LINUX.ORG.RU

Сообщения Igor_B

 

OpenVPN нет пакетов для клиента

Настроен openvpn сервер на отдельной машине на хостинге - проблема в том, что клиенту не проходят пакеты после установления соединения (хотя во время установления - очень даже проходят).

Порт форвардинг включен, ufw настроен - и все равно. Что еще можно и нужно посмотреть?

Версии

Ubuntu 22.04.2

OpenVPN 2.5.9 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jun 27 2024
library versions: OpenSSL 3.0.2 15 Mar 2022, LZO 2.10

Логи клиента

2024-09-23 13:19:38.246711 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:63081
2024-09-23 13:19:38.262125 MANAGEMENT: CMD 'pid'
2024-09-23 13:19:38.262184 MANAGEMENT: CMD 'auth-retry interact'
2024-09-23 13:19:38.262224 MANAGEMENT: CMD 'state on'
2024-09-23 13:19:38.262260 MANAGEMENT: CMD 'state'
2024-09-23 13:19:38.262322 MANAGEMENT: CMD 'bytecount 1'
2024-09-23 13:19:38.264114 *Tunnelblick: Established communication with OpenVPN
2024-09-23 13:19:38.264646 *Tunnelblick: >INFO:OpenVPN Management Interface Version 1 -- type 'help' for more info
2024-09-23 13:19:38.265446 MANAGEMENT: CMD 'hold release'
2024-09-23 13:19:38.267023 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2024-09-23 13:19:38.274824 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2024-09-23 13:19:38.274897 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2024-09-23 13:19:38.274908 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2024-09-23 13:19:38.274920 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2024-09-23 13:19:38.275623 Control Channel MTU parms [ L:1621 D:1156 EF:94 EB:0 ET:0 EL:3 ]
2024-09-23 13:19:38.275664 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
2024-09-23 13:19:38.275688 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1549,tun-mtu 1500,proto UDPv4,keydir 1,cipher AES-256-GCM,auth [null-digest],keysize 256,key-method 2,tls-client'
2024-09-23 13:19:38.275700 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1549,tun-mtu 1500,proto UDPv4,keydir 0,cipher AES-256-GCM,auth [null-digest],keysize 256,key-method 2,tls-server'
2024-09-23 13:19:38.275717 TCP/UDP: Preserving recently used remote address: [AF_INET]5.180.55.57:1194
2024-09-23 13:19:38.275778 Socket Buffers: R=[786896->786896] S=[9216->9216]
2024-09-23 13:19:38.275795 UDP link local: (not bound)
2024-09-23 13:19:38.275805 UDP link remote: [AF_INET]5.180.55.57:1194
2024-09-23 13:19:38.275825 MANAGEMENT: >STATE:1727086778,WAIT,,,,,,
2024-09-23 13:19:38.275945 UDP WRITE [54] to [AF_INET]5.180.55.57:1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=358 DATA len=40
2024-09-23 13:19:38.340408 UDP READ [66] from [AF_INET]5.180.55.57:1194: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ ] pid=358 DATA len=52
2024-09-23 13:19:38.340488 MANAGEMENT: >STATE:1727086778,AUTH,,,,,,
2024-09-23 13:19:38.340507 TLS: Initial packet from [AF_INET]5.180.55.57:1194, sid=c5752139 307aae59
2024-09-23 13:19:38.340654 UDP WRITE [62] to [AF_INET]5.180.55.57:1194: P_ACK_V1 kid=0 [ ]
2024-09-23 13:19:38.340937 UDP WRITE [331] to [AF_INET]5.180.55.57:1194: P_CONTROL_V1 kid=0 [ ] pid=870 DATA len=317
