- Bearbeitet
Hallo liebe archlinux user da darßen.
Ich habe seit heute ein openvpn server problem denn der server empfängt per tap device keine daten von den clients.
getetet per openra-ra server (sendet permanent 255.255.255.255 broadcast in das tap device) ist als openvpn client verbunden aber der server empfängt nicht auf sein tap0 per wireshark geprüft.
Server start openvpn bash file
chmod 777 /dev/net/tun
cd /etc/openvpn/server/
openvpn server.conf &
sleep 3
ip link set dev tap0 up
brctl addbr br0
brctl addif br0 tap0
#brctl addif br0 eth0 #disable zum testen brigt nichts
ifconfig br0 down
ifconfig br0 up
ifconfig br0 down
ifconfig br0 up 172.23.13.1
ip a >/etc/openvpn/server/ip_.log
iptables -I FORWARD -i tap0 -o br0 -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT
#iptables -t nat -I POSTROUTING -o br0 -s 10.8.0.0/24 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 172.13.23.0/24 -o br0 -j MASQUERADE
iptables -I FORWARD -m physdev --physdev-is-bridged -j ACCEPT
fail2ban-server &
/usr/bin/stunnel >/etc/stunnel/debug.txt &##Server openvpn config
mode server
port 9045
proto tcp
#proto tcp6
dev tap0
ca ca.crt
cert Server.crt
key Server.key
dh dh.pem
user nobody
group nogroup
#tls-crypt ta.key
#tls-auth ta.key
tls-auth ta.key 0
cipher AES-256-GCM
#tls-cipher TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA:TLS-DHE-RSA-WITH-AES-128-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA
auth SHA512
tls-version-min 1.3
ifconfig-pool-persist /etc/openvpn/ipp.txt
ifconfig 172.13.23.1 255.255.255.0
#server-bridge 172.13.23.1 255.255.255.0 172.13.23.100 172.13.23.200
server-bridge 172.13.23.1 255.255.255.0 172.13.23.2 172.13.23.200
#push "route 172.13.23.0 255.255.255.0"
persist-tun
persist-key
verb 3
tls-server
user nobody
group nobody
client-to-client
tun-mtu 1500
tun-mtu-extra 32
mssfix 1400
log-append /etc/openvpn/openvpn.log
topology subnet
push "topology subnet"
keepalive 10 120
push "redirect-gateway autolocal def1"
push "redirect-gateway def1"
comp-lzo##
#client openvpn conf
port 9045
remote 127.0.0.1
dev tap0
tls-auth ta.key 1
auth SHA512
tls-client
proto tcp
ca ca.crt
key client.key
cert client.crt
nobind
persist-key
persist-tun
remote-cert-tls server
comp-lzo
remote-cert-tls server
cipher AES-256-GCM
nobind
push "redirect-gateway autolocal def1"
push "redirect-gateway def1"##Client route
route add -host 255.255.255.255 tap0
##
for eine monat ging noch alles damit seit heute update des server nicht mehr.
Bitte um Hilfe danke!#client openvpn log 1 connect via stunnel
2022-03-10 15:05:27 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
2022-03-10 15:05:27 WARNING: file 'client.key' is group or others accessible
2022-03-10 15:05:27 OpenVPN 2.5.5 [git:makepkg/] x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Dec 15 2021
2022-03-10 15:05:27 library versions: OpenSSL 1.1.1m 14 Dec 2021, LZO 2.10
2022-03-10 15:05:27 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:9045
2022-03-10 15:05:27 Attempting to establish TCP connection with [AF_INET]127.0.0.1:9045 [nonblock]
2022-03-10 15:05:27 TCP connection established with [AF_INET]127.0.0.1:9045
2022-03-10 15:05:27 TCP_CLIENT link local: (not bound)
2022-03-10 15:05:27 TCP_CLIENT link remote: [AF_INET]127.0.0.1:9045
2022-03-10 15:05:27 [Server] Peer Connection Initiated with [AF_INET]127.0.0.1:9045
2022-03-10 15:05:27 WARNING: You have specified redirect-gateway and redirect-private at the same time (or the same option multiple times). This is not well supported and may lead to unexpected results
2022-03-10 15:05:27 TUN/TAP device tap0 opened
2022-03-10 15:05:27 net_iface_mtu_set: mtu 1500 for tap0
2022-03-10 15:05:27 net_iface_up: set tap0 up
2022-03-10 15:05:27 net_addr_v4_add: 172.13.23.2/24 dev tap0
2022-03-10 15:05:27 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2022-03-10 15:05:27 Initialization Sequence Completed
2022-03-10 15:07:27 [Server] Inactivity timeout (--ping-restart), restarting
2022-03-10 15:07:27 SIGUSR1[soft,ping-restart] received, process restarting
2022-03-10 15:07:32 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:9045
2022-03-10 15:07:32 Attempting to establish TCP connection with [AF_INET]127.0.0.1:9045 [nonblock]
2022-03-10 15:07:32 TCP connection established with [AF_INET]127.0.0.1:9045
2022-03-10 15:07:32 TCP_CLIENT link local: (not bound)
2022-03-10 15:07:32 TCP_CLIENT link remote: [AF_INET]127.0.0.1:9045
2022-03-10 15:07:34 Connection reset, restarting [-1]
2022-03-10 15:07:34 SIGUSR1[soft,connection-reset] received, process restarting
2022-03-10 15:07:39 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:9045
2022-03-10 15:07:39 Attempting to establish TCP connection with [AF_INET]127.0.0.1:9045 [nonblock]
2022-03-10 15:07:39 TCP connection established with [AF_INET]127.0.0.1:9045
2022-03-10 15:07:39 TCP_CLIENT link local: (not bound)
2022-03-10 15:07:39 TCP_CLIENT link remote: [AF_INET]127.0.0.1:9045
2022-03-10 15:07:40 Connection reset, restarting [-1]
2022-03-10 15:07:40 SIGUSR1[soft,connection-reset] received, process restarting
2022-03-10 15:07:45 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:9045
2022-03-10 15:07:45 Attempting to establish TCP connection with [AF_INET]127.0.0.1:9045 [nonblock]
2022-03-10 15:07:45 TCP connection established with [AF_INET]127.0.0.1:9045
2022-03-10 15:07:45 TCP_CLIENT link local: (not bound)
2022-03-10 15:07:45 TCP_CLIENT link remote: [AF_INET]127.0.0.1:9045client connect kann auch direct per LAN ip per stunnel.
