无法访问 OpenVPN 服务器后面的 LAN 设备

2024-5-31 • tag-icon

我在 Ubuntu Server 16.04 (10.122.224.2) 上运行 OpenVPN。在与 OpenVPN 服务器 (10.122.224.0/24) 相同的 LAN 上，我有一个 VoIP PBX (10.122.224.5)。

在我本地，我有一台 IP 电话 (192.168.10.110) 和一台位于同一子网的 Windows 计算机。我可以让 Windows PC 和 IP 电话成功连接到 VPN 并在 10.122.222.0/24 VPN 子网中获取 IP。Windows PC 和 IP 电话可以通过 10.122.222.0/24 子网相互 ping 通，也可以 ping 10.122.224.2 处的 OpenVPN 服务器，但它们无法 ping 10.122.224.5 处的 PBX。OpenVPN 服务器可以 ping 所有设备，没有问题。

我已在 OpenVPN 服务器上启用 IPv4 转发，并在 OpenVPN 服务器配置中添加了推送路由。我似乎无法通过连接到 VPN 的客户端访问 OpenVPN 服务器后面的子网。

以下是我的服务器配置

local PUBLIC_IP
port 1194
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/cloudco.crt
key /etc/openvpn/keys/cloudco.key
dh /etc/openvpn/keys/dh2048.pem
server 10.122.222.0 255.255.255.0
push "route 10.122.224.0 255.255.255.0"
client-to-client
comp-lzo no
keepalive 10 120
persist-key
persist-tun
verb 3
tls-server
log-append /var/log/openvpn.log

这是客户端配置

remote PUBLIC_IP
client
dev tun
resolv-retry infinite
ping 10
persist-key
persist-tun
float
comp-lzo no
proto udp
ca keys/ca.crt
cert keys/pctest.crt
key keys/pctest.key
ns-cert-type server
pull

我四处搜索，找到了一些对其他人有用的解决方案，但似乎对我不起作用。寻找一些方向。

编辑我已经从 Ubuntu 切换到 VyOS。VPN 服务器已启动，我可以连接到 VPN，尽管我仍然无法访问 VPN 后面的 LAN 设备。VyOS 盒是 LAN 的网关。

跟踪路由

10.122.224.5 至 10.122.222.2

traceroute to 10.122.222.2 (10.122.222.2), 30 hops max, 60 byte packets
 1  gw.sv2.orionvm.net (23.90.82.1)  0.955 ms  1.039 ms  0.884 ms
 2  192.168.50.1 (192.168.50.1)  1.071 ms  0.971 ms  0.956 ms
 3  206.16.209.233 (206.16.209.233)  1.205 ms  0.919 ms  1.185 ms
 4  mdf001c7613r0001-gig-10-3.wdc1.attens.net (63.240.192.137)  32.565 ms  32.557 ms  32.426 ms
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  * * *
10  * * *
11  * * *
12  * * *
13  * * *
14  * * *
15  * * *
16  * * *
17  * * *
18  * * *
19  * * *
20  * * *
21  * * *
22  * * *
23  * * *
24  * * *
25  * * *
26  * * *
27  * * *
28  * * *
29  * * *
30  * * *

10.122.222.2 至 10.122.224.5

λ tracert 10.122.224.5

Tracing route to 10.122.224.5 over a maximum of 30 hops

  1    41 ms    41 ms    39 ms  10.122.222.1
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  4     *        *        *     Request timed out.
  5     *        *        *     Request timed out.
  6     *        *        *     Request timed out.
  7     *        *        *     Request timed out.
  8     *        *        *     Request timed out.
  9     *        *        *     Request timed out.
 10     *        *        *     Request timed out.
 11     *        *        *     Request timed out.
 12     *        *        *     Request timed out.
 13     *        *        *     Request timed out.
 14     *        *        *     Request timed out.
 15     *        *        *     Request timed out.
 16     *        *        *     Request timed out.
 17     *        *        *     Request timed out.
 18     *        *        *     Request timed out.
 19     *        *        *     Request timed out.
 20     *        *        *     Request timed out.
 21     *        *        *     Request timed out.
 22     *        *        *     Request timed out.
 23     *        *        *     Request timed out.
 24     *        *        *     Request timed out.
 25     *        *        *     Request timed out.
 26     *        *        *     Request timed out.
 27     *        *        *     Request timed out.
 28     *        *        *     Request timed out.
 29     *        *        *     Request timed out.
 30     *        *        *     Request timed out.

10.122.222.2 至 vyos 公共

λ tracert 23.90.82.138

Tracing route to 23-90-82-138.sv2.orionvm.net [23.90.82.138]
over a maximum of 30 hops:

  1    <1 ms    <1 ms    <1 ms  192.168.10.1
  2     1 ms     8 ms    10 ms  agg15.lncsnycd01h.northeast.rr.com [24.58.27.213]
  3     9 ms     9 ms     9 ms  agg37.lkwnnyad02r.northeast.rr.com [24.58.38.24]
  4    16 ms    13 ms    15 ms  be29.albynyyf01r.northeast.rr.com [24.58.32.58]
  5    24 ms    26 ms    21 ms  bu-ether16.nycmny837aw-bcr00.tbone.rr.com [66.109.6.74]
  6    17 ms    17 ms    17 ms  unk-426d0577.adelphiacom.net [66.109.5.119]
  7    17 ms    19 ms    19 ms  nyk-b6-link.telia.net [62.115.156.214]
  8    17 ms    17 ms    18 ms  nyk-b5-link.telia.net [213.155.130.32]
  9    35 ms    36 ms    36 ms  192.205.34.53
 10    40 ms    39 ms    42 ms  cr2.n54ny.ip.att.net [12.122.130.110]
 11    40 ms    43 ms    39 ms  cr2.wswdc.ip.att.net [12.122.28.42]
 12   131 ms   134 ms    66 ms  gar3.ascva.ip.att.net [12.122.113.89]
 13    80 ms    39 ms    40 ms  12.122.251.206
 14    49 ms    48 ms    47 ms  mdf002c7613r0002-gig-12-1.wdc1.attens.net [63.240.192.142]
 15    39 ms    39 ms    40 ms  206-16-217-10.attens.net [206.16.217.10]
 16     *        *        *     Request timed out.
 17    37 ms    37 ms    38 ms  23-90-82-138.sv2.orionvm.net [23.90.82.138]

Trace complete.

答案1

网络上的设备是否10.122.224.0/24有可以让它们到达的路由或路由器10.122.222.0/24？

连接到 VPN 的设备有到达其他网络的路由，但除非 VPN 服务器也是该网络的网关，否则该网络上的设备不会奇迹般地拥有返回流量的路由。因此，您需要调整该网络上的路由。或者使用 NAT 在 VPN 服务器上做一些不雅的事情。

PS 您可能要认真考虑topology subnet在 OpenVPN 配置中使用。与默认的 net30 拓扑相比，它将使 OpenVPN 路由更简单。

答案1

相关内容