2024-09-23 13:19:38.410280 UDP READ [1128] from [AF_INET]5.180.55.57:1194: P_CONTROL_V1 kid=0 [ ] pid=614 DATA len=1114
2024-09-23 13:19:38.411018 UDP WRITE [62] to [AF_INET]5.180.55.57:1194: P_ACK_V1 kid=0 [ ]
2024-09-23 13:19:38.411277 UDP READ [1116] from [AF_INET]5.180.55.57:1194: P_CONTROL_V1 kid=0 [ ] pid=870 DATA len=1102
2024-09-23 13:19:38.412124 VERIFY OK: depth=1, CN=Easy-RSA CA
2024-09-23 13:19:38.412493 VERIFY KU OK
2024-09-23 13:19:38.412505 Validating certificate extended key usage
2024-09-23 13:19:38.412515 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2024-09-23 13:19:38.412523 VERIFY EKU OK
2024-09-23 13:19:38.412530 VERIFY OK: depth=0, CN=server
2024-09-23 13:19:38.412594 UDP WRITE [62] to [AF_INET]5.180.55.57:1194: P_ACK_V1 kid=0 [ ]
2024-09-23 13:19:38.412722 UDP READ [313] from [AF_INET]5.180.55.57:1194: P_CONTROL_V1 kid=0 [ ] pid=1126 DATA len=299
2024-09-23 13:19:38.422314 UDP WRITE [1128] to [AF_INET]5.180.55.57:1194: P_CONTROL_V1 kid=0 [ ] pid=1638 DATA len=1114
2024-09-23 13:19:38.422661 UDP WRITE [1116] to [AF_INET]5.180.55.57:1194: P_CONTROL_V1 kid=0 [ ] pid=1894 DATA len=1102
2024-09-23 13:19:38.422757 UDP WRITE [546] to [AF_INET]5.180.55.57:1194: P_CONTROL_V1 kid=0 [ ] pid=2150 DATA len=532
2024-09-23 13:19:38.485783 UDP READ [62] from [AF_INET]5.180.55.57:1194: P_ACK_V1 kid=0 [ ]
2024-09-23 13:19:38.493253 UDP READ [224] from [AF_INET]5.180.55.57:1194: P_CONTROL_V1 kid=0 [ ] pid=1638 DATA len=210
2024-09-23 13:19:38.493525 UDP WRITE [62] to [AF_INET]5.180.55.57:1194: P_ACK_V1 kid=0 [ ]
2024-09-23 13:19:38.493704 UDP READ [294] from [AF_INET]5.180.55.57:1194: P_CONTROL_V1 kid=0 [ ] pid=1894 DATA len=280
2024-09-23 13:19:38.493865 UDP WRITE [62] to [AF_INET]5.180.55.57:1194: P_ACK_V1 kid=0 [ ]
2024-09-23 13:19:38.493918 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
2024-09-23 13:19:38.493948 [server] Peer Connection Initiated with [AF_INET]5.180.55.57:1194
2024-09-23 13:19:39.779760 MANAGEMENT: >STATE:1727086779,GET_CONFIG,,,,,,
2024-09-23 13:19:39.779982 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
2024-09-23 13:19:39.780225 UDP WRITE [89] to [AF_INET]5.180.55.57:1194: P_CONTROL_V1 kid=0 [ ] pid=2918 DATA len=75
2024-09-23 13:19:39.847404 UDP READ [62] from [AF_INET]5.180.55.57:1194: P_ACK_V1 kid=0 [ ]
2024-09-23 13:19:39.847557 UDP READ [294] from [AF_INET]5.180.55.57:1194: P_CONTROL_V1 kid=0 [ ] pid=2406 DATA len=280
2024-09-23 13:19:39.847997 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5,peer-id 0,cipher AES-256-GCM'
2024-09-23 13:19:39.848138 OPTIONS IMPORT: timers and/or timeouts modified
2024-09-23 13:19:39.848160 OPTIONS IMPORT: --ifconfig/up options modified
2024-09-23 13:19:39.848174 OPTIONS IMPORT: route options modified
2024-09-23 13:19:39.848189 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2024-09-23 13:19:39.848202 OPTIONS IMPORT: peer-id set
2024-09-23 13:19:39.848219 OPTIONS IMPORT: adjusting link_mtu to 1624
2024-09-23 13:19:39.848233 OPTIONS IMPORT: data channel crypto options modified
2024-09-23 13:19:39.848259 Data Channel MTU parms [ L:1552 D:1450 EF:52 EB:406 ET:0 EL:3 ]
