Странное поведение OVPN

[xeon_greg]

да весь она нафиг не нужен

Код: [Выделить]

tail -n 200 логфайл

-  показать последние 200 записей файла

[artem-moskvin]

да весь она нафиг не нужен

Код: [Выделить]

tail -n 200 логфайл

-  показать последние 200 записей файла

Я понимаю. Форум не дает запостить.

[xeon_greg]

это я так понимаю пинг от 10.10.13.25 на 10.10.13.6 ?
ipv6 используешь ? если нет тогда

Код: [Выделить]

sudo su
sysctl -w net.ipv6.conf.all.disable_ipv6=1
echo 'net.ipv6.conf.all.disable_ipv6=1' > /etc/sysctl.d/10-disable_ipv6.conf

[artem-moskvin]

Не понял..
Клиенты -- 10.10.13.6 и 10.10.13.25, сервер -- 10.10.13.1
Ipv6 -- нет, к сожалению.

[xeon_greg]

говорю связь клиентов проверяешь так ?
 пинг от 10.10.13.25 на 10.10.13.6 ?
 и отключи ipv6, поглядим в лог(tail -n 50 логфайл) какой адрес клиента он теперь подсунет туда

[artem-moskvin]

Да.
Tracert от одного клиента, к другому.
Пользователь решил продолжить мысль 01 Ноября 2012, 13:28:44:Пинг с 10.10.13.6 на 25 -- успешный.
Пинг с 25 на 6 -- 100% потерь.

tail -n 50 openvpn.log:

(Нажмите, чтобы показать/скрыть)

