openvpn

[atem32]

поставил настроил всё работает но через некоторое время отваливается туннель
вот логи:

(Нажмите, чтобы показать/скрыть)

Wed Dec 15 16:09:40 2010 us=268361 UDPv4 READ [22] from [AF_INET]94.242.6.254:3334: P_ACK_V1 kid=0 [ 21 ]
Wed Dec 15 16:09:40 2010 us=294091 UDPv4 READ [22] from [AF_INET]94.242.6.254:3334: P_ACK_V1 kid=0 [ 22 ]
Wed Dec 15 16:09:40 2010 us=294964 UDPv4 READ [22] from [AF_INET]94.242.6.254:3334: P_ACK_V1 kid=0 [ 23 ]
Wed Dec 15 16:09:40 2010 us=295375 UDPv4 READ [126] from [AF_INET]94.242.6.254:3334: P_CONTROL_V1 kid=0 [ 24 ] pid=27 DATA len=100
Wed Dec 15 16:09:40 2010 us=295447 UDPv4 WRITE [22] to [AF_INET]94.242.6.254:3334: P_ACK_V1 kid=0 [ 27 ]
Wed Dec 15 16:09:40 2010 us=295497 UDPv4 READ [114] from [AF_INET]94.242.6.254:3334: P_CONTROL_V1 kid=0 [ ] pid=28 DATA len=100
Wed Dec 15 16:09:40 2010 us=295538 UDPv4 WRITE [22] to [AF_INET]94.242.6.254:3334: P_ACK_V1 kid=0 [ 28 ]
Wed Dec 15 16:09:40 2010 us=295590 UDPv4 READ [114] from [AF_INET]94.242.6.254:3334: P_CONTROL_V1 kid=0 [ ] pid=29 DATA len=100
Wed Dec 15 16:09:40 2010 us=295643 UDPv4 WRITE [22] to [AF_INET]94.242.6.254:3334: P_ACK_V1 kid=0 [ 29 ]
Wed Dec 15 16:09:40 2010 us=295695 UDPv4 READ [114] from [AF_INET]94.242.6.254:3334: P_CONTROL_V1 kid=0 [ ] pid=30 DATA len=100
Wed Dec 15 16:09:40 2010 us=295737 UDPv4 WRITE [22] to [AF_INET]94.242.6.254:3334: P_ACK_V1 kid=0 [ 30 ]
Wed Dec 15 16:09:40 2010 us=297500 UDPv4 READ [114] from [AF_INET]94.242.6.254:3334: P_CONTROL_V1 kid=0 [ ] pid=31 DATA len=100
Wed Dec 15 16:09:40 2010 us=297544 UDPv4 WRITE [22] to [AF_INET]94.242.6.254:3334: P_ACK_V1 kid=0 [ 31 ]
Wed Dec 15 16:09:40 2010 us=297820 UDPv4 READ [114] from [AF_INET]94.242.6.254:3334: P_CONTROL_V1 kid=0 [ ] pid=32 DATA len=100
Wed Dec 15 16:09:40 2010 us=297863 UDPv4 WRITE [22] to [AF_INET]94.242.6.254:3334: P_ACK_V1 kid=0 [ 32 ]
Wed Dec 15 16:09:40 2010 us=299156 UDPv4 READ [114] from [AF_INET]94.242.6.254:3334: P_CONTROL_V1 kid=0 [ ] pid=33 DATA len=100
Wed Dec 15 16:09:40 2010 us=299211 UDPv4 WRITE [22] to [AF_INET]94.242.6.254:3334: P_ACK_V1 kid=0 [ 33 ]
Wed Dec 15 16:09:40 2010 us=299293 UDPv4 READ [114] from [AF_INET]94.242.6.254:3334: P_CONTROL_V1 kid=0 [ ] pid=34 DATA len=100
Wed Dec 15 16:09:40 2010 us=299339 UDPv4 WRITE [22] to [AF_INET]94.242.6.254:3334: P_ACK_V1 kid=0 [ 34 ]
Wed Dec 15 16:09:40 2010 us=299967 UDPv4 READ [114] from [AF_INET]94.242.6.254:3334: P_CONTROL_V1 kid=0 [ ] pid=35 DATA len=100
Wed Dec 15 16:09:40 2010 us=300011 UDPv4 WRITE [22] to [AF_INET]94.242.6.254:3334: P_ACK_V1 kid=0 [ 35 ]