2024-09-23 13:19:39.848482 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2024-09-23 13:19:39.848508 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2024-09-23 13:19:39.848826 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
2024-09-23 13:19:39.848968 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
2024-09-23 13:19:39.849006 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
2024-09-23 13:19:39.849040 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
2024-09-23 13:19:39.849073 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
2024-09-23 13:19:39.849109 Opening utun (connect(AF_SYS_CONTROL)): Resource busy (errno=16)
2024-09-23 13:19:39.873958 Opened utun device utun6
2024-09-23 13:19:39.874050 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
2024-09-23 13:19:39.874068 MANAGEMENT: >STATE:1727086779,ASSIGN_IP,,10.8.0.6,,,,
2024-09-23 13:19:39.874107 /sbin/ifconfig utun6 delete
                           ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2024-09-23 13:19:39.886604 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2024-09-23 13:19:39.886642 /sbin/ifconfig utun6 10.8.0.6 10.8.0.5 mtu 1500 netmask 255.255.255.255 up
2024-09-23 13:19:39.906470 /sbin/route add -net 5.180.55.57 192.168.0.1 255.255.255.255
                           add net 5.180.55.57: gateway 192.168.0.1
2024-09-23 13:19:39.926258 /sbin/route add -net 0.0.0.0 10.8.0.5 128.0.0.0
                           add net 0.0.0.0: gateway 10.8.0.5
2024-09-23 13:19:39.936503 /sbin/route add -net 128.0.0.0 10.8.0.5 128.0.0.0
                           add net 128.0.0.0: gateway 10.8.0.5
2024-09-23 13:19:39.939134 MANAGEMENT: >STATE:1727086779,ADD_ROUTES,,,,,,
2024-09-23 13:19:39.939174 /sbin/route add -net 10.8.0.1 10.8.0.5 255.255.255.255
                           add net 10.8.0.1: gateway 10.8.0.5
                           13:19:39 *Tunnelblick:  **********************************************
                           13:19:39 *Tunnelblick:  Start of output from client.up.tunnelblick.sh
                           13:19:42 *Tunnelblick:  Retrieved from OpenVPN: name server(s) [ 208.67.222.222 208.67.220.220 ], search domain(s) [ ] and SMB server(s) [ ] and using default domain name [ openvpn ]
                           13:19:42 *Tunnelblick:  Not aggregating ServerAddresses because running on macOS 10.6 or higher
                           13:19:42 *Tunnelblick:  Setting search domains to 'openvpn' because the search domains were not set manually (or are allowed to be changed) and 'Prepend domain name to search domains' was not selected
                           13:19:43 *Tunnelblick:  Saved the DNS and SMB configurations so they can be restored
                           13:19:43 *Tunnelblick:  Changed DNS ServerAddresses setting from '192.168.0.1' to '208.67.222.222 208.67.220.220'
                           13:19:43 *Tunnelblick:  Changed DNS SearchDomains setting from '' to 'openvpn'
                           13:19:43 *Tunnelblick:  Changed DNS DomainName setting from '' to 'openvpn'
                           13:19:43 *Tunnelblick:  Did not change SMB NetBIOSName setting of ''
                           13:19:43 *Tunnelblick:  Did not change SMB Workgroup setting of ''
