![OpenVPN桥接模式,无法访问专用网络](https://linux22.com/image/671380/OpenVPN%E6%A1%A5%E6%8E%A5%E6%A8%A1%E5%BC%8F%EF%BC%8C%E6%97%A0%E6%B3%95%E8%AE%BF%E9%97%AE%E4%B8%93%E7%94%A8%E7%BD%91%E7%BB%9C.png)
我正在努力解决这个问题,但就是想不通。我正在使用云服务器,我从他们那里获得了一个私有网络,其 IP 为 10.99.xx,网络掩码为 255.255.0.0
我有两台服务器:
服务器 A:eth0:公共 IP eth1:10.99.0.10(DHCP 服务器)
服务器B:
br0 Link encap:Ethernet HWaddr 5a:00:00:17:77:9d
inet addr:10.99.0.13 Bcast:10.99.0.255 Mask:255.255.0.0
inet6 addr: fe80::5800:ff:fe17:779d/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:14372 errors:0 dropped:0 overruns:0 frame:0
TX packets:13790 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1499616 (1.4 MiB) TX bytes:2504080 (2.3 MiB)
eth0 Link encap:Ethernet HWaddr 56:00:00:17:77:9d
inet addr:publicip Bcast:publicip.255 Mask:255.255.255.0
inet6 addr: public Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:43554 errors:0 dropped:0 overruns:0 frame:0
TX packets:42546 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:6842717 (6.5 MiB) TX bytes:6795158 (6.4 MiB)
eth1 Link encap:Ethernet HWaddr 5a:00:00:17:77:9d
inet6 addr: fe80::5800:ff:fe17:779d/64 Scope:Link
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:61 errors:0 dropped:0 overruns:0 frame:0
TX packets:126 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:10634 (10.3 KiB) TX bytes:14772 (14.4 KiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
tap0 Link encap:Ethernet HWaddr ba:41:3e:54:37:72
inet6 addr: fe80::b841:3eff:fe54:3772/64 Scope:Link
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:14345 errors:0 dropped:0 overruns:0 frame:0
TX packets:13915 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:1696767 (1.6 MiB) TX bytes:2511654 (2.3 MiB)
如果我运行以下命令:
dhcpclient br0
我从服务器 A 的 DHCP 服务器获取分配的 IP
OPENVPN 在服务器 B 上以桥接模式运行,配置:
port 443
proto tcp
dev tap0
server-bridge 10.99.0.13 255.255.0.0 10.99.0.100 10.99.0.150
架起桥梁:
#!/bin/bash
#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################
# Define Bridge Interface
br="br0"
# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"
# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth1"
eth_ip="10.99.0.13"
eth_netmask="255.255.0.0"
eth_broadcast="10.99.0.255"
for t in $tap; do
openvpn --mktun --dev $t
done
brctl addbr $br
brctl addif $br $eth
for t in $tap; do
brctl addif $br $t
done
for t in $tap; do
ifconfig $t 0.0.0.0 promisc up
done
ifconfig $eth 0.0.0.0 promisc up
ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast
路由表服务器 B:
Destination Gateway Genmask Flags Metric Ref Use Iface
default publicip.1 0.0.0.0 UG 0 0 0 eth0
10.99.0.0 * 255.255.0.0 U 0 0 0 br0
publicip.0 * 255.255.255.0 U 0 0 0 eth0
link-local * 255.255.0.0 U 0 0 0 eth0
我正在使用 openvpn 连接到服务器 B,并且我希望所有流量都像这样流出:
VPN 客户端 ==> 服务器 B(VPN 服务器)==> eth1 ==> 服务器 A ==> eth0 ==> 互联网。
VPN 客户端:
ping 10.99.0.10
PING 10.99.0.10 (10.99.0.10): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
ping: sendto: No route to host
Request timeout for icmp_seq 4
ping: sendto: Host is down
^C
--- 10.99.0.10 ping statistics ---
11 packets transmitted, 0 packets received, 100.0% packet loss
服务器B br0 tcpdump:
12:43:18.301205 ARP, Request who-has 10.99.0.10 tell 10.99.0.100, length 28
12:43:19.280906 ARP, Request who-has 10.99.0.10 tell 10.99.0.100, length 28
12:43:22.597505 ARP, Request who-has 10.99.0.10 tell 10.99.0.13, length 28
12:43:22.599695 ARP, Reply 10.99.0.10 is-at 5a:00:00:17:d0:80 (oui Unknown), length 28
12:43:27.317572 ARP, Request who-has 10.99.0.100 tell 10.99.0.13, length 28
12:43:27.321143 ARP, Reply 10.99.0.100 is-at 66:25:94:15:72:63 (oui Unknown), length 28
现在我连接时,获得 IP 10.99.0.100,可以访问互联网。但我无法 ping 10.99.0.10。
我的问题:
- 我如何添加一条路由,使得来自 VPN 服务器的所有来自服务器 B 的流量都必须通过 eth1,然后通过网关到服务器 A 才能到达外界?
我尝试添加和更改路线,但大多数情况下都没有起作用,而且大多数情况下我还失去了从外界连接到 VPN 服务器的连接。
希望有人能指导一下!
最亲切的问候
答案1
我让它与 tun 设置和基于源的路由一起工作!