Клиенты openvpn не выходят в интернет

[dmitry63]

Здравствуйте.

Ubuntu 16.04, настроил OpenVpn, /etc/openvpn/server.conf:

Код: [Выделить]

port 445
proto tcp
dev tun
...
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
...
Лог подключения клиента:

Код: [Выделить]

$ openvpn --config Dropbox/Web/jonnnybru_vpn/desktop.ovpn
Mon Jul  3 21:39:23 2017 OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jun 22 2017
Mon Jul  3 21:39:23 2017 library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.08
Mon Jul  3 21:39:23 2017 Control Channel Authentication: tls-auth using INLINE static key file
Mon Jul  3 21:39:23 2017 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Jul  3 21:39:23 2017 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Jul  3 21:39:23 2017 Socket Buffers: R=[87380->87380] S=[16384->16384]
Mon Jul  3 21:39:24 2017 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Mon Jul  3 21:39:24 2017 Attempting to establish TCP connection with [AF_INET]136.243.146.52:445 [nonblock]
Mon Jul  3 21:39:25 2017 TCP connection established with [AF_INET]136.243.146.52:445
Mon Jul  3 21:39:25 2017 TCPv4_CLIENT link local: [undef]
Mon Jul  3 21:39:25 2017 TCPv4_CLIENT link remote: [AF_INET]136.243.146.52:445
Mon Jul  3 21:39:25 2017 TLS: Initial packet from [AF_INET]136.243.146.52:445, sid=774e2b30 01498f95
Mon Jul  3 21:39:27 2017 VERIFY OK: depth=1, C=RU, ST=SA, L=Samara, O=JonnybRu, OU=VpnUnit, CN=JonnybRu CA, name=server, emailAddress=info@jonnyb.ru
Mon Jul  3 21:39:27 2017 Validating certificate key usage
Mon Jul  3 21:39:27 2017 ++ Certificate has key usage  00a0, expects 00a0
Mon Jul  3 21:39:27 2017 VERIFY KU OK
Mon Jul  3 21:39:27 2017 Validating certificate extended key usage
Mon Jul  3 21:39:27 2017 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mon Jul  3 21:39:27 2017 VERIFY EKU OK
Mon Jul  3 21:39:27 2017 VERIFY OK: depth=0, C=RU, ST=SA, L=Samara, O=JonnybRu, OU=VpnUnit, CN=server, name=server, emailAddress=info@jonnyb.ru
Mon Jul  3 21:39:28 2017 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Mon Jul  3 21:39:28 2017 Data Channel Encrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Jul  3 21:39:28 2017 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Mon Jul  3 21:39:28 2017 Data Channel Decrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Jul  3 21:39:28 2017 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Mon Jul  3 21:39:28 2017 [server] Peer Connection Initiated with [AF_INET]136.243.146.52:445
Mon Jul  3 21:39:30 2017 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Mon Jul  3 21:39:31 2017 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Mon Jul  3 21:39:31 2017 OPTIONS IMPORT: timers and/or timeouts modified
Mon Jul  3 21:39:31 2017 OPTIONS IMPORT: --ifconfig/up options modified
Mon Jul  3 21:39:31 2017 OPTIONS IMPORT: route options modified
Mon Jul  3 21:39:31 2017 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mon Jul  3 21:39:31 2017 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 IFACE=wlp2s0 HWADDR=e4:6f:13:a5:8d:02
Mon Jul  3 21:39:31 2017 ERROR: Cannot ioctl TUNSETIFF tun: Operation not permitted (errno=1)
Mon Jul  3 21:39:31 2017 Exiting due to fatal errorПодскажите, что нужно настроить что-бы не только root мог поднимать соединение?
С sudo:

Код: [Выделить]

