извиняюсь, не оч хорошо разбираюсь в теме
Есть удаленный сервер на хостинге, хочу на нем установить личный vpn - сервер. От хостинга есть внутренний и внешний ip, список портов, порт для ssh и пароль от рута. Устанавливал по этой инструкции. Конкретно:
- Поставил centos 7 (потом еще пробовал debian 12 и centos 8, не сильно помогло), заменил устаревшие репозитории на эти и сделал
yum update
- Скачал предложенный скрипт, выдал ему права и запустил
- В процессе отключил ipv6, выбрал dns гугла (пробовал еще adguard и cloudflare) и сделал юзера без пароля.
- Скинул полученный конфиг юзера на систему клиента
На вид все системы, связанные с впном, работают правильно:
-bash-4.2# systemctl | grep VPN
iptables-openvpn.service loaded active exited iptables rules for OpenVPN
openvpn-server@server.service loaded active running OpenVPN service for server
-bash-4.2# systemctl status iptables-openvpn.service
● iptables-openvpn.service - iptables rules for OpenVPN
Loaded: loaded (/etc/systemd/system/iptables-openvpn.service; enabled; vendor preset: disabled)
Active: active (exited) since Sat 2024-08-24 00:22:16 BST; 41min ago
Process: 948 ExecStop=/etc/iptables/rm-openvpn-rules.sh (code=exited, status=0/SUCCESS)
Process: 954 ExecStart=/etc/iptables/add-openvpn-rules.sh (code=exited, status=0/SUCCESS)
Main PID: 954 (code=exited, status=0/SUCCESS)
CGroup: /system.slice/iptables-openvpn.service
Aug 24 00:22:16 vpn.vrvrpersonal.com systemd[1]: Stopped iptables rules for OpenVPN.
Aug 24 00:22:16 vpn.vrvrpersonal.com systemd[1]: Starting iptables rules for OpenVPN...
Aug 24 00:22:16 vpn.vrvrpersonal.com systemd[1]: Started iptables rules for OpenVPN.
-bash-4.2# systemctl status openvpn-server@server.service
● openvpn-server@server.service - OpenVPN service for server
Loaded: loaded (/etc/systemd/system/openvpn-server@.service; enabled; vendor preset: disabled)
Active: active (running) since Sat 2024-08-24 00:22:30 BST; 41min ago
Docs: man:openvpn(8)
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
https://community.openvpn.net/openvpn/wiki/HOWTO
Main PID: 968 (openvpn)
Status: "Initialization Sequence Completed"
CGroup: /system.slice/system-openvpn\x2dserver.slice/openvpn-server@server.service
└─968 /usr/sbin/openvpn --status /run/openvpn-server/status-server.log --status-version 2 --suppress-timestamps --config server.conf
Aug 24 00:52:09 vpn.vrvrpersonal.com openvpn[968]: MY_CLIENT_IP:1540 [vrvrpersonal] Peer Connection Initiated with [AF_INET]MY_CLIENT_IP:1540
Aug 24 00:52:09 vpn.vrvrpersonal.com openvpn[968]: vrvrpersonal/MY_CLIENT_IP:1540 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Aug 24 00:52:09 vpn.vrvrpersonal.com openvpn[968]: vrvrpersonal/MY_CLIENT_IP:1540 MULTI: Learn: 10.8.0.2 -> vrvrpersonal/MY_CLIENT_IP:1540
Aug 24 00:52:09 vpn.vrvrpersonal.com openvpn[968]: vrvrpersonal/MY_CLIENT_IP:1540 MULTI: primary virtual IP for vrvrpersonal/MY_CLIENT_IP:1540: 10.8.0.2
Aug 24 00:52:09 vpn.vrvrpersonal.com openvpn[968]: vrvrpersonal/MY_CLIENT_IP:1540 PUSH: Received control message: 'PUSH_REQUEST'
Aug 24 00:52:09 vpn.vrvrpersonal.com openvpn[968]: vrvrpersonal/MY_CLIENT_IP:1540 SENT CONTROL [vrvrpersonal]: 'PUSH_REPLY,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,i...S-128-GCM' (status=1)
Aug 24 00:52:09 vpn.vrvrpersonal.com openvpn[968]: vrvrpersonal/MY_CLIENT_IP:1540 Outgoing Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Aug 24 00:52:09 vpn.vrvrpersonal.com openvpn[968]: vrvrpersonal/MY_CLIENT_IP:1540 Incoming Data Channel: Cipher 'AES-128-GCM' initialized with 128 bit key
Aug 24 00:56:10 vpn.vrvrpersonal.com openvpn[968]: vrvrpersonal/MY_CLIENT_IP:1540 [vrvrpersonal] Inactivity timeout (--ping-restart), restarting
Aug 24 00:56:10 vpn.vrvrpersonal.com openvpn[968]: vrvrpersonal/MY_CLIENT_IP:1540 SIGUSR1[soft,ping-restart] received, client-instance restarting
Hint: Some lines were ellipsized, use -l to show in full.