Wed Dec 15 16:09:40 2010 us=300924 UDPv4 READ [114] from [AF_INET]94.242.6.254:3334: P_CONTROL_V1 kid=0 [ ] pid=36 DATA len=100
Wed Dec 15 16:09:40 2010 us=300979 UDPv4 WRITE [22] to [AF_INET]94.242.6.254:3334: P_ACK_V1 kid=0 [ 36 ]
Wed Dec 15 16:09:40 2010 us=301860 UDPv4 READ [114] from [AF_INET]94.242.6.254:3334: P_CONTROL_V1 kid=0 [ ] pid=37 DATA len=100
Wed Dec 15 16:09:40 2010 us=301904 UDPv4 WRITE [22] to [AF_INET]94.242.6.254:3334: P_ACK_V1 kid=0 [ 37 ]
Wed Dec 15 16:09:40 2010 us=302073 UDPv4 READ [108] from [AF_INET]94.242.6.254:3334: P_CONTROL_V1 kid=0 [ ] pid=38 DATA len=94
Wed Dec 15 16:09:40 2010 us=302564 UDPv4 WRITE [126] to [AF_INET]94.242.6.254:3334: P_CONTROL_V1 kid=0 [ 38 ] pid=25 DATA len=100
Wed Dec 15 16:09:40 2010 us=302610 UDPv4 WRITE [114] to [AF_INET]94.242.6.254:3334: P_CONTROL_V1 kid=0 [ ] pid=26 DATA len=100
Wed Dec 15 16:09:40 2010 us=302652 UDPv4 WRITE [114] to [AF_INET]94.242.6.254:3334: P_CONTROL_V1 kid=0 [ ] pid=27 DATA len=100
Wed Dec 15 16:09:40 2010 us=302693 UDPv4 WRITE [28] to [AF_INET]94.242.6.254:3334: P_CONTROL_V1 kid=0 [ ] pid=28 DATA len=14
Wed Dec 15 16:09:40 2010 us=306228 UDPv4 READ [22] from [AF_INET]94.242.6.254:3334: P_ACK_V1 kid=0 [ 25 ]
Wed Dec 15 16:09:40 2010 us=306263 UDPv4 READ [22] from [AF_INET]94.242.6.254:3334: P_ACK_V1 kid=0 [ 26 ]
Wed Dec 15 16:09:40 2010 us=306294 UDPv4 READ [22] from [AF_INET]94.242.6.254:3334: P_ACK_V1 kid=0 [ 27 ]
Wed Dec 15 16:09:40 2010 us=307106 UDPv4 READ [126] from [AF_INET]94.242.6.254:3334: P_CONTROL_V1 kid=0 [ 28 ] pid=39 DATA len=100
Wed Dec 15 16:09:40 2010 us=307149 UDPv4 WRITE [22] to [AF_INET]94.242.6.254:3334: P_ACK_V1 kid=0 [ 39 ]
Wed Dec 15 16:09:40 2010 us=307192 UDPv4 READ [114] from [AF_INET]94.242.6.254:3334: P_CONTROL_V1 kid=0 [ ] pid=40 DATA len=100
Wed Dec 15 16:09:40 2010 us=307224 UDPv4 WRITE [22] to [AF_INET]94.242.6.254:3334: P_ACK_V1 kid=0 [ 40 ]
Wed Dec 15 16:09:40 2010 us=307266 UDPv4 READ [96] from [AF_INET]94.242.6.254:3334: P_CONTROL_V1 kid=0 [ ] pid=41 DATA len=82
Wed Dec 15 16:09:40 2010 us=307391 WARNING: 'ifconfig' is present in remote config but missing in local config, remote='ifconfig 10.0.1.2 10.0.1.1'
Wed Dec 15 16:09:40 2010 us=307638 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Dec 15 16:09:40 2010 us=307658 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Dec 15 16:09:40 2010 us=307728 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Dec 15 16:09:40 2010 us=307745 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Dec 15 16:09:40 2010 us=307774 UDPv4 WRITE [22] to [AF_INET]94.242.6.254:3334: P_ACK_V1 kid=0 [ 41 ]