sudo openvpn --config Dropbox/Web/jonnnybru_vpn/desktop.ovpn
Mon Jul  3 21:40:45 2017 OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jun 22 2017
Mon Jul  3 21:40:45 2017 library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.08
Mon Jul  3 21:40:45 2017 Control Channel Authentication: tls-auth using INLINE static key file
Mon Jul  3 21:40:45 2017 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Jul  3 21:40:45 2017 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Jul  3 21:40:45 2017 Socket Buffers: R=[87380->87380] S=[16384->16384]
Mon Jul  3 21:40:45 2017 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Mon Jul  3 21:40:45 2017 Attempting to establish TCP connection with [AF_INET]136.243.146.52:445 [nonblock]
Mon Jul  3 21:40:46 2017 TCP connection established with [AF_INET]136.243.146.52:445
Mon Jul  3 21:40:46 2017 TCPv4_CLIENT link local: [undef]
Mon Jul  3 21:40:46 2017 TCPv4_CLIENT link remote: [AF_INET]136.243.146.52:445
Mon Jul  3 21:40:46 2017 TLS: Initial packet from [AF_INET]136.243.146.52:445, sid=720a2a46 00b1585f
Mon Jul  3 21:40:48 2017 VERIFY OK: depth=1, C=RU, ST=SA, L=Samara, O=JonnybRu, OU=VpnUnit, CN=JonnybRu CA, name=server, emailAddress=info@jonnyb.ru
Mon Jul  3 21:40:48 2017 Validating certificate key usage
Mon Jul  3 21:40:48 2017 ++ Certificate has key usage  00a0, expects 00a0
Mon Jul  3 21:40:48 2017 VERIFY KU OK
Mon Jul  3 21:40:48 2017 Validating certificate extended key usage
Mon Jul  3 21:40:48 2017 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mon Jul  3 21:40:48 2017 VERIFY EKU OK
Mon Jul  3 21:40:48 2017 VERIFY OK: depth=0, C=RU, ST=SA, L=Samara, O=JonnybRu, OU=VpnUnit, CN=server, name=server, emailAddress=info@jonnyb.ru
Mon Jul  3 21:40:49 2017 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Mon Jul  3 21:40:49 2017 Data Channel Encrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Jul  3 21:40:49 2017 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Mon Jul  3 21:40:49 2017 Data Channel Decrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Jul  3 21:40:49 2017 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Mon Jul  3 21:40:49 2017 [server] Peer Connection Initiated with [AF_INET]136.243.146.52:445
Mon Jul  3 21:40:51 2017 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Mon Jul  3 21:40:51 2017 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Mon Jul  3 21:40:51 2017 OPTIONS IMPORT: timers and/or timeouts modified
Mon Jul  3 21:40:51 2017 OPTIONS IMPORT: --ifconfig/up options modified
Mon Jul  3 21:40:51 2017 OPTIONS IMPORT: route options modified
Mon Jul  3 21:40:51 2017 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mon Jul  3 21:40:51 2017 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 IFACE=wlp2s0 HWADDR=e4:6f:13:a5:8d:02
Mon Jul  3 21:40:51 2017 TUN/TAP device tun0 opened
Mon Jul  3 21:40:51 2017 TUN/TAP TX queue length set to 100
Mon Jul  3 21:40:51 2017 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Jul  3 21:40:51 2017 /sbin/ip link set dev tun0 up mtu 1500
Mon Jul  3 21:40:51 2017 /sbin/ip addr add dev tun0 local 10.8.0.6 peer 10.8.0.5
Mon Jul  3 21:40:51 2017 /sbin/ip route add 136.243.146.52/32 via 192.168.1.1
RTNETLINK answers: File exists
Mon Jul  3 21:40:51 2017 ERROR: Linux route add command failed: external program exited with error status: 2
Mon Jul  3 21:40:51 2017 /sbin/ip route add 0.0.0.0/1 via 10.8.0.5
Mon Jul  3 21:40:51 2017 /sbin/ip route add 128.0.0.0/1 via 10.8.0.5
Mon Jul  3 21:40:51 2017 /sbin/ip route add 10.8.0.1/32 via 10.8.0.5
Mon Jul  3 21:40:51 2017 GID set to nogroup
Mon Jul  3 21:40:51 2017 UID set to nobody
Mon Jul  3 21:40:51 2017 Initialization Sequence CompletedПри этом на клиенте интернет пропадает:

~$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8. 56(84) bytes of data.
^C
--- 8.8.8.8 ping statistics ---
25 packets transmitted, 0 received, 100% packet loss, time 24526ms

~$ tracepath 8.8.8.8
 1?: [LOCALHOST]                                         pmtu 1500
 1:  10.8.0.1                                             81.976ms
 1:  10.8.0.1                                            248.665ms
 2:  no reply
 3:  no reply
 4:  no reply
 5:  no reply
 6:  no reply
 7:  no reply
 8:  no reply
 9:  no reply

Помогите, пожалуйста, добиться выхода клиентов в интернет через сервер.
На сервере:

Код: [Выделить]

# cat /proc/sys/net/ipv4/ip_forward
1

Исправил.
Придерживайтесь правил:

Правила форума
1.4. Листинги и содержимое текстовых файлов следует добавлять в сообщение с помощью тегов [spoiler]...[/spoiler] или [code]...[/code], либо прикреплять к сообщению в виде отдельного файла. Длинные гиперссылки следует оформлять при помощи тега [url=]...[/url]

  --Aleksandru

[fisher74]

Подскажите, что нужно настроить что-бы не только root мог поднимать соединение?

Применить пользовательнские менеджеры сети, например NM

Помогите, пожалуйста, добиться выхода клиентов в интернет через сервер.

судя по логу, в настройках OVPN, всё уже сделано.

На сервере нужно ещё проверить трансляцию клиентов VPN в интернет