Thu Nov  1 13:02:25 2012 us=143067 Control Channel MTU parms [ L:1560 D:168 EF:68 EB:0 ET:0 EL:0 ]
Thu Nov  1 13:02:25 2012 us=143142 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Nov  1 13:02:25 2012 us=143229 Local Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Thu Nov  1 13:02:25 2012 us=143255 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Thu Nov  1 13:02:25 2012 us=143304 Local Options hash (VER=V4): '9915e4a2'
Thu Nov  1 13:02:25 2012 us=143348 Expected Remote Options hash (VER=V4): '2f2c6498'
Thu Nov  1 13:02:25 2012 us=143416 TCP connection established with [AF_INET]46.138.36.111:58027
Thu Nov  1 13:02:25 2012 us=143451 TCPv4_SERVER link local: [undef]
Thu Nov  1 13:02:25 2012 us=143482 TCPv4_SERVER link remote: [AF_INET]46.138.36.111:58027
RThu Nov  1 13:02:25 2012 us=144471 46.138.36.111:58027 TLS: Initial packet from [AF_INET]46.138.36.111:58027, sid=bc6e6b89 e7499dcb
WrWRRWRWRWWWWRWRWWWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRRRRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRThu Nov  1 13:02:28 2012 us=81076 46.138.36.111:58027 CRL CHECK OK: /C=ru/ST=ru/L=Moscow/O=NoOrg/CN=HomeServer/name=ArtemMoskvin/emailAddress=artem.moskvin@gmail.com
Thu Nov  1 13:02:28 2012 us=81198 46.138.36.111:58027 VERIFY OK: depth=1, /C=ru/ST=ru/L=Moscow/O=NoOrg/CN=HomeServer/name=ArtemMoskvin/emailAddress=artem.moskvin@gmail.com
Thu Nov  1 13:02:28 2012 us=81970 46.138.36.111:58027 CRL CHECK OK: /C=ru/ST=AL/L=Moscow/O=No/CN=artem-moskvin/emailAddress=a
Thu Nov  1 13:02:28 2012 us=82045 46.138.36.111:58027 VERIFY OK: depth=0, /C=ru/ST=AL/L=Moscow/O=No/CN=artem-moskvin/emailAddress=a
WRWRWRWRWWWWRWRWWWRWRWRWRWRRRRWRWRWRThu Nov  1 13:02:29 2012 us=835584 46.138.36.111:58027 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Nov  1 13:02:29 2012 us=835660 46.138.36.111:58027 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Nov  1 13:02:29 2012 us=835696 46.138.36.111:58027 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Nov  1 13:02:29 2012 us=835730 46.138.36.111:58027 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
WWWRRThu Nov  1 13:02:30 2012 us=357103 46.138.36.111:58027 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Nov  1 13:02:30 2012 us=357208 46.138.36.111:58027 [artem-moskvin] Peer Connection Initiated with [AF_INET]46.138.36.111:58027
Thu Nov  1 13:02:30 2012 us=357608 artem-moskvin/46.138.36.111:58027 TCP/UDP: Closing socket
Thu Nov  1 13:02:30 2012 us=357691 MULTI: new connection by client 'artem-moskvin' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Thu Nov  1 13:02:30 2012 us=357751 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/artem-moskvin
Thu Nov  1 13:02:30 2012 us=357996 MULTI: Learn: 10.10.13.25 -> artem-moskvin/46.138.36.111:58027
Thu Nov  1 13:02:30 2012 us=358036 MULTI: primary virtual IP for artem-moskvin/46.138.36.111:58027: 10.10.13.25
RThu Nov  1 13:02:32 2012 us=379531 artem-moskvin/46.138.36.111:58027 PUSH: Received control message: 'PUSH_REQUEST'
Thu Nov  1 13:02:32 2012 us=379603 artem-moskvin/46.138.36.111:58027 send_push_reply(): safe_cap=960
Thu Nov  1 13:02:32 2012 us=379711 artem-moskvin/46.138.36.111:58027 SENT CONTROL [artem-moskvin]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 192.168.1.20,route 10.10.13.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.10.13.25 10.10.13.26' (status=1)