Wed Dec 15 16:09:40 2010 us=307808 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Dec 15 16:09:40 2010 us=307835 [server] Peer Connection Initiated with [AF_INET]94.242.6.254:3334
Wed Dec 15 16:09:41 2010 us=298184 UDPv4 READ [189] from [AF_INET]94.242.6.254:3334: P_DATA_V1 kid=0 DATA len=188
Wed Dec 15 16:09:41 2010 us=298239 TUN WRITE [153]
Wed Dec 15 16:09:41 2010 us=338843 TUN READ [52]
Wed Dec 15 16:09:41 2010 us=338946 UDPv4 WRITE [93] to [AF_INET]94.242.6.254:3334: P_DATA_V1 kid=0 DATA len=92
Wed Dec 15 16:09:41 2010 us=357559 TUN READ [126]
Wed Dec 15 16:09:41 2010 us=357654 UDPv4 WRITE [165] to [AF_INET]94.242.6.254:3334: P_DATA_V1 kid=0 DATA len=164
Wed Dec 15 16:09:41 2010 us=360170 UDPv4 READ [77] from [AF_INET]94.242.6.254:3334: P_DATA_V1 kid=0 DATA len=76
Wed Dec 15 16:09:41 2010 us=360212 TUN WRITE [40]
Wed Dec 15 16:09:42 2010 us=33490 UDPv4 READ [101] from [AF_INET]94.242.6.254:3334: P_DATA_V1 kid=0 DATA len=100
Wed Dec 15 16:09:42 2010 us=33561 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Dec 15 16:09:42 2010 us=33599 UDPv4 WRITE [104] to [AF_INET]94.242.6.254:3334: P_CONTROL_V1 kid=0 [ ] pid=29 DATA len=90
Wed Dec 15 16:09:42 2010 us=33637 TUN WRITE [60]
Wed Dec 15 16:09:42 2010 us=33701 TUN READ [60]
Wed Dec 15 16:09:42 2010 us=33737 UDPv4 WRITE [101] to [AF_INET]94.242.6.254:3334: P_DATA_V1 kid=0 DATA len=100
Wed Dec 15 16:09:42 2010 us=36233 UDPv4 READ [22] from [AF_INET]94.242.6.254:3334: P_ACK_V1 kid=0 [ 29 ]
Wed Dec 15 16:09:42 2010 us=36333 UDPv4 READ [104] from [AF_INET]94.242.6.254:3334: P_CONTROL_V1 kid=0 [ ] pid=42 DATA len=90
Wed Dec 15 16:09:42 2010 us=36386 PUSH: Received control message: 'PUSH_REPLY'
Wed Dec 15 16:09:42 2010 us=36404 Preserving previous TUN/TAP instance: tun0
Wed Dec 15 16:09:42 2010 us=36418 NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device.
Wed Dec 15 16:09:42 2010 us=36432 Closing TUN/TAP interface
Wed Dec 15 16:09:42 2010 us=36454 /sbin/ifconfig tun0 0.0.0.0
SIOCSIFADDR: Permission denied
SIOCSIFFLAGS: Permission denied
Wed Dec 15 16:09:42 2010 us=37774 Linux ip addr del failed: external program exited with error status: 255
Wed Dec 15 16:09:43 2010 us=90816 Note: Cannot ioctl TUNSETIFF tun: Operation not permitted (errno=1)
Wed Dec 15 16:09:43 2010 us=90839 Note: Attempting fallback to kernel 2.2 TUN/TAP interface
Wed Dec 15 16:09:43 2010 us=91750 Cannot allocate TUN/TAP dev dynamically
Wed Dec 15 16:09:43 2010 us=91773 Exiting

