我在地下室的一台 Linux 机器上设置了 OpenVPN。
当我连接到本地网络时，我能够从我的 Windows 8.1 机器进行连接，而不会出现问题。
在这个例子中，我将配置文件设置为使用remote 192.168.0.111 1194
当我离开本地网络时，我会修改该配置文件以说明：我的公共 IP 在remote 63.xxx.x.xxx 1194
哪里。63.xxx.xx.xx
当我在本地网络之外时，我无法连接。这是我最近尝试从外部网络连接时的日志条目。
Mon Oct 06 13:59:54 2014 OpenVPN 2.3.4 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on May 2 2014
Mon Oct 06 13:59:54 2014 library versions: OpenSSL 1.0.1g 7 Apr 2014, LZO 2.05
Mon Oct 06 13:59:54 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Mon Oct 06 13:59:54 2014 Need hold release from management interface, waiting...
Mon Oct 06 13:59:55 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Mon Oct 06 13:59:55 2014 MANAGEMENT: CMD 'state on'
Mon Oct 06 13:59:55 2014 MANAGEMENT: CMD 'log all on'
Mon Oct 06 13:59:55 2014 MANAGEMENT: CMD 'hold off'
Mon Oct 06 13:59:55 2014 MANAGEMENT: CMD 'hold release'
Mon Oct 06 13:59:55 2014 Socket Buffers: R=[65536->65536] S=[65536->65536]
Mon Oct 06 13:59:55 2014 UDPv4 link local: [undef]
Mon Oct 06 13:59:55 2014 UDPv4 link remote: [AF_INET]63.xxx.xx.xx:1194
Mon Oct 06 13:59:55 2014 MANAGEMENT: >STATE:1412625595,WAIT,,,
Mon Oct 06 14:00:55 2014 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Oct 06 14:00:55 2014 TLS Error: TLS handshake failed
Mon Oct 06 14:00:55 2014 SIGUSR1[soft,tls-error] received, process restarting
Mon Oct 06 14:00:55 2014 MANAGEMENT: >STATE:1412625655,RECONNECTING,tls-error,,
Mon Oct 06 14:00:55 2014 Restart pause, 2 second(s)
Mon Oct 06 14:00:57 2014 Socket Buffers: R=[65536->65536] S=[65536->65536]
Mon Oct 06 14:00:57 2014 UDPv4 link local: [undef]
Mon Oct 06 14:00:57 2014 UDPv4 link remote: [AF_INET]63.xxx.xx.xx:1194
Mon Oct 06 14:00:57 2014 MANAGEMENT: >STATE:1412625657,WAIT,,,
看起来可能是防火墙的问题，但我已经反复检查了该页面上的每个要点，并没有发现任何问题。
- 服务器网络上的外围防火墙正在过滤传入的 OpenVPN 数据包（默认情况下，OpenVPN 使用 UDP 或 TCP 端口
号 1194）。
我已检查并再次检查了路由器设置，并且端口 1194 肯定应该转发到我的 Linux 机器...这是我的路由器的 iptables 配置：
> iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
drop all -- anywhere 63.xxx.xx.xx
ACCEPT 2 -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere icmp echo-request
DROP tcp -- anywhere anywhere tcp dpt:www
DROP tcp -- anywhere anywhere tcp dpt:https
DROP tcp -- anywhere anywhere tcp dpt:telnet
DROP tcp -- anywhere anywhere tcp dpt:ssh
DROP tcp -- anywhere anywhere tcp dpt:ftp
DROP tcp -- anywhere anywhere tcp dpt:domain
DROP tcp -- anywhere anywhere tcp dpt:44401
DROP tcp -- anywhere anywhere tcp dpt:49431
DROP udp -- anywhere anywhere udp dpt:domain
DROP udp -- anywhere anywhere udp dpt:tftp
DROP udp -- anywhere anywhere udp dpt:1900
DROP udp -- anywhere anywhere udp dpt:37000
DROP udp -- anywhere anywhere udp dpt:38000
DROP udp -- anywhere anywhere udp dpts:5098:5100
DROP udp -- anywhere anywhere udp dpt:50032
DROP udp -- anywhere anywhere udp dpt:54008
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT udp -- anywhere anywhere udp dpt:500
ACCEPT esp -- anywhere anywhere
ACCEPT ah -- anywhere anywhere
ACCEPT !esp -- anywhere anywhere MARK match 0x10000000/0x10000000
ACCEPT !ah -- anywhere anywhere MARK match 0x10000000/0x10000000
ACCEPT tcp -- anywhere anywhere tcp dpt:4567