WWWWRRRThu Nov  1 13:02:33 2012 us=108754 artem-moskvin/46.138.36.111:58027 MULTI: bad source address from client [::], packet dropped
RThu Nov  1 13:02:33 2012 us=108866 artem-moskvin/46.138.36.111:58027 MULTI: bad source address from client [fe80::5cb2:c38b:cff9:f3a1], packet dropped
RThu Nov  1 13:02:33 2012 us=108944 artem-moskvin/46.138.36.111:58027 MULTI: bad source address from client [fe80::5cb2:c38b:cff9:f3a1], packet dropped
RThu Nov  1 13:02:33 2012 us=109028 artem-moskvin/46.138.36.111:58027 MULTI: bad source address from client [fe80::5cb2:c38b:cff9:f3a1], packet dropped
RThu Nov  1 13:02:33 2012 us=175333 artem-moskvin/46.138.36.111:58027 MULTI: bad source address from client [fe80::5cb2:c38b:cff9:f3a1], packet dropped
RThu Nov  1 13:02:33 2012 us=175460 artem-moskvin/46.138.36.111:58027 MULTI: bad source address from client [fe80::5cb2:c38b:cff9:f3a1], packet dropped
RThu Nov  1 13:02:33 2012 us=251862 artem-moskvin/46.138.36.111:58027 MULTI: bad source address from client [fe80::5cb2:c38b:cff9:f3a1], packet dropped
RThu Nov  1 13:02:33 2012 us=251988 artem-moskvin/46.138.36.111:58027 MULTI: bad source address from client [fe80::5cb2:c38b:cff9:f3a1], packet dropped
RThu Nov  1 13:02:33 2012 us=331400 artem-moskvin/46.138.36.111:58027 MULTI: bad source address from client [fe80::5cb2:c38b:cff9:f3a1], packet dropped
RThu Nov  1 13:02:33 2012 us=331558 artem-moskvin/46.138.36.111:58027 MULTI: bad source address from client [fe80::5cb2:c38b:cff9:f3a1], packet dropped
RRThu Nov  1 13:02:33 2012 us=413437 artem-moskvin/46.138.36.111:58027 MULTI: bad source address from client [fe80::5cb2:c38b:cff9:f3a1], packet dropped
RThu Nov  1 13:02:33 2012 us=473364 artem-moskvin/46.138.36.111:58027 MULTI: bad source address from client [fe80::5cb2:c38b:cff9:f3a1], packet dropped
RThu Nov  1 13:02:33 2012 us=473490 artem-moskvin/46.138.36.111:58027 MULTI: bad source address from client [fe80::5cb2:c38b:cff9:f3a1], packet dropped
RThu Nov  1 13:02:33 2012 us=473597 artem-moskvin/46.138.36.111:58027 MULTI: bad source address from client [fe80::5cb2:c38b:cff9:f3a1], packet dropped
RThu Nov  1 13:02:33 2012 us=473671 artem-moskvin/46.138.36.111:58027 MULTI: bad source address from client [fe80::5cb2:c38b:cff9:f3a1], packet dropped
RThu Nov  1 13:02:33 2012 us=580771 artem-moskvin/46.138.36.111:58027 MULTI: bad source address from client [fe80::5cb2:c38b:cff9:f3a1], packet dropped
RThu Nov  1 13:02:33 2012 us=580896 artem-moskvin/46.138.36.111:58027 MULTI: bad source address from client [fe80::5cb2:c38b:cff9:f3a1], packet dropped
rWRThu Nov  1 13:02:33 2012 us=686139 artem-moskvin/46.138.36.111:58027 MULTI: bad source address from client [fe80::5cb2:c38b:cff9:f3a1], packet dropped
RThu Nov  1 13:02:33 2012 us=686268 artem-moskvin/46.138.36.111:58027 MULTI: bad source address from client [fe80::5cb2:c38b:cff9:f3a1], packet dropped
RThu Nov  1 13:02:33 2012 us=686350 artem-moskvin/46.138.36.111:58027 MULTI: bad source address from client [fe80::5cb2:c38b:cff9:f3a1], packet dropped
RThu Nov  1 13:02:33 2012 us=686425 artem-moskvin/46.138.36.111:58027 NOTE: --mute triggered...