конфиг сервера:

(Нажмите, чтобы показать/скрыть)

dev tun
        tls-server
        proto udp
        port 3334
        comp-lzo
        persist-tun
        persist-key
#tls-auth "/etc/openvpn/ta.key"      
      
        ifconfig 10.0.1.1 10.0.1.2
        route 192.168.0.0 255.255.255.0

        dh /etc/openvpn/dh1024.pem
        ca /etc/openvpn/ca.crt
        cert /etc/openvpn/server.crt
        key /etc/openvpn/server.key

        log /var/log/openvpn.log
        verb 6

конфиг клиента:

(Нажмите, чтобы показать/скрыть)

client
dev tun
proto udp
remote 94.242.6.254  3334
ifconfig 10.0.1.2 10.0.1.1
resolv-retry infinite
persist-key
persist-tun
nobind
user nobody
group nobody
dh /etc/openvpn/keys/dh1024.pem
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/client.crt
key /etc/openvpn/keys/client.key
comp-lzo
log /var/log/openvpn.log
verb 6

как видно прописывается роут до локалки клиента
лог сервака:

(Нажмите, чтобы показать/скрыть)

Wed Dec 15 16:08:02 2010 us=582991 TUN READ [52]
Wed Dec 15 16:08:02 2010 us=583039 UDPv4 WRITE [93] to [AF_INET]95.137.66.205:4685: P_DATA_V1 kid=0 DATA len=92
Wed Dec 15 16:08:02 2010 us=586061 UDPv4 READ [757] from [AF_INET]95.137.66.205:4685: P_DATA_V1 kid=0 DATA len=756
Wed Dec 15 16:08:02 2010 us=586289 TUN WRITE [718]
Wed Dec 15 16:08:02 2010 us=586392 TUN READ [52]
Wed Dec 15 16:08:02 2010 us=586457 UDPv4 WRITE [93] to [AF_INET]95.137.66.205:4685: P_DATA_V1 kid=0 DATA len=92
Wed Dec 15 16:09:40 2010 us=443579 TUN READ [153]
Wed Dec 15 16:09:40 2010 us=443700 UDPv4 WRITE [189] to [AF_INET]95.137.66.205:4685: P_DATA_V1 kid=0 DATA len=188
Wed Dec 15 16:09:40 2010 us=644579 TUN READ [153]
Wed Dec 15 16:09:40 2010 us=644694 UDPv4 WRITE [189] to [AF_INET]95.137.66.205:4685: P_DATA_V1 kid=0 DATA len=188
Wed Dec 15 16:09:41 2010 us=53091 TUN READ [153]
Wed Dec 15 16:09:41 2010 us=53217 UDPv4 WRITE [189] to [AF_INET]95.137.66.205:4685: P_DATA_V1 kid=0 DATA len=188
Wed Dec 15 16:09:41 2010 us=868583 TUN READ [153]
Wed Dec 15 16:09:41 2010 us=868692 UDPv4 WRITE [189] to [AF_INET]95.137.66.205:4685: P_DATA_V1 kid=0 DATA len=188
Wed Dec 15 16:09:43 2010 us=505081 TUN READ [153]
Wed Dec 15 16:09:43 2010 us=505211 UDPv4 WRITE [189] to [AF_INET]95.137.66.205:4685: P_DATA_V1 kid=0 DATA len=188
Wed Dec 15 16:09:46 2010 us=777071 TUN READ [153]
Wed Dec 15 16:09:46 2010 us=777185 UDPv4 WRITE [189] to [AF_INET]95.137.66.205:4685: P_DATA_V1 kid=0 DATA len=188
Wed Dec 15 16:09:53 2010 us=313162 TUN READ [153]
Wed Dec 15 16:09:53 2010 us=313299 UDPv4 WRITE [189] to [AF_INET]95.137.66.205:4685: P_DATA_V1 kid=0 DATA len=188
Wed Dec 15 16:09:57 2010 us=68249 TUN READ [52]
Wed Dec 15 16:09:57 2010 us=68368 UDPv4 WRITE [93] to [AF_INET]95.137.66.205:4685: P_DATA_V1 kid=0 DATA len=92