DROP all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere 224.0.1.60
ACCEPT udp -- anywhere 192.168.0.111 udp dpt:1194
ACCEPT tcp -- anywhere 192.168.0.111 tcp dpt:1194
ACCEPT tcp -- anywhere 192.168.0.111 tcp dpt:https
ACCEPT udp -- anywhere 192.168.0.17 udp dpt:51490
ACCEPT udp -- anywhere 192.168.0.25 udp dpt:53681
ACCEPT udp -- anywhere 192.168.0.111 udp dpt:1194
ACCEPT tcp -- anywhere 192.168.0.111 tcp dpt:1194
ACCEPT udp -- anywhere 192.168.0.111 udp dpt:https
ACCEPT tcp -- anywhere 192.168.0.111 tcp dpt:https
ACCEPT tcp -- anywhere 5.5.126.125 tcp dpt:15979
ACCEPT udp -- anywhere 192.168.0.22 udp dpt:16402
ACCEPT all -- anywhere 224.0.0.0/3
ACCEPT icmp -- anywhere anywhere icmp echo-request
ACCEPT icmp -- anywhere anywhere icmp echo-reply
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
ACCEPT icmp -- anywhere anywhere icmp type 30
TCPMSS tcp -- anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
ACCEPT tcp -- anywhere 192.168.0.111 tcp dpt:www
ACCEPT udp -- anywhere 192.168.0.18 udp dpt:62558
ACCEPT udp -- anywhere 192.168.0.17 udp dpt:57874
ACCEPT udp -- anywhere 192.168.0.17 udp dpt:51621
ACCEPT udp -- anywhere 192.168.0.3 udp dpt:58670
ACCEPT udp -- anywhere 192.168.0.3 udp dpt:50209
ACCEPT udp -- anywhere 192.168.0.3 udp dpt:60530
ACCEPT udp -- anywhere 192.168.0.3 udp dpt:60285
ACCEPT udp -- anywhere 192.168.0.3 udp dpt:59415
ACCEPT udp -- anywhere 192.168.0.3 udp dpt:62603
ACCEPT udp -- anywhere 192.168.0.3 udp dpt:52438
ACCEPT udp -- anywhere 192.168.0.3 udp dpt:53919
ACCEPT udp -- anywhere 192.168.0.3 udp dpt:62384
ACCEPT tcp -- anywhere 192.168.0.3 tcp dpt:35689
ACCEPT udp -- anywhere 192.168.0.3 udp dpt:35689
ACCEPT udp -- anywhere 192.168.0.3 udp dpt:55287
ACCEPT udp -- anywhere 192.168.0.3 udp dpt:50487
ACCEPT udp -- anywhere 192.168.0.3 udp dpt:51697
urlfilter tcp -- anywhere anywhere tcp flags:FIN,SYN,RST/NONE
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT !esp -- anywhere anywhere MARK match 0x10000000/0x10000000
ACCEPT !ah -- anywhere anywhere MARK match 0x10000000/0x10000000
DROP udp -- 192.168.0.9 anywhere udp dpt:l2tp
DROP tcp -- 192.168.0.9 anywhere tcp dpt:1723
ACCEPT tcp -- anywhere anywhere tcp dpts:5060:5061
ACCEPT udp -- anywhere anywhere udp dpts:5060:5061
ACCEPT tcp -- anywhere anywhere tcp dpt:www
ACCEPT udp -- 205.171.2.65 anywhere udp dpt:domain
ACCEPT udp -- 205.171.3.65 anywhere udp dpt:domain
ACCEPT udp -- anywhere anywhere udp dpt:domain
ACCEPT tcp -- anywhere anywhere tcp dpts:27167:27169
ACCEPT tcp -- anywhere anywhere tcp dpts:27164:27166
ACCEPT tcp -- anywhere anywhere tcp dpts:27161:27163
drop all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain drop (2 references)
target prot opt source destination
ACCEPT icmp -- anywhere anywhere icmp echo-request
LOG all -- anywhere anywhere LOG level info prefix `firewall drop: '
DROP all -- anywhere anywhere
Chain urlfilter (1 references)
target prot opt source destination
SKIPLOG tcp -- anywhere anywhere tcp dpt:www
QUEUE tcp -- anywhere anywhere tcp dpt:www
我觉得我的路由器确实应该将端口 1194 转发到我的 Linux 机器。我还将端口 80 转发到同一个机器，没有任何问题。
我怀疑我的 ISP 会阻止端口 1194，而不是端口 80......