                           13:19:43 *Tunnelblick:  Did not change SMB WINSAddresses setting of ''
                           13:19:43 *Tunnelblick:  DNS servers '208.67.222.222 208.67.220.220' will be used for DNS queries when the VPN is active
                           13:19:43 *Tunnelblick:  The DNS servers include only free public DNS servers known to Tunnelblick.
                           13:19:43 *Tunnelblick:  Flushed the DNS cache via dscacheutil
                           13:19:43 *Tunnelblick:  /usr/sbin/discoveryutil not present. Not flushing the DNS cache via discoveryutil
                           13:19:43 *Tunnelblick:  Notified mDNSResponder that the DNS cache was flushed
                           13:19:43 *Tunnelblick:  Notified mDNSResponderHelper that the DNS cache was flushed
                           13:19:43 *Tunnelblick:  Setting up to monitor system configuration with process-network-changes
                           13:19:43 *Tunnelblick:  End of output from client.up.tunnelblick.sh
                           13:19:43 *Tunnelblick:  **********************************************
2024-09-23 13:19:43.685534 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2024-09-23 13:19:43.685541 Initialization Sequence Completed
2024-09-23 13:19:43.685563 MANAGEMENT: >STATE:1727086783,CONNECTED,SUCCESS,10.8.0.6,5.180.55.57,1194,,
2024-09-23 13:19:43.685610 UDP WRITE [62] to [AF_INET]5.180.55.57:1194: P_ACK_V1 kid=0 [ ]
2024-09-23 13:19:43.685684 UDP READ [294] from [AF_INET]5.180.55.57:1194: P_CONTROL_V1 kid=0 [ ] pid=2662 DATA len=280
2024-09-23 13:19:43.685709 UDP WRITE [62] to [AF_INET]5.180.55.57:1194: P_ACK_V1 kid=0 [ ]
2024-09-23 13:19:43.685737 UDP WRITE [88] to [AF_INET]5.180.55.57:1194: P_DATA_V2 kid=0 DATA len=87
2024-09-23 13:19:43.685756 UDP WRITE [88] to [AF_INET]5.180.55.57:1194: P_DATA_V2 kid=0 DATA len=87
2024-09-23 13:19:43.685774 UDP WRITE [88] to [AF_INET]5.180.55.57:1194: P_DATA_V2 kid=0 DATA len=87
2024-09-23 13:19:43.685835 UDP WRITE [88] to [AF_INET]5.180.55.57:1194: P_DATA_V2 kid=0 DATA len=87
2024-09-23 13:19:43.685855 UDP WRITE [88] to [AF_INET]5.180.55.57:1194: P_DATA_V2 kid=0 DATA len=87
2024-09-23 13:19:43.685874 UDP WRITE [88] to [AF_INET]5.180.55.57:1194: P_DATA_V2 kid=0 DATA len=87
2024-09-23 13:19:43.685892 UDP WRITE [88] to [AF_INET]5.180.55.57:1194: P_DATA_V2 kid=0 DATA len=87
2024-09-23 13:19:43.685920 UDP WRITE [88] to [AF_INET]5.180.55.57:1194: P_DATA_V2 kid=0 DATA len=87
2024-09-23 13:19:43.685937 UDP WRITE [88] to [AF_INET]5.180.55.57:1194: P_DATA_V2 kid=0 DATA len=87
2024-09-23 13:19:43.685952 UDP WRITE [88] to [AF_INET]5.180.55.57:1194: P_DATA_V2 kid=0 DATA len=87
2024-09-23 13:19:43.685973 UDP WRITE [88] to [AF_INET]5.180.55.57:1194: P_DATA_V2 kid=0 DATA len=87
2024-09-23 13:19:43.685989 UDP WRITE [88] to [AF_INET]5.180.55.57:1194: P_DATA_V2 kid=0 DATA len=87
2024-09-23 13:19:43.686006 UDP WRITE [88] to [AF_INET]5.180.55.57:1194: P_DATA_V2 kid=0 DATA len=87
2024-09-23 13:19:43.686025 UDP WRITE [88] to [AF_INET]5.180.55.57:1194: P_DATA_V2 kid=0 DATA len=87
2024-09-23 13:19:43.686042 UDP WRITE [88] to [AF_INET]5.180.55.57:1194: P_DATA_V2 kid=0 DATA len=87