[xeon_greg]

оси клиентов какие ? 6 -  Windows ?  фаервол/брандмауэр отключен ? у 25 отключить ipv6

[artem-moskvin]

Кстати, после опции client-to-client вообще перестал идти tracert.
6 -- xp
25 -- w7
Отключу v6 и попробую пропинговать.

[xeon_greg]

на XP фаервол/брандмауэр отключен ?

Отключу v6 и попробую пропинговать.

как отключишь лог потом покажи

[artem-moskvin]

Везде фаер отключен.
Пользователь решил продолжить мысль 01 Ноября 2012, 13:44:36:Пинги с 25 на 6 не идут.

(Нажмите, чтобы показать/скрыть)

artem-moskvin@moskvinartemserver:/etc/openvpn/log$ tail -n 50 op*.log
tail: невозможно открыть «openvpn.log» для чтения: Отказано в доступе
artem-moskvin@moskvinartemserver:/etc/openvpn/log$ sudo tail -n 50 op*.log
[sudo] password for artem-moskvin:
Thu Nov  1 13:42:58 2012 us=135266 TCPv4_SERVER link remote: [AF_INET]46.138.36.111:59400
RThu Nov  1 13:42:58 2012 us=139823 46.138.36.111:59400 TLS: Initial packet from [AF_INET]46.138.36.111:59400, sid=4f1e9aa8 aeedfbf9
WRRWRWRWWWWRWRWWWRWRWRWWRWRWRWWRWRWRWWRWRWRWWRWRWRRRWRWRWRWRWRWRWRWRWThu Nov  1 13:42:59 2012 us=253061 MULTI: multi_create_instance called
Thu Nov  1 13:42:59 2012 us=253214 Re-using SSL/TLS context
Thu Nov  1 13:42:59 2012 us=253292 LZO compression initialized
Thu Nov  1 13:42:59 2012 us=253466 Control Channel MTU parms [ L:1560 D:168 EF:68 EB:0 ET:0 EL:0 ]
Thu Nov  1 13:42:59 2012 us=253516 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Nov  1 13:42:59 2012 us=253635 Local Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Thu Nov  1 13:42:59 2012 us=253664 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Thu Nov  1 13:42:59 2012 us=253713 Local Options hash (VER=V4): '9915e4a2'
Thu Nov  1 13:42:59 2012 us=253758 Expected Remote Options hash (VER=V4): '2f2c6498'
Thu Nov  1 13:42:59 2012 us=253818 TCP connection established with [AF_INET]46.138.36.111:59402
Thu Nov  1 13:42:59 2012 us=253853 TCPv4_SERVER link local: [undef]
Thu Nov  1 13:42:59 2012 us=253885 TCPv4_SERVER link remote: [AF_INET]46.138.36.111:59402
RThu Nov  1 13:42:59 2012 us=254239 46.138.36.111:59402 TLS: Initial packet from [AF_INET]46.138.36.111:59402, sid=4383484b 0c31928b
WRWRWRWRRWRWRWRWRWRWRWWWWRWRWRWRThu Nov  1 13:42:59 2012 us=470444 46.138.36.111:59400 CRL CHECK OK: /C=ru/ST=ru/L=Moscow/O=NoOrg/CN=HomeServer/name=ArtemMoskvin/emailAddress=artem.moskvin@gmail.com
Thu Nov  1 13:42:59 2012 us=470574 46.138.36.111:59400 VERIFY OK: depth=1, /C=ru/ST=ru/L=Moscow/O=NoOrg/CN=HomeServer/name=ArtemMoskvin/emailAddress=artem.moskvin@gmail.com
Thu Nov  1 13:42:59 2012 us=471289 46.138.36.111:59400 CRL CHECK OK: /C=IN/ST=AL/L=Bangkok/O=Anonymous/CN=virtualpc_1/emailAddress=tome@anonym.com
Thu Nov  1 13:42:59 2012 us=471360 46.138.36.111:59400 VERIFY OK: depth=0, /C=IN/ST=AL/L=Bangkok/O=Anonymous/CN=virtualpc_1/emailAddress=tome@anonym.com
WRWRWRWWWWRWRWWWRWRWRWRWWWRWRWRWRWRWRWRWWRWRWRWRRRWRWRWRWRThu Nov  1 13:43:00 2012 us=78542 46.138.36.111:59400 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Nov  1 13:43:00 2012 us=78615 46.138.36.111:59400 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Nov  1 13:43:00 2012 us=78652 46.138.36.111:59400 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Nov  1 13:43:00 2012 us=78686 46.138.36.111:59400 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
WWWRWRWRWRWRWRWRWRWRWRRThu Nov  1 13:43:00 2012 us=371299 46.138.36.111:59400 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Nov  1 13:43:00 2012 us=371407 46.138.36.111:59400 [virtualpc_1] Peer Connection Initiated with [AF_INET]46.138.36.111:59400
Thu Nov  1 13:43:00 2012 us=371524 virtualpc_1/46.138.36.111:59400 MULTI_sva: pool returned IPv4=10.10.13.6, IPv6=2700::1800:0:147a:4c00
Thu Nov  1 13:43:00 2012 us=371654 virtualpc_1/46.138.36.111:59400 MULTI: Learn: 10.10.13.6 -> virtualpc_1/46.138.36.111:59400
Thu Nov  1 13:43:00 2012 us=371692 virtualpc_1/46.138.36.111:59400 MULTI: primary virtual IP for virtualpc_1/46.138.36.111:59400: 10.10.13.6
RRRRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRThu Nov  1 13:43:01 2012 us=15678 46.138.36.111:59402 CRL CHECK OK: /C=ru/ST=ru/L=Moscow/O=NoOrg/CN=HomeServer/name=ArtemMoskvin/emailAddress=artem.moskvin@gmail.com
Thu Nov  1 13:43:01 2012 us=45241 46.138.36.111:59402 VERIFY OK: depth=1, /C=ru/ST=ru/L=Moscow/O=NoOrg/CN=HomeServer/name=ArtemMoskvin/emailAddress=artem.moskvin@gmail.com
Thu Nov  1 13:43:01 2012 us=46112 46.138.36.111:59402 CRL CHECK OK: /C=ru/ST=AL/L=Moscow/O=No/CN=artem-moskvin/emailAddress=a
Thu Nov  1 13:43:01 2012 us=46185 46.138.36.111:59402 VERIFY OK: depth=0, /C=ru/ST=AL/L=Moscow/O=No/CN=artem-moskvin/emailAddress=a
WRWRWRWRWWWWRWRWWWRWRWRWRWRRRRWRWRWRThu Nov  1 13:43:01 2012 us=761054 46.138.36.111:59402 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Nov  1 13:43:01 2012 us=761126 46.138.36.111:59402 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Nov  1 13:43:01 2012 us=761186 46.138.36.111:59402 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Nov  1 13:43:01 2012 us=761222 46.138.36.111:59402 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
WWWRRThu Nov  1 13:43:02 2012 us=124680 46.138.36.111:59402 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Nov  1 13:43:02 2012 us=124788 46.138.36.111:59402 [artem-moskvin] Peer Connection Initiated with [AF_INET]46.138.36.111:59402
Thu Nov  1 13:43:02 2012 us=125149 artem-moskvin/46.138.36.111:59402 TCP/UDP: Closing socket
Thu Nov  1 13:43:02 2012 us=125232 MULTI: new connection by client 'artem-moskvin' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Thu Nov  1 13:43:02 2012 us=125292 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/artem-moskvin
Thu Nov  1 13:43:02 2012 us=125565 MULTI: Learn: 10.10.13.25 -> artem-moskvin/46.138.36.111:59402
Thu Nov  1 13:43:02 2012 us=125610 MULTI: primary virtual IP for artem-moskvin/46.138.36.111:59402: 10.10.13.25
RThu Nov  1 13:43:02 2012 us=499823 virtualpc_1/46.138.36.111:59400 PUSH: Received control message: 'PUSH_REQUEST'
Thu Nov  1 13:43:02 2012 us=499893 virtualpc_1/46.138.36.111:59400 send_push_reply(): safe_cap=960
Thu Nov  1 13:43:02 2012 us=499997 virtualpc_1/46.138.36.111:59400 SENT CONTROL [virtualpc_1]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 192.168.1.20,route 10.10.13.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.10.13.6 10.10.13.5' (status=1)
WWWWRRRThu Nov  1 13:43:04 2012 us=52780 artem-moskvin/46.138.36.111:59402 PUSH: Received control message: 'PUSH_REQUEST'
Thu Nov  1 13:43:04 2012 us=52850 artem-moskvin/46.138.36.111:59402 send_push_reply(): safe_cap=960
Thu Nov  1 13:43:04 2012 us=52954 artem-moskvin/46.138.36.111:59402 SENT CONTROL [artem-moskvin]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 192.168.1.20,route 10.10.13.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.10.13.25 10.10.13.26' (status=1)
WWWWRRrWRwRwRwRwRwrWRwrWRwrWrWRwrWrWRwRwrWrWRwRwRwRwrWRWRWRWRWRWRWRwrWRwrWRwRwRwrWrWrWRwRwrWrWRwRwRwRwRwRwrWrWrWrWRwrWrWrWRwRwRwrWRwrWrWrWRwrWRwrWRwRwRwrWRwrWRwRwrWrWrWRWRwRwrWRwrWrWRwRwRwRwRwRwrWrWrWRwRwRwrWrWRwRwrWRwrWrWRWRwRwrWrWRwrWRwRwrWRwRWrWrWRwrWRwRwrWrWRwRwrWrWRwrWrWRWRwrWRwrWRwrWRwRwRwrWrWRwrWrWRwRwrWRwrWrWrWrWRwRwrWrWrWrWrWrWRwRwrWrWrWRwrWrWrWrWrWrWRwRwRwrWrWrWrWrWrWrWrWrWRwRwRwrWrWrWrWrWRwrWRwrWrWrWrWrWrWRwRwRwrWrWrWrWRwRwRwRwrWRwRwrWrWrWRwRwrWrWRRwrWrWRWRwrWRwrWRwRWRWRWRWrWRwrWRWrWRwRwrWRRWRwrWRWRWartem-moskvin@moskvinartemserver:/etc/openvpn/log$

[xeon_greg]

ну сейчас в логах порядок,  а когда пинги в 1 сторону идут а в другую нет, этого говорит об одном,что на приемной стороне включен брандмауэр, ну еще как вариант, для проверки закомментируй это , рестартани впн сервер и рестартани впн клиентов

push "redirect-gateway def1" # Протолкнуть клиенту новый шлюз по умолчанию
push "dhcp-option DNS 192.168.1.20" # Назначить для клиента DNS сервер, в данном случае публичный DNS от гугла

[artem-moskvin]

Все работает!
Огромнейшее спасибо Вам!
Пользователь решил продолжить мысль 01 Ноября 2012, 15:09:49:Возникла еще одна "штука". Как прокинуть броадкаст пакеты из одной сети в другую?

[xeon_greg]

использовать vpn в режиме моста. там свои особенности конфигурации