我已经在我的 OpenWrt 10.03 路由器上安装了 OpenVPN 服务器 [刚刚刷入]:
echo "nameserver 8.8.8.8" > /etc/resolv.conf; opkg update; opkg install luci-app-openvpn openvpn openssl-util openssh-sftp-server ntpd
vim /etc/ssl/openssl.cnf # modify a few lines
[ CA_default ]
dir = /etc/openvpn
new_certs_dir = $dir/certs
certificate = $dir/ca.crt
private_key = $dir/ca.key
touch /etc/openvpn/index.txt; touch /etc/openvpn/serial; echo 01 > /etc/openvpn/serial
openssl req -nodes -new -x509 -keyout /etc/openvpn/ca.key -out /etc/openvpn/ca.crt -days 3650 # give a common name, like: vpnserver
openvpn --genkey --secret /etc/openvpn/ta.key
openssl req -nodes -new -keyout /etc/openvpn/server.key -out /etc/openvpn/server.csr # give a common name, like: vpnserver
mkdir -p /etc/openvpn/certs; mkdir -p /etc/openvpn/private
openssl ca -out /etc/openvpn/server.crt -in /etc/openvpn/server.csr
time openssl dhparam -out /etc/openvpn/dh1024.pem 1024 # it could take 10 minutes!
# generate certs for clients [X = client number]
openssl req -nodes -new -keyout /etc/openvpn/clientX.key -out /etc/openvpn/clientX.csr # give a common name! it will be the user name
openssl ca -out /etc/openvpn/clientX.crt -in /etc/openvpn/clientX.csr
# e.g.:
openssl req -nodes -new -keyout /etc/openvpn/client1.key -out /etc/openvpn/client1.csr # give a common name! it will be the user name
openssl ca -out /etc/openvpn/client1.crt -in /etc/openvpn/client1.csr
vim /etc/config/openvpn
config 'openvpn' 'openvpn_server'
option 'enable' '1'
option 'port' '1194'
option 'proto' 'udp'
option 'dev' 'tap'
option 'ca' '/etc/openvpn/ca.crt'
option 'cert' '/etc/openvpn/server.crt'
option 'key' '/etc/openvpn/server.key'
option 'tls_auth' '/etc/openvpn/ta.key 0' # server: 0
option 'dh' '/etc/openvpn/dh1024.pem'
option 'comp_lzo' '1'
option 'server' '10.20.30.0 255.255.255.0'
option 'keepalive' '10 120'
option 'persist_key' '1'
option 'persist_tun' '1'
option 'mute' '20'
option 'verb' '3'
option 'client_to_client' '1'
list 'push' 'dhcp-option DNS 10.20.30.1'
/etc/init.d/openvpn enable
/etc/init.d/openvpn start
ifconfig -a | less
ping 10.20.30.1
# here comes the firewall part
vim /etc/config/firewall # modify it
config 'include'
option 'path' '/etc/firewall.user'
config 'redirect'
option 'src' 'wan'
option 'proto' 'udp'
option 'src_dport' '1194'
option 'dest_port' '1194'
option '_name' 'OpenVPN'
vim /etc/firewall.user # modify it
iptables -t nat -A prerouting_rule -i $WAN -p udp --dport 11194 -j ACCEPT
iptables -A input_rule -i $WAN -p udp --dport 11194 -j ACCEPT
iptables -A forwarding_rule -i tap+ -o br-lan -j ACCEPT
iptables -A forwarding_rule -i br-lan -o tap+ -j ACCEPT
iptables -A input_rule -i tap+ -j ACCEPT
iptables -A output_rule -o tap -j ACCEPT
/etc/init.d/firewall restart
# tar the files that goes to the client1
mkdir -p /root/client1
cp /etc/openvpn/ca.crt /root/client1/; cp /etc/openvpn/client1.crt /root/client1/; cp /etc/openvpn/client1.key /root/client1/; cp /etc/openvpn/ta.key /root/client1/
cd /root/; tar -cf client1.tar client1
看起来“没问题”。
我将我的电脑连接到路由器的 LAN 端口,我想试试看。我使用的是 Fedora 14 和 GNOME。在 NetworkManager 小程序中,我设置了以下内容:
我尝试连接,但失败了。以下是日志:
Mar 7 15:42:43 ASDF NetworkManager[1458]: <info> Starting VPN service 'openvpn'...
Mar 7 15:42:43 ASDF NetworkManager[1458]: <info> VPN service 'openvpn' started (org.freedesktop.NetworkManager.openvpn), PID 23552
Mar 7 15:42:43 ASDF NetworkManager[1458]: <info> VPN service 'openvpn' appeared; activating connections
Mar 7 15:42:43 ASDF NetworkManager[1458]: <info> VPN plugin state changed: 1
Mar 7 15:42:43 ASDF NetworkManager[1458]: <info> VPN plugin state changed: 3
Mar 7 15:42:43 ASDF NetworkManager[1458]: <info> VPN connection 'elsovpn' (Connect) reply received.