Wed Dec 15 16:09:58 2010 us=125589 TUN READ [60]
Wed Dec 15 16:09:58 2010 us=125687 UDPv4 WRITE [101] to [AF_INET]95.137.66.205:4685: P_DATA_V1 kid=0 DATA len=100
Wed Dec 15 16:09:58 2010 us=376712 TUN READ [60]
Wed Dec 15 16:09:58 2010 us=376814 UDPv4 WRITE [101] to [AF_INET]95.137.66.205:4685: P_DATA_V1 kid=0 DATA len=100
Wed Dec 15 16:10:01 2010 us=128581 TUN READ [60]
Wed Dec 15 16:10:01 2010 us=128686 UDPv4 WRITE [101] to [AF_INET]95.137.66.205:4685: P_DATA_V1 kid=0 DATA len=100
Wed Dec 15 16:10:01 2010 us=384580 TUN READ [60]
Wed Dec 15 16:10:01 2010 us=384672 UDPv4 WRITE [101] to [AF_INET]95.137.66.205:4685: P_DATA_V1 kid=0 DATA len=100
Wed Dec 15 16:10:03 2010 us=666519 TUN READ [84]
Wed Dec 15 16:10:03 2010 us=666614 UDPv4 WRITE [125] to [AF_INET]95.137.66.205:4685: P_DATA_V1 kid=0 DATA len=124
Wed Dec 15 16:10:04 2010 us=675155 TUN READ [84]
Wed Dec 15 16:10:04 2010 us=675368 UDPv4 WRITE [125] to [AF_INET]95.137.66.205:4685: P_DATA_V1 kid=0 DATA len=124
Wed Dec 15 16:10:05 2010 us=249360 UDPv4 READ [14] from [AF_INET]95.137.66.205:4764: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Wed Dec 15 16:10:05 2010 us=249421 TLS: new session incoming connection from [AF_INET]95.137.66.205:4764
Wed Dec 15 16:10:05 2010 us=249479 UDPv4 WRITE [26] to [AF_INET]95.137.66.205:4764: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ 0 ] pid=0 DATA len=0
Wed Dec 15 16:10:05 2010 us=251801 UDPv4 READ [22] from [AF_INET]95.137.66.205:4764: P_ACK_V1 kid=0 [ 0 ]
Wed Dec 15 16:10:05 2010 us=252414 UDPv4 READ [109] from [AF_INET]95.137.66.205:4764: P_CONTROL_V1 kid=0 [ ] pid=1 DATA len=95
Wed Dec 15 16:10:05 2010 us=283880 UDPv4 WRITE [126] to [AF_INET]95.137.66.205:4764: P_CONTROL_V1 kid=0 [ 1 ] pid=1 DATA len=100
Wed Dec 15 16:10:05 2010 us=283987 UDPv4 WRITE [114] to [AF_INET]95.137.66.205:4764: P_CONTROL_V1 kid=0 [ ] pid=2 DATA len=100
Wed Dec 15 16:10:05 2010 us=284037 UDPv4 WRITE [114] to [AF_INET]95.137.66.205:4764: P_CONTROL_V1 kid=0 [ ] pid=3 DATA len=100
Wed Dec 15 16:10:05 2010 us=284085 UDPv4 WRITE [114] to [AF_INET]95.137.66.205:4764: P_CONTROL_V1 kid=0 [ ] pid=4 DATA len=100
Wed Dec 15 16:10:05 2010 us=286539 UDPv4 READ [22] from [AF_INET]95.137.66.205:4764: P_ACK_V1 kid=0 [ 1 ]

95.137.66.205 это ип клиента серый
после рестарта со стороны клиента опять некоторое время всё нормально а затем падает

[AndyNat]

1. Опишите, плиз, какую цель Вы преследуете, наводя этот тунель? Чтоб сервер мог попасть в локалку клиента?
2. dh /etc/openvpn/keys/dh1024.pem - в конфиге клиента ИМХО это лишнее...
3. Для целей настройки, я думаю, comp-lzo - есть смысл убрать. Поставить, когда все будет работать...
4. Если используете  tls-server, то есть смысл использовать и tls-client.