☰

OpenVPN TCP 443

tag-icon • tag-icon openvpn tcp udp
OpenVPN TCP 443

我在 Ubuntu 16.04.3 上运行 OpenVPN 服务器版本 2.4.4。VPN 连接使用 UDP 1194 时工作正常，但当我尝试更改为 TCP 443 时，它就是无法连接。我使用的是 apache2，在使用命令进行测试之前我将其关闭service apache2 stop。ufw tcp 443 是允许的，但即使我关闭防火墙，它也无法连接。（Windows 客户端也是如此）

这是我的服务器配置：

port 443
proto tcp
;proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 213.133.98.98"
push "dhcp-option DNS 213.133.99.99"
push "dhcp-option DNS 213.133.100.100"
keepalive 10 120
tls-auth ta.key 0
key-direction 0
cipher AES-256-CBC
tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384
auth SHA512
max-clients 2
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
explicit-exit-notify 1
tls-version-min 1.2
reneg-sec 60
remote-cert-tls client

我的客户端配置：

client
dev tun
proto tcp
;proto udp
remote *super secret IP* 443
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
tls-auth ta.key 1
cipher AES-256-CBC
tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384
auth SHA512
key-direction 1
auth-nocache
reneg-sec 60
verb 3

客户端日志：

Fri Nov 10 13:35:05 2017 SIGUSR1[soft,connection-reset] received, process restarting
Fri Nov 10 13:35:05 2017 MANAGEMENT: >STATE:1510317305,RECONNECTING,connection-reset,,,,,
Fri Nov 10 13:35:05 2017 Restart pause, 5 second(s)
Fri Nov 10 13:35:10 2017 TCP/UDP: Preserving recently used remote address: [AF_INET]*super secret IP*:443
Fri Nov 10 13:35:10 2017 Socket Buffers: R=[65536->65536] S=[65536->65536]
Fri Nov 10 13:35:10 2017 Attempting to establish TCP connection with [AF_INET]*super secret IP*:443 [nonblock]
Fri Nov 10 13:35:10 2017 MANAGEMENT: >STATE:1510317310,TCP_CONNECT,,,,,,
Fri Nov 10 13:35:11 2017 TCP connection established with [AF_INET]*super secret IP*:443
Fri Nov 10 13:35:11 2017 TCP_CLIENT link local: (not bound)
Fri Nov 10 13:35:11 2017 TCP_CLIENT link remote: [AF_INET]*super secret IP*:443
Fri Nov 10 13:35:11 2017 MANAGEMENT: >STATE:1510317311,WAIT,,,,,,
Fri Nov 10 13:35:11 2017 Connection reset, restarting [0]

服务器日志：

Nov 12 18:22:22 ubuntu systemd[1]: Starting OpenVPN connection to server...
Nov 12 18:22:22 ubuntu systemd[1]: Starting OpenVPN service...
Nov 12 18:22:22 ubuntu systemd[1]: Started OpenVPN service.
Nov 12 18:22:22 ubuntu systemd[1]: Failed to start OpenVPN connection to server.

ip addr show tun0使用 UDP 1149：

12: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
    link/none
    inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0
       valid_lft forever preferred_lft forever

ip addr show tun0使用 TCP 443：

Device "tun0" does not exist.

有人知道为什么我改为 TCP 443 后它不起作用吗？

答案1

可能 openvpn 服务器无法绑定特权端口：

用户 nobody 组 nogroup

尝试

用户 root 组 root

看看是否有效。

答案2

好的，我找到了解决方案！感谢 djsumdog 为我提供了 log-append 选项的提示。文件中有错误：Options error: --explicit-exit-notify can only be used with --proto udp 所以当我想使用 TCP 时，我无法使用此选项。现在一切都运行正常。

相关内容