Witam
Niech mnie ktoś poratuje z forumowiczów bo ja już ładnie mówiąc nie mam siły do tego softu.
Mianowicie, próbuję ustawić VPNa pomiędzy routeramy TP-Linka wdr4300 z softem DD-WRT v24-sp2 (07/24/13) - build 22118.
Konfig serwera:
Konfig klienta:
I non stop log:
20130902 21:21:59 D MANAGEMENT: CMD 'log 500'
20130902 21:21:59 MANAGEMENT: Client disconnected
20130902 21:32:09 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20130902 21:32:09 D MANAGEMENT: CMD 'state'
20130902 21:32:09 MANAGEMENT: Client disconnected
20130902 21:32:09 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20130902 21:32:09 D MANAGEMENT: CMD 'state'
20130902 21:32:09 MANAGEMENT: Client disconnected
20130902 21:32:09 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20130902 21:32:09 D MANAGEMENT: CMD 'state'
20130902 21:32:09 MANAGEMENT: Client disconnected
20130902 21:32:09 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20130902 21:32:09 D MANAGEMENT: CMD 'status 2'
20130902 21:32:09 MANAGEMENT: Client disconnected
20130902 21:32:09 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20130902 21:32:09 D MANAGEMENT: CMD 'log 500'
Openvpn tomato - tomato pomimo różnych wersji samego tomato i zapewne też vpna działą bez problemu. Śmiga jak 2latek po pokoju. No ale na ten router tomato nie ma ;/ A dd-wrt nijak z żadnej strony. Już 2 krotnie generowałem sertyfikaty, dodawałem static key, TLS auth key i nic. 0. Ping nie idzie w rzadną stronę.
Klient:
Destination Gateway Genmask Flags Metric Ref Use Iface
default NET 0.0.0.0 UG 0 0 0 vlan2
127.0.0.0 * 255.0.0.0 U 0 0 0 lo
169.254.0.0 * 255.255.0.0 U 0 0 0 br0
192.168.5.0 * 255.255.255.0 U 0 0 0 vlan2
192.168.210.0 * 255.255.255.0 U 0 0 0 tap1
192.168.211.0 * 255.255.255.0 U 0 0 0 br0
Serwer:
Destination Gateway Genmask Flags Metric Ref Use Iface
default xx-xx-68-1.dyna 0.0.0.0 UG 0 0 0 vlan2
xx.xx.68.0 * 255.255.252.0 U 0 0 0 vlan2
127.0.0.0 * 255.0.0.0 U 0 0 0 lo
169.254.0.0 * 255.255.0.0 U 0 0 0 br0
192.168.212.0 * 255.255.255.0 U 0 0 0 br0
Co jeszcze brakuje?
--edit--
Co ciekawe skubaniec pojawia się w statusie:
Połączony z 02 wrzesień 2013 23:00:22:
Log po restarcie:
Serverlog 20130902 21:49:36 I OpenVPN 2.3.2 mips-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jul 24 2013
20130902 21:49:36 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:14
20130902 21:49:36 W NOTE: when bridging your LAN adapter with the TAP adapter note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
20130902 21:49:36 W NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
20130902 21:49:36 Diffie-Hellman initialized with 1024 bit key
20130902 21:49:36 W WARNING: normally if you use --mssfix and/or --fragment you should also set --tun-mtu 1500 (currently it is 1400)
20130902 21:49:36 Socket Buffers: R=[87380->131072] S=[16384->131072]
20130902 21:49:36 I TUN/TAP device tap2 opened
20130902 21:49:36 TUN/TAP TX queue length set to 100
20130902 21:49:38 I Listening for incoming TCP connection on [undef]
20130902 21:49:38 Socket flags: TCP_NODELAY=1 succeeded
20130902 21:49:38 I TCPv4_SERVER link local (bound): [undef]
20130902 21:49:38 I TCPv4_SERVER link remote: [undef]
20130902 21:49:38 MULTI: multi_init called r=256 v=256
20130902 21:49:38 IFCONFIG POOL: base=192.168.210.2 size=19 ipv6=0
20130902 21:49:38 IFCONFIG POOL LIST
20130902 21:49:38 MULTI: TCP INIT maxclients=1024 maxevents=1028
20130902 21:49:38 I Initialization Sequence Completed
20130902 21:49:38 W WARNING: normally if you use --mssfix and/or --fragment you should also set --tun-mtu 1500 (currently it is 1400)
20130902 21:49:38 I TCP connection established with [AF_INET]xx.xx.64.213:34718
20130902 21:49:38 Socket flags: TCP_NODELAY=1 succeeded
20130902 21:49:39 xx.xx.64.213:34718 TLS: Initial packet from [AF_INET]xx.xx.64.213:34718 sid=178e8fa2 1993de98
20130902 21:49:39 xx.xx.64.213:34718 VERIFY OK: depth=1 C=PL ST=LU L=Lublin O=xx CN=OPENVPN-CA emailAddress=biuro@xxx.pl
20130902 21:49:39 xx.xx.64.213:34718 VERIFY OK: depth=0 C=PL ST=LU O=xx CN=KLIENT1 emailAddress=biuro@xxx.pl
20130902 21:49:39 xx.xx.64.213:34718 NOTE: --mute triggered...