На клиенте стоит windows 10, могу подключиться через openvpn, но тогда «пропадает» интернет. Сам сервер с клиента пингуется и с сервера инет есть (по крайней мере можно, например, скачать что-нибудь через wget). Пробовал включать, пока играл с друзьями с дискордом, в результате во время работы впна я их слышу, остаюсь в игре, но они меня не слышат и я не могу открывать сайты, скачивать что-то и тд.
Конфиг сервера:
port EXTERNAL_PORT
proto udp
dev tun
user nobody
group nobody
persist-key
persist-tun
keepalive 10 120
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "redirect-gateway def1 bypass-dhcp"
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key
crl-verify crl.pem
ca ca.crt
cert server_e91xjcnHwH1cpPqx.crt
key server_e91xjcnHwH1cpPqx.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
client-config-dir /etc/openvpn/ccd
status /var/log/openvpn/status.log
verb 3
Конфиг юзера:
client
proto udp
explicit-exit-notify
remote EXTERNAL_IP EXTERNAL_PORT
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
verify-x509-name server_e91xjcnHwH1cpPqx name
auth SHA256
auth-nocache
cipher AES-128-GCM
tls-client
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
ignore-unknown-option block-outside-dns
setenv opt block-outside-dns # Prevent Windows 10 DNS leak
verb 3
<ca>
-----BEGIN CERTIFICATE-----
SERTIFICATE
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
SERTIFICATE
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
KEY
-----END PRIVATE KEY-----
</key>
<tls-crypt>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
KEY
-----END OpenVPN Static key V1-----
</tls-crypt>
syslogа почему-то нет, откуда еще можно вытащить логи на стороне сервера - не знаю. Есть логи на стороне клиента:
[Aug 24, 2024, 02:40:56] SetupClient: signaling tun destroy event
⏎[Aug 24, 2024, 02:40:56] EVENT: DISCONNECTED ⏎[Aug 24, 2024, 02:41:10] OpenVPN core 3.10_qa win x86_64 64-bit OVPN-DCO built on Jul 17 2024 14:22:15
⏎[Aug 24, 2024, 02:41:10] Frame=512/2112/512 mssfix-ctrl=1250
⏎[Aug 24, 2024, 02:41:10] NOTE: This configuration contains options that were not used:
⏎[Aug 24, 2024, 02:41:10] Ignored by option 'ignore-unknown-option'
⏎[Aug 24, 2024, 02:41:10] 0 [block-outside-dns]
⏎[Aug 24, 2024, 02:41:10] Unsupported option (ignored)
⏎[Aug 24, 2024, 02:41:10] 0 [explicit-exit-notify]
⏎[Aug 24, 2024, 02:41:10] 1 [resolv-retry] [infinite]
⏎[Aug 24, 2024, 02:41:10] 2 [persist-key]
⏎[Aug 24, 2024, 02:41:10] 3 [persist-tun]
⏎[Aug 24, 2024, 02:41:10] EVENT: RESOLVE ⏎[Aug 24, 2024, 02:41:10] Contacting EXTERNAL_IP:EXTERNAL_PORT via UDP