Все, UDP_READ больше не будет никогда, дальше клиент отваливается по таймауту через какое-то время.

Логи со стороны сервера выглядят следующим образом:


Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: MULTI: multi_create_instance called
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 Re-using SSL/TLS context
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 Control Channel MTU parms [ L:1621 D:1156 EF:94 EB:0 ET:0 EL:3 ]
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 Data Channel MTU parms [ L:1621 D:1450 EF:121 EB:406 ET:0 EL:3 ]
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1549,tun-mtu 1500,proto UDPv4,cipher AES-256-GCM,auth [null-digest],keysize 256,key-method 2,tls-server'
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1549,tun-mtu 1500,proto UDPv4,cipher AES-256-GCM,auth [null-digest],keysize 256,key-method 2,tls-client'
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 UDPv4 READ [54] from [AF_INET]client_ip:57537: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=358 DATA len=40
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 TLS: Initial packet from [AF_INET]client_ip:57537, sid=277076f6 1cd8249e
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 UDPv4 WRITE [66] to [AF_INET]client_ip:57537: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ ] pid=358 DATA len=52
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 UDPv4 READ [62] from [AF_INET]client_ip:57537: P_ACK_V1 kid=0 [ ]
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 UDPv4 READ [331] from [AF_INET]client_ip:57537: P_CONTROL_V1 kid=0 [ ] pid=870 DATA len=317
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 UDPv4 WRITE [1128] to [AF_INET]client_ip:57537: P_CONTROL_V1 kid=0 [ ] pid=614 DATA len=1114
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 UDPv4 WRITE [1116] to [AF_INET]client_ip:57537: P_CONTROL_V1 kid=0 [ ] pid=870 DATA len=1102
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 UDPv4 WRITE [313] to [AF_INET]client_ip:57537: P_CONTROL_V1 kid=0 [ ] pid=1126 DATA len=299
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 UDPv4 READ [62] from [AF_INET]client_ip:57537: P_ACK_V1 kid=0 [ ]
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 UDPv4 READ [62] from [AF_INET]client_ip:57537: P_ACK_V1 kid=0 [ ]
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 UDPv4 READ [1128] from [AF_INET]client_ip:57537: P_CONTROL_V1 kid=0 [ ] pid=1638 DATA len=1114
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 UDPv4 WRITE [62] to [AF_INET]client_ip:57537: P_ACK_V1 kid=0 [ ]
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 UDPv4 READ [1116] from [AF_INET]client_ip:57537: P_CONTROL_V1 kid=0 [ ] pid=1894 DATA len=1102
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 VERIFY OK: depth=1, CN=Easy-RSA CA
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 VERIFY OK: depth=0, CN=vt_client
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 UDPv4 WRITE [224] to [AF_INET]client_ip:57537: P_CONTROL_V1 kid=0 [ ] pid=1638 DATA len=210
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 UDPv4 READ [546] from [AF_INET]client_ip:57537: P_CONTROL_V1 kid=0 [ ] pid=2150 DATA len=532
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 peer info: IV_VER=2.4.12
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 peer info: IV_PLAT=mac
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 peer info: IV_PROTO=2
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 peer info: IV_NCP=2
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 peer info: IV_LZ4=1
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 peer info: IV_LZ4v2=1
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 peer info: IV_LZO=1
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 peer info: IV_COMP_STUB=1
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 peer info: IV_COMP_STUBv2=1
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 peer info: IV_TCPNL=1
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 peer info: IV_GUI_VER="net.tunnelblick.tunnelblick_5971_4.0.1__build_5971)"
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 UDPv4 WRITE [294] to [AF_INET]client_ip:57537: P_CONTROL_V1 kid=0 [ ] pid=1894 DATA len=280
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 UDPv4 READ [62] from [AF_INET]client_ip:57537: P_ACK_V1 kid=0 [ ]
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 UDPv4 READ [62] from [AF_INET]client_ip:57537: P_ACK_V1 kid=0 [ ]
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA256
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: client_ip:57537 [vt_client] Peer Connection Initiated with [AF_INET]client_ip:57537
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 MULTI: Learn: 10.8.0.6 -> vt_client/client_ip:57537
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 MULTI: primary virtual IP for vt_client/client_ip:57537: 10.8.0.6
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sep 23 12:19:38 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sep 23 12:19:39 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 READ [89] from [AF_INET]client_ip:57537: P_CONTROL_V1 kid=0 [ ] pid=2918 DATA len=75
Sep 23 12:19:39 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 PUSH: Received control message: 'PUSH_REQUEST'
Sep 23 12:19:39 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 SENT CONTROL [vt_client]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5,peer-id 0,cipher AES-256-GCM' (status=1)
Sep 23 12:19:39 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [62] to [AF_INET]client_ip:57537: P_ACK_V1 kid=0 [ ]
Sep 23 12:19:39 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [294] to [AF_INET]client_ip:57537: P_CONTROL_V1 kid=0 [ ] pid=2406 DATA len=280
