我正在尝试在我的 Raspberry Pi 上运行 OpenVPN 服务器。Raspberry Pi 运行的是 Arch Linux，OpenVPN 版本为 2.3.8-2。
我目前能够从 Android 设备连接到服务器，但无法访问互联网（但是我可以通过 ping 其 eth0 地址 192.168.86.3 或通过 tun0 10.8.0.1 ping 它来访问托管 OpenVPN 服务器的设备）。我尝试过 OpenVPN 服务器和 iptables 的许多不同配置，但仍然没有任何成功，希望得到帮助。
这是我的服务器的配置：
port 443
proto tcp
dev tun0
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/key.crt
key /etc/openvpn/keys/key.key
dh /etc/openvpn/keys/dh4096.pem
tls-auth /etc/openvpn/keys/ta.key 0
user nobody
group nobody
server 10.8.0.0 255.255.255.0
persist-key
persist-tun
ifconfig-pool-persist ipp.txt
topology subnet
push "redirect-gateway def1"
push "route 192.168.86.0 255.255.255.0"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 192.168.86.1"
keepalive 10 120
comp-lzo
status openvpn-status.log
log-append /var/log/openvpn.log
verb 4
我的客户端配置：
client
dev tun
proto tcp
remote SERVER_IP 443
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun
<ca>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
</key>
key-direction 1
<tls-auth>
-----BEGIN OpenVPN Static key V1-----
...
-----END OpenVPN Static key V1-----
</tls-auth>
comp-lzo
verb 3
Android设备上的跑步路线输出：
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.8.0.0 * 255.255.255.0 U 0 0 0 tun0
服务器上的 iptables 规则：
# Generated by iptables-save v1.4.21 on Mon Nov 9 20:43:23 2015
*mangle
:PREROUTING ACCEPT [5137:447124]
:INPUT ACCEPT [3884:334912]
:FORWARD ACCEPT [624:36889]
:OUTPUT ACCEPT [2554:269872]
:POSTROUTING ACCEPT [3178:306761]
COMMIT
# Completed on Mon Nov 9 20:43:23 2015
# Generated by iptables-save v1.4.21 on Mon Nov 9 20:43:23 2015
*nat
:PREROUTING ACCEPT [737:37974]
:INPUT ACCEPT [413:18792]
:OUTPUT ACCEPT [7:508]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Mon Nov 9 20:43:23 2015
# Generated by iptables-save v1.4.21 on Mon Nov 9 20:43:23 2015
*filter
:INPUT ACCEPT [3878:334408]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [2564:271200]
-A INPUT -i tun+ -j ACCEPT
-A FORWARD -i tun+ -j ACCEPT
COMMIT
# Completed on Mon Nov 9 20:43:23 2015
Ping 8.8.8.8 失败。Ping 10.8.0.1 成功。Ping 192.168.86.3 也成功。
编辑：添加了更多详细信息
以下是服务器上 ifconfig 的输出：
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.86.3 netmask 255.255.255.0 broadcast 192.168.86.255
inet6 fe80::30a2:e462:a8e7:64b8 prefixlen 64 scopeid 0x20<link>
ether b8:27:eb:59:26:90 txqueuelen 1000 (Ethernet)
RX packets 39226 bytes 8815553 (8.4 MiB)
RX errors 0 dropped 100 overruns 0 frame 0
TX packets 14621 bytes 1395612 (1.3 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 0 (Local Loopback)
RX packets 131 bytes 10414 (10.1 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 131 bytes 10414 (10.1 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1500
inet 10.8.0.1 netmask 255.255.255.0 destination 10.8.0.1
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (UNSPEC)
RX packets 4719 bytes 369475 (360.8 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 12 bytes 984 (984.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
当我从客户端运行“traceroute 8.8.8.8”时，结果是这样的。
traceroute to 8.8.8.8 (8.8.8.8), 64 hops max, 52 byte packets
1 10.8.0.1 (10.8.0.1) 2.718 ms 5.771 ms 2.981 ms
2 * * *
3 * * *
4 * * *
// And so on...
编辑：附加信息
输出sysctl -n net.ipv4.ip_forward
1
答案1
我禁用了“systemd-networkd”，它默认禁用接口的 IP 转发，重新启动，现在它可以正常工作了！
编辑： 需要澄清的是，我禁用了“systemd-netword”，因为“systemd-networkd”在默认配置中阻止了 IP 转发，而我没有使用它做任何事情。我确实不是禁用该服务以禁用 IP 转发。