Openvpn服务器作为客户端：从服务器IP连接到客户端

Question 1

解决方案是：

不知何故，有以下防火墙规则将服务器定向到真实的 LAN 而不是 VPN，以访问必须删除的 VPN 客户端：

服务器 iptables -t nat -L -n -v --line-numbers：

Chain PREROUTING (policy ACCEPT 249K packets, 44M bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain INPUT (policy ACCEPT 247K packets, 44M bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 3954 packets, 273K bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 3890 packets, 269K bytes)
num   pkts bytes target     prot opt in     out     source               destination
1      208 15001 SNAT       all  --  *      *       10.8.0.0/24          0.0.0.0/0            to:[REDACTED SERVER_REAL_IP]

在服务器上：iptables -t nat -D POSTROUTING 1

瞧！一切正常……

要使其永久删除/注释相应的行/etc/rc.local。

感谢大家的帮助！

Answer

解决方案是：

不知何故，有以下防火墙规则将服务器定向到真实的 LAN 而不是 VPN，以访问必须删除的 VPN 客户端：

服务器 iptables -t nat -L -n -v --line-numbers：

Chain PREROUTING (policy ACCEPT 249K packets, 44M bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain INPUT (policy ACCEPT 247K packets, 44M bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 3954 packets, 273K bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 3890 packets, 269K bytes)
num   pkts bytes target     prot opt in     out     source               destination
1      208 15001 SNAT       all  --  *      *       10.8.0.0/24          0.0.0.0/0            to:[REDACTED SERVER_REAL_IP]

在服务器上：iptables -t nat -D POSTROUTING 1

瞧！一切正常……

要使其永久删除/注释相应的行/etc/rc.local。

感谢大家的帮助！

Question 2

以下是一个示例最小适用于以下网络设置的客户端到客户端 SSL/TLS 配置：

+------------------+            |                                                                 
|                  |            |                                                                 
|                  | 10.132.0.2 |                                                                 
|    Client 1      -------------|                                                                 
|                  |            |                                             +------------------+
|                  |            |                                             |                  |
+------------------+            |104.199.78.27                 130.211.80.223 |                  |
                             /- --------------  The Internet   ---------------|    Client 2      |
                           /-   |                                             |                  |
+------------------+     /-     |                                             |                  |
|                  |   /-       |                                             +------------------+
|                  | /-         |                                                                 
|  OpenVPN server  --------------                                                                 
|                  | 10.132.0.3 |                                                                 
|                  |            |                                                                 
+------------------+            |

104.199.78.2710.132.0.3被 NAT 到OpenVPN 服务器的内部。该10.8.0.0/24网络将用于所有 VPN 客户端。

以下是 OpenVPN 服务器配置：

tls-server
proto tcp
port 443
dev tun

ca ca.crt
cert server.crt
key server.key
dh dh2048.pem

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

client-to-client

keepalive 10 120

comp-lzo

persist-key
persist-tun

status openvpn-status.log
log-append  /var/log/openvpn.log
verb 4
mute 20

这是客户端 1 的配置：

client
dev tun
proto tcp-client
remote 10.132.0.3 443
resolv-retry infinite

ca ca.crt
cert client1.crt
key client1.key

nobind
persist-key
persist-tun
comp-lzo

status openvpn-status.log
log-append  /var/log/openvpn.log
verb 4
mute 20

这是客户端2的配置：

client
dev tun
proto tcp-client
remote 104.199.78.27 443
resolv-retry infinite

ca ca.crt
cert client2.crt
key client2.key

nobind
persist-key
persist-tun
comp-lzo

status openvpn-status.log
log-append  /var/log/openvpn.log
verb 4
mute 20

当一切正常运行时，我们获得以下 IP 和路由配置：

server% ifconfig tun0
tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:27 errors:0 dropped:0 overruns:0 frame:0
          TX packets:25 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:3971 (3.8 KiB)  TX bytes:3051 (2.9 KiB)

server% ip route show to match 10.8.0.0/24
default via 10.132.0.1 dev eth0 
10.8.0.0/24 via 10.8.0.2 dev tun0

client1% ifconfig tun0
tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.6  P-t-P:10.8.0.5  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:3 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:252 (252.0 B)  TX bytes:252 (252.0 B)

client1% ip route show to match 10.8.0.1
default via 10.132.0.1 dev eth0 
10.8.0.0/24 via 10.8.0.5 dev tun0

client2% ifconfig tun0
tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.8.0.10  P-t-P:10.8.0.9  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:5 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:420 (420.0 B)  TX bytes:420 (420.0 B)

client2% ip route show to match 10.8.0.1
default via 10.132.0.1 dev eth0 
10.8.0.0/24 via 10.8.0.9 dev tun0

因此我们拥有客户端到客户端的连接：

server% ping -c 1 10.8.0.6
PING 10.8.0.6 (10.8.0.6) 56(84) bytes of data.
64 bytes from 10.8.0.6: icmp_seq=1 ttl=64 time=1.45 ms

--- 10.8.0.6 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.456/1.456/1.456/0.000 ms
root@server:/etc/openvpn# ping -c 1 10.8.0.10
PING 10.8.0.10 (10.8.0.10) 56(84) bytes of data.
64 bytes from 10.8.0.10: icmp_seq=1 ttl=64 time=0.779 ms

--- 10.8.0.10 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.779/0.779/0.779/0.000 ms

client1% ping -c 1 10.8.0.10
PING 10.8.0.10 (10.8.0.10) 56(84) bytes of data.
64 bytes from 10.8.0.10: icmp_seq=1 ttl=64 time=1.39 ms

--- 10.8.0.10 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.392/1.392/1.392/0.000 ms
root@client1:/etc/openvpn# ping -c 1 10.8.0.1
PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=1.54 ms

--- 10.8.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.540/1.540/1.540/0.000 ms

client2% ping -c 1 10.8.0.6
PING 10.8.0.6 (10.8.0.6) 56(84) bytes of data.
64 bytes from 10.8.0.6: icmp_seq=1 ttl=64 time=1.12 ms

--- 10.8.0.6 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.124/1.124/1.124/0.000 ms
root@client2:/etc/openvpn# ping -c 1 10.8.0.1
PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=0.584 ms

--- 10.8.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.584/0.584/0.584/0.000 ms

Answer