Sep 23 12:19:42 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [294] to [AF_INET]client_ip:57537: P_CONTROL_V1 kid=0 [ ] pid=2662 DATA len=280
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 READ [62] from [AF_INET]client_ip:57537: P_ACK_V1 kid=0 [ ]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 READ [62] from [AF_INET]client_ip:57537: P_ACK_V1 kid=0 [ ]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 READ [88] from [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=87
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN WRITE [64]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 READ [88] from [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=87
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN WRITE [64]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 READ [88] from [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=87
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN WRITE [64]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 READ [88] from [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=87
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN WRITE [64]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 READ [88] from [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=87
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN WRITE [64]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 READ [88] from [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=87
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN WRITE [64]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 READ [88] from [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=87
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN WRITE [64]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 READ [88] from [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=87
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN WRITE [64]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 READ [88] from [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=87
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN WRITE [64]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 READ [88] from [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=87
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN WRITE [64]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 READ [88] from [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=87
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN WRITE [64]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 READ [88] from [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=87
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN WRITE [64]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 READ [88] from [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=87
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN WRITE [64]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 READ [88] from [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=87
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN WRITE [64]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 READ [88] from [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=87
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN WRITE [64]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:44 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:44 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:44 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:44 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:44 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:44 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:44 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:44 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:44 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:44 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:46 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:46 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:46 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:46 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:46 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:46 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:46 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:46 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:46 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:46 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:50 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:50 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:50 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:50 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:50 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:50 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:50 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:50 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:51 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:51 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:58 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:58 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:59 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:59 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:59 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
Sep 23 12:19:59 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 UDPv4 WRITE [84] to [AF_INET]client_ip:57537: P_DATA_V2 kid=0 DATA len=83
Sep 23 12:19:59 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 TUN READ [60]
...
Sep 23 12:23:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 [vt_client] Inactivity timeout (--ping-restart), restarting
Sep 23 12:23:43 vm3028493.stark-industries.solutions ovpn-udp[1673]: vt_client/client_ip:57537 SIGUSR1[soft,ping-restart] received, client-instance restarting