Mar 7 15:42:43 ASDF nm-openvpn[23554]: OpenVPN 2.1.1 i686-redhat-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] built on Jan 5 2010
Mar 7 15:42:43 ASDF nm-openvpn[23554]: WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Mar 7 15:42:43 ASDF nm-openvpn[23554]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Mar 7 15:42:43 ASDF nm-openvpn[23554]: Cannot load certificate file /home/g/Desktop/client1/client1.crt: error:0200100D:system library:fopen:Permission denied: error:20074002:BIO routines:FILE_CTRL:system lib: error:140AD002:SSL routines:SSL_CTX_use_certificate_file:system lib
Mar 7 15:42:43 ASDF nm-openvpn[23554]: Exiting
Mar 7 15:42:43 ASDF kernel: [55630.235164] type=1400 audit(1299508963.340:23608): avc: denied { read } for pid=23554 comm="openvpn" name="client1.crt" dev=dm-1 ino=3019385 scontext=system_u:system_r:openvpn_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file
Mar 7 15:42:43 ASDF NetworkManager[1458]: <warn> VPN plugin failed: 1
Mar 7 15:42:43 ASDF NetworkManager[1458]: <info> VPN plugin state changed: 6
Mar 7 15:42:43 ASDF NetworkManager[1458]: <info> VPN plugin state change reason: 0
Mar 7 15:42:43 ASDF NetworkManager[1458]: <warn> error disconnecting VPN: Could not process the request because no VPN connection was active.
Mar 7 15:42:43 ASDF NetworkManager[1458]: <info> Policy set 'Auto Ethernet' (eth0) as default for IPv4 routing and DNS.
Mar 7 15:42:49 ASDF NetworkManager[1458]: <info> VPN service 'openvpn' disappeared
一件重要的事情:我的路由器(带有 openvpn 服务器的路由器)的 IP 地址是 192.168.1.2,我不需要把它写在任何地方。那么网络管理器小程序如何知道我的 openvpn 服务器的 IP 地址?我认为这是问题所在,但我就是找不到在哪里写 192.168.1.2
我尝试在 Google 上搜索:“未启用任何服务器证书验证方法。”但我什么也没找到,而且我已经尝试了好几个小时……:\
ps:如果我 [在路由器上]:
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -t mangle -P PREROUTING ACCEPT
iptables -t mangle -P OUTPUT ACCEPT
然后查看 tcpdump 的状态,并尝试从我的电脑进行连接,什么也没发生!... 所以这个错误是在网络管理器小程序中!?
再次,PS:如果我:
$ telnet 192.168.1.2 1197
Trying 192.168.1.2...
telnet: connect to address 192.168.1.2: Connection refused
$connbsp;
有没有关于如何设置这种 openvpn 的好方法 [如 pastebin 链接中所述,在 openwrt 路由器上...]?
是否值得寻找另一个 openvpn 客户端程序?[除了 networkmanager 小程序]
答案1
您究竟为什么要尝试从 LAN 内部连接到 OpenVPN 服务器?在路由器上安装 OpenVPN 的目的应该是:
A)作为客户端将你的整个专用网络连接到另一个 OpenVPN 服务器或
B)作为服务器从 WAN 端连接到你的专用网络
回答您的问题,这里的问题出在您粘贴的调试输出中:
Cannot load certificate file /home/g/Desktop/client1/client1.crt: error:0200100D:system library:fopen:Permission denied:
检查该文件的权限,确保它们至少可供用户(和父目录)读取。根据您的 client.conf,您可能还需要使其可供所有人读取。
答案2
路由器可能只接受来自 WAN 端的 OpenVPN 连接,而不接受来自 LAN 端的 OpenVPN 连接。请尝试从网络外的计算机访问路由器的公共 IP 地址。
因此,请确保您的路由器具有可路由的公共 IP 地址。您发布的屏幕截图表明它没有。(提示:如果公共 IP 的形式为 10.xxx 或 192.168.xx,则不可路由)。如果您的 ISP 将您置于他们自己的 NAT 路由器后面,则可能会发生这种情况。在这种情况下,您将无法从互联网发起到路由器的连接。(游戏结束。)
答案3
要自动连接,请使用以下 Python 脚本:https://gist.github.com/1547663
脚本的第一个参数是 NetworkManager 中的 VPN 连接名称,第二个参数是应忽略的网络的逗号分隔名称(在家中使用 VPN 连接是无用的)。
例子
$ git clone git://gist.github.com/1547663.git /home/user/autovpn/
$ echo "python /home/user/autovpn/autovpn.py 'myvpn' 'Auto homenetwork,Auto worknetwork' > /var/log/autovpn.log&" > /etc/rc.local
$ /etc/rc.local
现在,如果您连接到 wifi/以太网,它也会尝试设置 VPN 连接。