我们正在尝试配置一个 OpenVPN 隧道，以允许 LAN 上的设备与 Amazon VPC 中的服务器进行通信。我们正在使用 Amazon 上的交钥匙 OpenVPN 访问服务器实例，并按照文档将我们的本地服务器设置为网关。
配置图片：https://i.stack.imgur.com/gwGxU.jpg
Amazon 服务器能够与我们 LAN 上的路由器 A 顺利通信（ping、ssh），但是当我们尝试从路由器 A ping 服务器的私有 IP 时，却无法通过。使用 tcpdump，我们在网关 A 的 eth0 接口上看到回显请求，但在 tun1 接口上看不到任何内容。似乎它没有被正确转发到 tun0 接口。使用 OpenVPN 的配置，我们已使客户端能够充当网关。
我们哪里做错了？下面有更多详细信息。
左侧网关
网络状态监测
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 10.23.0.1 0.0.0.0 UG 0 0 0 wlan0
10.0.0.2 10.0.2.1 255.255.255.255 UGH 0 0 0 tun1
10.0.1.0 10.0.2.1 255.255.255.0 UG 0 0 0 tun1
10.0.2.0 0.0.0.0 255.255.255.0 U 0 0 0 tun1
10.23.0.0 0.0.0.0 255.255.240.0 U 0 0 0 wlan0
54.208.149.66 10.23.0.1 255.255.255.255 UGH 0 0 0 wlan0
172.16.0.0 172.16.0.1 255.255.0.0 UG 0 0 0 tap0
192.168.0.0 192.168.10.100 255.255.0.0 UG 0 0 0 eth0
sudo iptables --list
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
路由
default via 10.23.0.1 dev wlan0 proto static
10.0.0.2 via 10.0.2.1 dev tun1 metric 101
10.0.1.0/24 via 10.0.2.1 dev tun1 metric 101
10.0.2.0/24 dev tun1 proto kernel scope link src 10.0.2.12
10.23.0.0/20 dev wlan0 proto kernel scope link src 10.23.3.197 metric 9
54.208.149.66 via 10.23.0.1 dev wlan0
172.16.0.0/16 via 172.16.0.1 dev tap0
192.168.0.0/16 via 192.168.10.100 dev eth0
OpenVPN 配置
setenv FORWARD_COMPATIBLE 1
client
proto tcp
remote vpn.xxx.com
port 3389
dev tun
dev-type tun
ns-cert-type server
reneg-sec 604800
sndbuf 100000
rcvbuf 100000
# NOTE: LZO commands are pushed by the Access Server at connect time.
# NOTE: The below line doesn't disable LZO.
comp-lzo no
verb 3
setenv PUSH_PEER_INFO
ip 规则
0: from all lookup local
220: from all lookup 220
32766: from all lookup main
32767: from all lookup default
是否配置
eth0 Link encap:Ethernet HWaddr 44:8a:5b:57:a7:68
inet addr:192.168.10.100 Bcast:192.168.10.255 Mask:255.255.255.0
inet6 addr: fe80::468a:5bff:fe57:a768/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:96265 errors:0 dropped:103 overruns:0 frame:0
TX packets:42772 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:15112811 (15.1 MB) TX bytes:6396552 (6.3 MB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:1420458 errors:0 dropped:0 overruns:0 frame:0
TX packets:1420458 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:339956597 (339.9 MB) TX bytes:339956597 (339.9 MB)
tap0 Link encap:Ethernet HWaddr a6:0a:3c:76:bd:33
inet addr:172.16.0.1 Bcast:172.16.0.255 Mask:255.255.255.0
inet6 addr: fe80::a40a:3cff:fe76:bd33/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:138694 errors:0 dropped:1155 overruns:0 frame:0
TX packets:118026 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:49993976 (49.9 MB) TX bytes:25231042 (25.2 MB)
tun1 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.0.2.11 P-t-P:10.0.2.11 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:9 errors:0 dropped:0 overruns:0 frame:0
TX packets:9 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:1260 (1.2 KB) TX bytes:1372 (1.3 KB)
wlan0 Link encap:Ethernet HWaddr 40:f0:2f:8f:51:5c
inet addr:10.23.3.197 Bcast:10.23.15.255 Mask:255.255.240.0
inet6 addr: fe80::42f0:2fff:fe8f:515c/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2205804 errors:0 dropped:0 overruns:0 frame:0
TX packets:1773520 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1823901987 (1.8 GB) TX bytes:273830921 (273.8 MB)
右侧网关
OpenVPN Access Server Version: 2.0.8
Accepting VPN client connections on IP address: all interfaces
Port for VPN client connections: tcp/3389
OSI Layer: 3 (routing/NAT)
Clients access private subnets using: Routing
openvpnas@openvpnas2:/var/log$ netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 10.0.1.1 0.0.0.0 UG 0 0 0 eth0
10.0.1.0 10.0.1.128 255.255.255.0 UG 0 0 0 eth0
10.0.2.0 0.0.0.0 255.255.255.0 U 0 0 0 as0t0
172.16.0.0 0.0.0.0 255.255.0.0 U 0 0 0 as0t0
192.168.0.0 0.0.0.0 255.255.0.0 U 0 0 0 as0t0
答案1
我认为缺少 iroute conf。简而言之，您需要创建一个 ccd 文件夹并在 openvpn conf 文件中指定其路径，如下所示：
client-config-dir /path-to-ccd/ccd
在该文件夹中，您应该创建一个与特定 vpn conf 相对应的文件（如果您在username-as-common-nameconf 中，那么证书的名称就是文件的名称），然后将内部子网放入该文件中，例如
iroute 192.168.x.x 255.255.x.x
在这种情况下 openvpn 将知道如何到达内部子网。
更多详情请点击这里： https://community.openvpn.net/openvpn/wiki/RoutedLans
希望这可以帮助。