- OpenVPN 服务器机器本身上运行的软件防火墙正在过滤端口 1194 上的传入连接。请注意，许多操作系统
默认会阻止传入连接，除非
另有配置。
我在本地机器上使用 Yast 打开了 Linux 机器上的 1194 端口。我很确定这不是问题，因为我可以在连接到本地网络的同时连接到 Linux 机器。如果 Linux 机器的防火墙是问题所在，那么我也无法从本地地址进行连接。
- 服务器网络上的 NAT 网关没有针对 TCP/UDP 1194 到 OpenVPN 服务器计算机内部地址的端口转发规则
。
我很确定路由器上的配置也正确。以下是路由器上的 iptables nat 配置：
> iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere 224.0.0.0/3
ACCEPT tcp -- anywhere anywhere tcp dpt:4567
DNAT udp -- anywhere anywhere udp dpt:51697 to:192.168.0.3
DNAT udp -- anywhere anywhere udp dpt:50487 to:192.168.0.3
DNAT udp -- anywhere anywhere udp dpt:55287 to:192.168.0.3
DNAT udp -- anywhere anywhere udp dpt:35689 to:192.168.0.3
DNAT tcp -- anywhere anywhere tcp dpt:35689 to:192.168.0.3
DNAT udp -- anywhere anywhere udp dpt:62384 to:192.168.0.3
DNAT udp -- anywhere anywhere udp dpt:53919 to:192.168.0.3
DNAT udp -- anywhere anywhere udp dpt:52438 to:192.168.0.3
DNAT udp -- anywhere anywhere udp dpt:62603 to:192.168.0.3
DNAT udp -- anywhere anywhere udp dpt:59415 to:192.168.0.3
DNAT udp -- anywhere anywhere udp dpt:60285 to:192.168.0.3
DNAT udp -- anywhere anywhere udp dpt:60530 to:192.168.0.3
DNAT udp -- anywhere anywhere udp dpt:50209 to:192.168.0.3
DNAT udp -- anywhere anywhere udp dpt:58670 to:192.168.0.3
DNAT udp -- anywhere anywhere udp dpt:51621 to:192.168.0.17
DNAT udp -- anywhere anywhere udp dpt:57874 to:192.168.0.17
DNAT udp -- anywhere anywhere udp dpt:62558 to:192.168.0.18
DNAT tcp -- anywhere anywhere tcp dpt:www to:192.168.0.111
REDIRECT tcp -- anywhere anywhere tcp dpt:webcache redir ports 80
DNAT udp -- anywhere anywhere udp dpt:57106 to:192.168.0.22:16402
DNAT tcp -- anywhere anywhere tcp dpt:15980 to:5.5.126.125:15979
DNAT tcp -- anywhere anywhere tcp dpt:https to:192.168.0.111
DNAT udp -- anywhere anywhere udp dpt:https to:192.168.0.111
DNAT tcp -- anywhere anywhere tcp dpt:1194 to:192.168.0.111
DNAT udp -- anywhere anywhere udp dpt:1194 to:192.168.0.111
DNAT udp -- anywhere anywhere udp dpt:53681 to:192.168.0.25
DNAT udp -- anywhere anywhere udp dpt:51490 to:192.168.0.17
DNAT tcp -- anywhere anywhere tcp dpt:https to:192.168.0.111
DNAT tcp -- anywhere anywhere tcp dpt:1194 to:192.168.0.111
DNAT udp -- anywhere anywhere udp dpt:1194 to:192.168.0.111
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
- OpenVPN 客户端配置在其配置文件中没有正确的服务器地址。客户端配置文件中的远程指令必须指向服务器本身或服务器网络网关的公共 IP 地址。
我已检查、再检查、再检查过它所连接的 IP，它是正确的。
- 另一个可能的原因是 Windows 防火墙阻止了对 openvpn.exe 二进制文件的访问。您可能需要将其列入白名单（将其添加
到“例外”列表中）以使 OpenVPN 正常工作。
我相当确定这不是问题，因为我能够从本地网络连接。我错了吗？Windows 8.1 在连接到远程地址时会阻止二进制文件，但在连接到本地地址时不会阻止吗？这对我来说似乎不太可能......
编辑 -
这是我的配置文件
##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server. #