Конфиги сервера

username@vm3028493:/etc/openvpn$ cat udp.conf 
port 1194
proto udp

dev tun

ca ca.crt
cert server.crt
key server.key
dh none

# crl-verify crl.pem

server 10.8.0.0 255.255.255.0

push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"

duplicate-cn
keepalive 10 120

tls-crypt ta.key
cipher AES-256-GCM
auth SHA256

user nobody
group nogroup

persist-key
persist-tun

verb 6

explicit-exit-notify 1


username@vm3028493:/etc/openvpn$ cat tcp.conf 
port 443
proto tcp

dev tun

ca ca.crt
cert server.crt
key server.key  
dh none

server 10.9.0.0 255.255.255.0

push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"

duplicate-cn
keepalive 10 120

tls-crypt ta.key
cipher AES-256-GCM
auth SHA256

user nobody
group nogroup

persist-key
persist-tun

verb 3

Конфиги клиента

client
dev tun

remote host_white_ip 1194 udp
remote host_white_ip 443 tcp

resolv-retry infinite

nobind

persist-key
persist-tun

remote-cert-tls server
cipher AES-256-GCM
auth SHA256
key-direction 1

verb 6
<ca>
...
</ca>
<cert>
...
</cert>
<key>
...
</key>
<tls-crypt>
...
</tls-crypt>

pf включен (тут для демонстрации, в /etc/sysctl.conf строчка есть)

username@vm3028493:/etc/openvpn$ sudo sysctl net.ipv4.ip_forward=1
net.ipv4.ip_forward = 1

ufw

username@vm3028493:/etc/openvpn$ sudo ufw status verbose 
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), allow (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
1194/udp                   ALLOW IN    Anywhere                  
443/tcp                    ALLOW IN    Anywhere                  
2022/tcp                   ALLOW IN    Anywhere                  
1194/udp (v6)              ALLOW IN    Anywhere (v6)             
443/tcp (v6)               ALLOW IN    Anywhere (v6)             
2022/tcp (v6)              ALLOW IN    Anywhere (v6)     


username@vm3028493:/etc/openvpn$ sudo cat /etc/ufw/before.rules 
#
# rules.before
#
# Rules that should be run before the ufw command line added rules. Custom
# rules should be added to one of these chains:
#   ufw-before-input
#   ufw-before-output
#   ufw-before-forward
#

# START OPENVPN RULES
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.8.0.0/8 -o ens3 -j MASQUERADE
-A POSTROUTING -s 10.9.0.0/8 -o ens3 -j MASQUERADE
COMMIT
# END OPENVPN RULES


# Don't delete these required lines, otherwise there will be errors
*filter
:ufw-before-input - [0:0]
:ufw-before-output - [0:0]
:ufw-before-forward - [0:0]
:ufw-not-local - [0:0]
# End required lines


# allow all on loopback
-A ufw-before-input -i lo -j ACCEPT
-A ufw-before-output -o lo -j ACCEPT

# quickly process packets for which we already have a connection
-A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

# drop INVALID packets (logs these in loglevel medium and higher)
-A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
-A ufw-before-input -m conntrack --ctstate INVALID -j DROP

# ok icmp codes for INPUT
-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT
-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT
-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT
-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT

# ok icmp code for FORWARD
-A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type time-exceeded -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type parameter-problem -j ACCEPT
-A ufw-before-forward -p icmp --icmp-type echo-request -j ACCEPT

# allow dhcp client to work
-A ufw-before-input -p udp --sport 67 --dport 68 -j ACCEPT

#
# ufw-not-local
#
-A ufw-before-input -j ufw-not-local

# if LOCAL, RETURN
-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN

# if MULTICAST, RETURN
-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN

# if BROADCAST, RETURN
-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN

# all other non-local packets are dropped
-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
-A ufw-not-local -j DROP

# allow MULTICAST mDNS for service discovery (be sure the MULTICAST line above
# is uncommented)
-A ufw-before-input -p udp -d 224.0.0.251 --dport 5353 -j ACCEPT

# allow MULTICAST UPnP for service discovery (be sure the MULTICAST line above
# is uncommented)
-A ufw-before-input -p udp -d 239.255.255.250 --dport 1900 -j ACCEPT

# don't delete the 'COMMIT' line or these rules won't be processed
COMMIT

Перемещено hobbit из general

 ,

Igor_B
()
5 комментариев

HDD не хочет монтироваться после первой записи

Добрый день!