⏎[Aug 24, 2024, 02:41:10] EVENT: WAIT ⏎[Aug 24, 2024, 02:41:10] WinCommandAgent: transmitting bypass route to EXTERNAL_IP
{
"host" : "EXTERNAL_IP",
"ipv6" : false
}
⏎[Aug 24, 2024, 02:41:10] Connecting to [EXTERNAL_IP]:EXTERNAL_PORT (EXTERNAL_IP) via UDP
⏎[Aug 24, 2024, 02:41:10] EVENT: CONNECTING ⏎[Aug 24, 2024, 02:41:10] Tunnel Options:V4,dev-type tun,link-mtu 1521,tun-mtu 1500,proto UDPv4,cipher AES-128-GCM,auth [null-digest],keysize 128,key-method 2,tls-client
⏎[Aug 24, 2024, 02:41:10] Creds: UsernameEmpty/PasswordEmpty
⏎[Aug 24, 2024, 02:41:10] Sending Peer Info:
IV_VER=3.10_qa
IV_PLAT=win
IV_NCP=2
IV_TCPNL=1
IV_PROTO=2974
IV_MTU=1600
IV_CIPHERS=AES-128-CBC:AES-192-CBC:AES-256-CBC:AES-128-GCM:AES-192-GCM:AES-256-GCM:CHACHA20-POLY1305
IV_AUTO_SESS=1
IV_GUI_VER=OCWindows_3.5.0-3818
IV_SSO=webauth,crtext
⏎[Aug 24, 2024, 02:41:10] SSL Handshake: peer certificate: CN=server_e91xjcnHwH1cpPqx, 256 bit EC, group:prime256v1, cipher: ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(128) Mac=AEAD
⏎[Aug 24, 2024, 02:41:10] Session is ACTIVE
⏎[Aug 24, 2024, 02:41:10] EVENT: GET_CONFIG ⏎[Aug 24, 2024, 02:41:10] Sending PUSH_REQUEST to server...
⏎[Aug 24, 2024, 02:41:10] OPTIONS:
0 [dhcp-option] [DNS] [8.8.8.8]
1 [dhcp-option] [DNS] [8.8.4.4]
2 [redirect-gateway] [def1]
3 [route-gateway] [10.8.0.1]
4 [topology] [subnet]
5 [ping] [10]
6 [ping-restart] [120]
7 [ifconfig] [10.8.0.2] [255.255.255.0]
8 [peer-id] [0]
9 [cipher] [AES-128-GCM]
⏎[Aug 24, 2024, 02:41:10] PROTOCOL OPTIONS:
cipher: AES-128-GCM
digest: none
key-derivation: OpenVPN PRF
compress: NONE
peer ID: 0
control channel: tls-crypt enabled
⏎[Aug 24, 2024, 02:41:10] EVENT: ASSIGN_IP ⏎[Aug 24, 2024, 02:41:10] CAPTURED OPTIONS:
Session Name: EXTERNAL_IP
Layer: OSI_LAYER_3
Remote Address: EXTERNAL_IP
Tunnel Addresses:
10.8.0.2/24 -> 10.8.0.1
Reroute Gateway: IPv4=1 IPv6=0 flags=[ ENABLE REROUTE_GW DEF1 IPv4 ]
Block IPv4: no
Block IPv6: no
Block local DNS: no
Add Routes:
Exclude Routes:
DNS Servers:
8.8.8.8
8.8.4.4
⏎[Aug 24, 2024, 02:41:11] SetupClient: transmitting tun setup list to \\.\pipe\agent_ovpnconnect
{
"allow_local_dns_resolvers" : false,
"confirm_event" : "b00f000000000000",
"destroy_event" : "ac0f000000000000",
"tun" :
{
"adapter_domain_suffix" : "",
"block_ipv6" : false,
"block_outside_dns" : false,
"dns_options" :
{
"servers" : {}
},
"dns_servers" :
[
{
"address" : "8.8.8.8",
"ipv6" : false
},
{
"address" : "8.8.4.4",
"ipv6" : false
}
],
"layer" : 3,
"mtu" : 0,
"remote_address" :
{
"address" : "EXTERNAL_IP",
"ipv6" : false
},
"reroute_gw" :
{
"flags" : 275,
"ipv4" : true,
"ipv6" : false
},
"route_metric_default" : -1,
"session_name" : "EXTERNAL_IP",
