我正在设置一个辅助 (DD-WRT) 路由器作为 OpenVPN 客户端，这样所有客户端只需连接到路由器即可获得 VPN 访问权限。但似乎客户端流量总是通过主网关而不是已建立的 VPN 隧道进行路由。
设置
ISP modem+router(gateway) <--LAN cable--> DD-WRT OpenVPN client <--LAN/WIFI--> clients
此辅助 DD-WRT OpenVPN 客户端可以正常连接到远程 OpenVPN 服务器。
我可以通过首先 telnet 进入 DD-WRT 来 ping 服务器端子网中的主机。
OpenVPN服务器也显示DD-WRT客户端已正确连接。
wget -O-http://icanhazip.com返回远程服务器的公共 IP。
因此隧道已正常建成。
问题
连接到我的 DD-WRT 的客户端的流量通过我的网关路由器路由，而不是通过 VPN 隧道 tun0。
我认为我需要将流量从 br0 接口转发到 tun0 接口。我尝试遵循 iptables 规则，并检查已启用 IPv4 转发。
cat /proc/sys/net/ipv4/ip_forward ==> 1
cat /proc/sys/net/ipv4/conf/tun0/forwarding ==> 1
cat /proc/sys/net/ipv4/conf/br0/forwarding ==> 1
# These rules are saved by pressing the 'Save firewall' button
#and rebooting the DD-WRT router.
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
并分别
# These rules are saved by pressing the 'Save firewall' button
# and rebooting the DD-WRT router.
iptables -I FORWARD -s 192.168.2.0/24 -d 192.168.66.0/24 -j ACCEPT
iptables -I FORWARD -s 192.168.66.0/24 -d 192.168.2.0/24 -j ACCEPT
设置
ISP 调制解调器 + 网关路由器
No settings modified. It is as ISP has set it.
DD-WRT OpenVPN 客户端
- Firmware: DD-WRT v24-sp2 (08/12/10) vpn
- SPI firewall: Disabled
- WAN: Disabled
- Operating mode: Router (this disables NAT, right?)
- Gateway: 192.168.2.1
- Local DNS: 8.8.8.8
- NTP client: Enabled
我没有发布 VPN 服务器/客户端配置，因为客户端可以无错误地连接到服务器，并且 ping 和 wget 命令都可以在 DD-WRT 内部正常工作。
所以，我的问题是：
如何将连接到 DD-WRT 的客户端的所有流量路由到其 OpenVPN 隧道 tun0？我是否错误地使用了 iptables？也许可以添加一条新路线？
如果缺少某些信息，请询问。提前谢谢您！:)
PS 以下是更多信息。
路由表（VPN 隧道启动后）
root@DD-WRT:~# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
87.219.xxx.xxx 192.168.2.1 255.255.255.255 UGH 0 0 0 br0
192.168.66.1 192.168.66.5 255.255.255.255 UGH 0 0 0 tun0
192.168.66.5 * 255.255.255.255 UH 0 0 0 tun0
192.168.5.0 192.168.66.5 255.255.255.0 UG 0 0 0 tun0
192.168.2 .0 * 255.255.255.0 U 0 0 0 br0
169.254.0.0 * 255.255.0.0 U 0 0 0 br0
127.0.0.0 * 255.0.0.0 U 0 0 0 lo
default 192.168.66.5 128.0.0.0 UG 0 0 0 tun0
128.0.0.0 192.168.66.5 128.0.0.0 UG 0 0 0 tun0
default 192.168.2.1 0.0.0.0 UG 0 0 0 br0
IP 路线展示
root@DD-WRT:~# ip route show
87.219.xxx.xxx via 192.168.2.1 dev br0
192.168.66.1 via 192.168.66.5 dev tun0
192.168.66.5 dev tun0 proto kernel scope link src 192.168.66.6
192.168.5.0/24 via 192.168.66.5 dev tun0
192.168.2.0/24 dev br0 proto kernel scope link src 192.168.2.160
169.254.0.0/16 dev br0 proto kernel scope link src 169.254.255.1
127.0.0.0/8 dev lo scope link
0.0.0.0/1 via 192.168.66.5 dev tun0
128.0.0.0/1 via 192.168.66.5 dev tun0
default via 192.168.2.1 dev br0
知识产权规则展示
root@DD-WRT:~# ip rule show
0: from all lookup local
32766: from all lookup main
32767: from all lookup default
OpenVPN 客户端日志
root@DD-WRT:~# cat /var/log/messages | grep openvpn
May 24 15:47:21 DD-WRT daemon.notice openvpn[699]: OpenVPN 2.1.1 mipsel-unknown-linux-gnu [SSL] [LZO2] [EPOLL] built on Aug 12 2010
May 24 15:47:21 DD-WRT daemon.warn openvpn[699]: WARNING: file '/tmp/openvpncl/client.key' is group or others accessible
May 24 15:47:21 DD-WRT daemon.notice openvpn[702]: UDPv4 link local: [undef]