# #
# This configuration can be used by multiple #
# clients, however each client should have #
# its own cert and key files. #
# #
# On Windows, you might want to rename this #
# file so it has a .ovpn extension #
##############################################
# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client client1
# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun
# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one. On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap
# Are we connecting to a TCP or
# UDP server? Use the same setting as
# on the server.
;proto tcp
proto udp
# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
;remote 192.168.0.111 1194
remote 63.xxx.xx.xx 1194
# Choose a random host from the remote
# list for load-balancing. Otherwise
# try hosts in the order specified.
;remote-random
# Keep trying indefinitely to resolve the
# host name of the OpenVPN server. Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite
# Most clients don't need to bind to
# a specific local port number.
nobind
# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nobody
# Try to preserve some state across restarts.
persist-key
persist-tun
# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here. See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
# Wireless networks often produce a lot
# of duplicate packets. Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings
# SSL/TLS parms.
# See the server config file for more
# description. It's best to use
# a separate .crt/.key file pair
# for each client. A single ca
# file can be used for all clients.
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\client1.crt"
key "C:\\Program Files\\OpenVPN\\config\\client1.key"
# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server". This is an
# important precaution to protect against
# a potential attack discussed here:
# http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server". The build-key-server
# script in the easy-rsa folder will do this.
ns-cert-type server
# If a tls-auth key is used on the server
# then every client must also have the key.
;tls-auth ta.key 1
# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
;cipher x
# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo yes
# Set log file verbosity.
verb 3
# Silence repeating messages
;mute 20
auth-nocache
script-security 2
remote-cert-tls server
有谁知道我为什么会遇到连接问题？
EDIT2 - 我用它来设置 openVPN： http://en.opensuse.org/SDB:OpenVPN_Installation_and_Setup
那里有一个“防火墙配置”部分，但对我来说不适用，因为我没有 openvz 或 kvm。我使用 yast 在 SuSEfirewall2 中打开端口 1194
答案1
远程位置阻止了大多数出站流量。我必须在端口 443（SSL 端口）上运行 OpenVPN，才能使其从特定位置运行。没有远程位置会阻止 443。
答案2
告诉您的系统转发网关流量：
$ sysctl -w net.ipv4.ip_forward=1
sysctl: permission denied on key 'net.ipv4.ip_forward'
[user@localhost udp]$ sudo !!
sudo sysctl -w net.ipv4.ip_forward=1
[sudo] password for user:
net.ipv4.ip_forward = 1
[user@localhost udp]$