"tunnel_address_index_ipv4" : 0,
"tunnel_address_index_ipv6" : -1,
"tunnel_addresses" :
[
{
"address" : "10.8.0.2",
"gateway" : "10.8.0.1",
"ipv6" : false,
"metric" : -1,
"net30" : false,
"prefix_length" : 24
}
]
},
"tun_type" : 0
}
POST np://[\\.\pipe\agent_ovpnconnect]/tun-setup : 200 OK
TAP ADAPTERS:
guid='{9902C2FF-200B-4944-91BB-240D651D9D24}' index=14 name='Подключение по локальной сети 2'
Open TAP device "Подключение по локальной сети 2" PATH="\\.\Global\{9902C2FF-200B-4944-91BB-240D651D9D24}.tap" SUCCEEDED
TAP-Windows Driver Version 9.27
ActionDeleteAllRoutesOnInterface iface_index=14
netsh interface ip set interface 14 metric=9000
ОК.
netsh interface ip set address 14 static 10.8.0.2 255.255.255.0 gateway=10.8.0.1 store=active
netsh interface ip add route EXTERNAL_IP/32 2 192.168.0.1 store=active
Этот объект уже существует.
netsh interface ip add route 0.0.0.0/1 14 10.8.0.1 store=active
ОК.
netsh interface ip add route 128.0.0.0/1 14 10.8.0.1 store=active
ОК.
netsh interface ip set dnsservers 14 static 8.8.8.8 register=primary validate=no
netsh interface ip add dnsservers 14 8.8.4.4 2 validate=no
NRPT::ActionCreate pid=[1012] domains=[] dns_servers=[8.8.8.8,8.8.4.4] dnssec=[0] id=[OpenVPNDNSRouting-1012]
ActionBase openvpn_app_path=C:\Program Files\OpenVPN Connect\OpenVPNConnect.exe tap_index=14 enable=1
permit IPv4 requests from OpenVPN app
permit IPv6 requests from OpenVPN app
block IPv4 requests from other apps
block IPv6 requests from other apps
allow IPv4 traffic from TAP
allow IPv6 traffic from TAP
block IPv4 DNS requests to loopback from other apps
block IPv6 DNS requests to loopback from other apps
ipconfig /flushdns
Настройка протокола IP для Windows
Кэш сопоставителя DNS успешно очищен.
TAP: ARP flush succeeded
TAP handle: 700f000000000000
⏎[Aug 24, 2024, 02:41:11] Connected via TUN_WIN
⏎[Aug 24, 2024, 02:41:11] EVENT: CONNECTED EXTERNAL_IP:EXTERNAL_PORT (EXTERNAL_IP) via /UDP on TUN_WIN/10.8.0.2/ gw=[10.8.0.1/] mtu=(default)⏎[Aug 24, 2024, 02:41:23] SetupClient: signaling tun destroy event
⏎[Aug 24, 2024, 02:41:23] EVENT: DISCONNECTED ⏎
Пробовал смотреть через tcpdump -eni any port. На 53 порту тишина, на порте, который я выбрал для впна, пакеты идут. На стороне клиента, когда я подключен к впну, появляются ipшники DNS - серверов в локальной сети 2. На всякий случай еще пробовал полностью вырубать брандмауэр на винде, не помогает
Из-за чего может быть эта проблема и что делать с ней?
Этот сервер у меня уже года 3, в начале он точно работал хорошо, когда именно начались проблемы - сказать точно не могу, но до сегодняшнего дня я по ssh-у его и не трогал