Имею следующую проблему: есть Raspberry Pi 4 с Убунтой 20 и 3,5 жесткий диск WD Red (WDC WD30EFRX-68EUZN0) HDD в кейсе ORICO 3139U3 (контроллер jmicron)

И вот в чем проблема - диск отказывается монтироваться и ФС сыпется после первой записи на диск. Пробовал под Raspberry Pi OS и Убунтой - поведение одинаковое.

Создаю таблицу разделов и партишн:

ubuntu@ubuntu:~$ sudo parted /dev/sda mklabel gpt
Information: You may need to update /etc/fstab.

ubuntu@ubuntu:~$ sudo parted -a opt /dev/sda mkpart primary ext4 0% 100%  
Information: You may need to update /etc/fstab.

Создаю ФС:

ubuntu@ubuntu:~$ sudo mkfs.ext4 -L wdred /dev/sda1           
mke2fs 1.45.5 (07-Jan-2020)
Creating filesystem with 732566272 4k blocks and 183148544 inodes
Filesystem UUID: 8f644482-9669-4f76-b8b3-a85c8f284c11
Superblock backups stored on blocks: 
	32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208, 
	4096000, 7962624, 11239424, 20480000, 23887872, 71663616, 78675968, 
	102400000, 214990848, 512000000, 550731776, 644972544

Allocating group tables: done                            
Writing inode tables: done                            
Creating journal (262144 blocks): done
Writing superblocks and filesystem accounting information: done

С учетом проблемы - проверяю ФС:

ubuntu@ubuntu:~$ sudo e2fsck /dev/sda1
e2fsck 1.45.5 (07-Jan-2020)
wdred: clean, 11/183148544 files, 11783899/732566272 blocks

Монтирую раздел, пишу, отмонтирую и монтирую снова - ВСЕ, ФС убита:

ubuntu@ubuntu:~$ sudo mount /dev/sda1 /mnt/wdred/
ubuntu@ubuntu:~$ sudo touch /mnt/wdred/test_touch
ubuntu@ubuntu:~$ sudo chown ubuntu /mnt/wdred/test_touch
ubuntu@ubuntu:~$ sudo echo "test" > /mnt/wdred/test_touch
ubuntu@ubuntu:~$ cat /mnt/wdred/test_touch
test

ubuntu@ubuntu:~$ sudo umount /mnt/wdred 
ubuntu@ubuntu:~$ sudo mount /dev/sda1 /mnt/wdred/
[b]mount: /mnt/wdred: mount(2) system call failed: Structure needs cleaning.[/b]
ubuntu@ubuntu:~$ sudo e2fsck /dev/sda1
e2fsck 1.45.5 (07-Jan-2020)
ext2fs_check_desc: Corrupt group descriptor: bad block for block bitmap
e2fsck: Group descriptors look bad... trying backup blocks...
wdred was not cleanly unmounted, check forced.
Resize inode not valid.  Recreate<y>? no
Pass 1: Checking inodes, blocks, and sizes
^Cwdred: e2fsck canceled.

wdred: ***** FILE SYSTEM WAS MODIFIED *****

Смарт ничего криминального не показывает:

ubuntu@ubuntu:~$ sudo smartctl -a /dev/sda
smartctl 7.1 2019-12-30 r5022 [aarch64-linux-5.4.0-1015-raspi] (local build)
Copyright (C) 2002-19, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF INFORMATION SECTION ===
Model Family:     Western Digital Red
Device Model:     WDC WD30EFRX-68EUZN0
Serial Number:    WD-WCC4N5ASK8R4
LU WWN Device Id: 5 0014ee 2bcf3f84f
Firmware Version: 82.00A82
User Capacity:    3,000,592,982,016 bytes [3.00 TB]
Sector Sizes:     512 bytes logical, 4096 bytes physical
Rotation Rate:    5400 rpm

Что это вообще может быть? куда смотреть?

 , , ,

Igor_B
()
22 комментария

RSS подписка на новые темы