May 24 15:47:21 DD-WRT daemon.notice openvpn[702]: UDPv4 link remote: 87.219.xxx.xxx:1194
May 24 15:47:23 DD-WRT daemon.notice openvpn[702]: [server] Peer Connection Initiated with 87.219.xxx.xxx:1194
May 24 15:47:25 DD-WRT daemon.notice openvpn[702]: TUN/TAP device tun0 opened
May 24 15:47:25 DD-WRT daemon.notice openvpn[702]: /sbin/ifconfig tun0 192.168.66.6 pointopoint 192.168.66.5 mtu 1500
May 24 15:47:26 DD-WRT daemon.notice openvpn[702]: Initialization Sequence Completed
接口配置
root@DD-WRT:~# ifconfig
br0
Link encap:Ethernet HWaddr 00:1D:73:55:1C:A4
inet addr:192.168.2.160 Bcast:192.168.2.255 Mask:255.255.255.0
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:14119 errors:0 dropped:0 overruns:0 frame:0
TX packets:10639 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2068891 (1.9 MiB) TX bytes:5382302 (5.1 MiB)
br0:0
Link encap:Ethernet HWaddr 00:1D:73:55:1C:A4
inet addr:169.254.255.1 Bcast:169.254.255.255 Mask:255.255.0.0
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
eth0
Link encap:Ethernet HWaddr 00:1D:73:55:1C:A4
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:13136 errors:0 dropped:0 overruns:0 frame:0
TX packets:10847 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:2180726 (2.0 MiB) TX bytes:5517739 (5.2 MiB)
Interrupt:4
eth1
Link encap:Ethernet HWaddr 00:1D:73:55:1C:A6
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:210 errors:0 dropped:0 overruns:0 frame:198105
TX packets:3683 errors:14 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:41273 (40.3 KiB) TX bytes:963954 (941.3 KiB)
Interrupt:2 Base address:0x5000
lo
Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MULTICAST MTU:16436 Metric:1
RX packets:28 errors:0 dropped:0 overruns:0 frame:0
TX packets:28 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2034 (1.9 KiB) TX bytes:2034 (1.9 KiB)
tun0
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:192.168.66.6 P-t-P:192.168.66.5 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:56 errors:0 dropped:0 overruns:0 frame:0
TX packets:62 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:4734 (4.6 KiB) TX bytes:4428 (4.3 KiB)
vlan0
Link encap:Ethernet HWaddr 00:1D:73:55:1C:A4
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:13135 errors:0 dropped:0 overruns:0 frame:0
TX packets:10847 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1944080 (1.8 MiB) TX bytes:5466622 (5.2 MiB)
答案1
这里我假设服务器上的 lan 和 vpn 接口分别是 br0 和 tun0。
# Enable IP forwarding.
echo 1 > /proc/sys/net/ipv4/ip_forward
# Allow postrouting to tun0. You may want to use "-s" here to strictly limit forwarding to IPs on your LAN.
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
# Enable forwarding from the LAN to the VPN (and back via related and established connections).
# Again, you may want to use "-s".
iptables -A FORWARD -i br0 -o tun0 -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
它适用于 openwrt rotuer，来自@Xynehttps://bbs.archlinux.org/viewtopic.php?pid=1208721#p1208721