20130902 21:49:39 xx.xx.64.213:34718 5 variation(s) on previous 3 message(s) suppressed by --mute
20130902 21:49:39 I xx.xx.64.213:34718 [KLIENT1] Peer Connection Initiated with [AF_INET]xx.xx.64.213:34718
20130902 21:49:40 I KLIENT1/xx.xx.64.213:34718 MULTI_sva: pool returned IPv4=192.168.210.2 IPv6=(Not enabled)
20130902 21:49:42 KLIENT1/xx.xx.64.213:34718 PUSH: Received control message: 'PUSH_REQUEST'
20130902 21:49:42 I KLIENT1/xx.xx.64.213:34718 send_push_reply(): safe_cap=940
20130902 21:49:42 KLIENT1/xx.xx.64.213:34718 SENT CONTROL [KLIENT1]: 'PUSH_REPLY route-gateway 192.168.210.1 ping 10 ping-restart 120 socket-flags TCP_NODELAY ifconfig 192.168.210.2 255.255.255.0' (status=1)
20130902 21:50:10 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20130902 21:50:10 D MANAGEMENT: CMD 'state'
20130902 21:50:10 MANAGEMENT: Client disconnected
20130902 21:50:10 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20130902 21:50:10 D MANAGEMENT: CMD 'state'
20130902 21:50:10 MANAGEMENT: Client disconnected
20130902 21:50:10 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20130902 21:50:10 D MANAGEMENT: CMD 'state'
20130902 21:50:10 MANAGEMENT: Client disconnected
20130902 21:50:10 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20130902 21:50:10 D MANAGEMENT: CMD 'status 2'
20130902 21:50:10 MANAGEMENT: Client disconnected
20130902 21:50:10 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20130902 21:50:10 D MANAGEMENT: CMD 'log 500'
19700101 00:00:00
Połączony z 03 wrzesień 2013 00:13:06:
------ ROZWIAZANE ------
Nie wiem czemu wpisywałem zły IP :P
W ustawieniach serwera pula adresowa musi być z tego samego zakresu tj. jak DHCP rozdaje adresy w sieci 192.168.0.0/24 to tak samo ma rozdawać dla klientów VPN, więc ustawiamy zakres np. 192.168.0.100-200 dla LAN i np. 192.168.0.20-30 VPN. Brama dla VPN oczywiście także w tej samej sieci (taki sam IP jak IP naszego routera).
Na chwilę obecną nawet działa.
Ale dalej ciekawi mnie log:
20130902 21:50:10 MANAGEMENT: Client disconnected
20130902 21:50:10 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20130902 21:50:10 D MANAGEMENT: CMD 'status 2'
20130902 21:50:10 MANAGEMENT: Client disconnected
20130902 21:50:10 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20130902 21:50:10 D MANAGEMENT: CMD 'log 500'
Edytowany przez koralm dnia 02-09-2013 23:13
Proud winner of Netgear WNR3500L
|
' target='_blank'>Link
