☰

openvpn 配置 - 无法连接到 aws vpc 中的服务器

tag-icon • tag-icon amazon-web-services amazon-ec2 openvpn amazon-vpc
openvpn 配置 - 无法连接到 aws vpc 中的服务器

我遇到的问题是当我连接到白名单 IP 之外时：

  1. VPN 连接成功
  2. 设备的 IP 没有改变
  3. 互联网发挥作用
  4. 连接到 VPN 时无法直接访问实例

以下是我在 vpc 内的 AWS EC2 实例上的 openvpn 配置：

EC2->

Ubuntu 16.04 LTS
openvpn
easyrsa
ufw
Has elastic ip (let's call this 26.3.4.5 for this config file)

AWS 安全组设置非常简单：

INBOUND->
Ports   Protocol    Source        openvpn
22      tcp         PrivateIP/0    ✔
443     tcp         0.0.0.0/0      ✔

OUTBOUND->
All traffic  All All 0.0.0.0/0

openvpn配置->

port PORTFORTRAFFIC
dev tun

 **# All these are in the root directory of openvpn i.e. /etc/openvpn/*.crt or /etc/openvpn/*.key** 

ca ca.crt
cert vpnserver.crt
key vpnserver.key
dh dh2048.pem
 # VPN Subnet
server 10.8.0.0 255.255.255.0
 # DNS
push "dhcp-option DNS 208.67.222.222"   
push "dhcp-option DNS 208.67.220.220" 
push "route 172.30.0.0 255.255.0.0" # AWS EC2 Private IPs 172.x.x.x

keepalive 10 120

tls-auth ta.key 0 # This file is secret
key-direction 0

cipher AES-128-CBC   # AES
auth SHA256

comp-lzo # enabled for client setup as well
user nobody
group nogroup

persist-key
persist-tun
status openvpn-status.log
verb 6 # DEBUGGING currently but its set to 3 normally
log-append  openvpn.log

在终端中使用此行执行 iptables 并将其添加到 /etc/rc.local ：

# iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

防火墙内容：

# ufw allow PORTFORTRAFFIC/tcp

# ufw allow OpenSSH

# ufw app list
Available applications:
  OpenSSH

为了持久性，这也被添加到“/etc/sysctl.conf”中：

net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.all.rp_filter=1
net.ipv4.ip_forward=1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

# cat /proc/sys/net/ipv4/ip_forward

返回 1

答案1

您需要将路线更改为：

push "route route 172.30.0.0 255.255.0.0 vpn_gateway"

相关内容