☰

OpenVPN-密码实际上会改变吗？

tag-icon • tag-icon openvpn openwrt
OpenVPN-密码实际上会改变吗？

我在路由器 (openwrt) 上运行 openvpn，并尝试最大化吞吐量。我尝试降低证书使用的位数，但似乎对速度没有影响。猜测证书越短，登录时间越短（这并不重要，因为路由器始终处于开启状态）。我尝试更改和调整配置和密码，但速度保持不变。

这是我的 server.conf

port 443
proto udp
dev tun
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/se01.crt
key /etc/openvpn/keys/se01.key
dh /etc/openvpn/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
;duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/keys/ta.key 0 
cipher AES-256-CBC
;cipher AES-128-CBC
;cipher none
;max-clients 100
user openvpn
group nogroup
persist-key
persist-tun
status openvpn-status.log
log         /dev/null 
log-append  /dev/null
verb 3
;mute 20
explicit-exit-notify 1

这里是客户

key-direction 1
client
dev tun
proto udp
remote 5.150.254.167 443
resolv-retry infinite
nobind
verb 3
auth-nocache
persist-key
persist-tun
remote-cert-tls server
;user nobody
;group nogroup

cipher AES-256-CBC
;cipher AES-128-CBC
;cipher none

-----HERE BEGINS MY CERTS ETC-----

我尝试禁用加密，得到了此输出。我不确定如何读取它，但在我看来，它似乎使用了“cipher AES-256-GCM”。这是正确的吗？我该如何更改它，以便不推送“cipher AES-256-GCM”？

Tue Feb  6 08:53:16 2018 OpenVPN 2.4.4 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Tue Feb  6 08:53:16 2018 library versions: OpenSSL 1.0.2n  7 Dec 2017, LZO 2.10
Tue Feb  6 08:53:17 2018 ******* WARNING *******: '--cipher none' was specified. This means NO encryption will be performed and tunnelled data WILL be transmitted in clear text over the network! PLEASE DO RECONSIDER THIS SETTING!
Tue Feb  6 08:53:17 2018 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb  6 08:53:17 2018 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Feb  6 08:53:17 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]5.150.254.167:443
Tue Feb  6 08:53:17 2018 Socket Buffers: R=[163840->163840] S=[163840->163840]
Tue Feb  6 08:53:17 2018 UDP link local: (not bound)
Tue Feb  6 08:53:17 2018 UDP link remote: [AF_INET]5.150.254.167:443
Tue Feb  6 08:53:17 2018 TLS: Initial packet from [AF_INET]5.150.254.167:443, sid=7e98aa7d eaee25ee
Tue Feb  6 08:53:17 2018 VERIFY OK: depth=1, C=DE, ST=DE, L=Berlin, O=Data Privcy, CN=Data Privcy CA, name=Data Privcy, [email protected]
Tue Feb  6 08:53:17 2018 VERIFY KU OK
Tue Feb  6 08:53:17 2018 Validating certificate extended key usage
Tue Feb  6 08:53:17 2018 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Feb  6 08:53:17 2018 VERIFY EKU OK
Tue Feb  6 08:53:17 2018 VERIFY OK: depth=0, C=DE, ST=DE, L=Berlin, O=Data Privcy, CN=Data Privcy CA, name=Data Privcy, [email protected]
Tue Feb  6 08:53:17 2018 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue Feb  6 08:53:17 2018 [Data Privcy CA] Peer Connection Initiated with [AF_INET]5.150.254.167:443
Tue Feb  6 08:53:18 2018 SENT CONTROL [Data Privcy CA]: 'PUSH_REQUEST' (status=1)
Tue Feb  6 08:53:18 2018 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.14 10.8.0.13,peer-id 0,cipher AES-256-GCM'
Tue Feb  6 08:53:18 2018 OPTIONS IMPORT: timers and/or timeouts modified
Tue Feb  6 08:53:18 2018 OPTIONS IMPORT: --ifconfig/up options modified
Tue Feb  6 08:53:18 2018 OPTIONS IMPORT: route options modified
Tue Feb  6 08:53:18 2018 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Feb  6 08:53:18 2018 OPTIONS IMPORT: peer-id set
Tue Feb  6 08:53:18 2018 OPTIONS IMPORT: adjusting link_mtu to 1624
Tue Feb  6 08:53:18 2018 OPTIONS IMPORT: data channel crypto options modified
Tue Feb  6 08:53:18 2018 Data Channel: using negotiated cipher 'AES-256-GCM'
Tue Feb  6 08:53:18 2018 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Feb  6 08:53:18 2018 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Feb  6 08:53:18 2018 TUN/TAP device tun0 opened
Tue Feb  6 08:53:18 2018 TUN/TAP TX queue length set to 100
Tue Feb  6 08:53:18 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Tue Feb  6 08:53:18 2018 /sbin/ifconfig tun0 10.8.0.14 pointopoint 10.8.0.13 mtu 1500
Tue Feb  6 08:53:18 2018 /sbin/route add -net 5.150.254.167 netmask 255.255.255.255 gw 192.168.2.1
Tue Feb  6 08:53:18 2018 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.8.0.13
Tue Feb  6 08:53:18 2018 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.8.0.13
Tue Feb  6 08:53:18 2018 /sbin/route add -net 10.8.0.1 netmask 255.255.255.255 gw 10.8.0.13
Tue Feb  6 08:53:18 2018 Initialization Sequence Completed
^CTue Feb  6 08:54:27 2018 event_wait : Interrupted system call (code=4)
Tue Feb  6 08:54:27 2018 /sbin/route del -net 10.8.0.1 netmask 255.255.255.255
Tue Feb  6 08:54:27 2018 /sbin/route del -net 5.150.254.167 netmask 255.255.255.255
Tue Feb  6 08:54:27 2018 /sbin/route del -net 0.0.0.0 netmask 128.0.0.0
Tue Feb  6 08:54:27 2018 /sbin/route del -net 128.0.0.0 netmask 128.0.0.0
Tue Feb  6 08:54:27 2018 Closing TUN/TAP interface
Tue Feb  6 08:54:27 2018 /sbin/ifconfig tun0 0.0.0.0
Tue Feb  6 08:54:27 2018 SIGINT[hard,] received, process exiting

除了购买具有更好 CPU 的路由器外，还可以做什么来优化吞吐量？

答案1

这是“协商密码参数”在起作用；“cipher”选项被（默认）“ncp-ciphers”列表覆盖。这是 OpenVPN 2.4 以来的新功能。另请参阅手册页：

   --cipher alg
          Encrypt data channel packets with cipher algorithm alg.

          The default is BF-CBC, an abbreviation for  Blowfish  in  Cipher
          Block  Chaining mode.  When cipher negotiation (NCP) is allowed,
          OpenVPN 2.4 and newer on both client and server side will  auto‐
          matically   upgrade   to  AES-256-GCM.   See  --ncp-ciphers  and
          --ncp-disable for more details on NCP.

和

   --ncp-ciphers cipher_list
          Restrict the allowed ciphers to be negotiated to the ciphers  in
          cipher_list.   cipher_list is a colon-separated list of ciphers,
          and defaults to "AES-256-GCM:AES-128-GCM".

          For servers, the first cipher from cipher_list will be pushed to
          clients that support cipher negotiation.

因此，如果您想要 AES-128-GCM（可能比 AES-256-GCM 稍快），请将其添加ncp-ciphers "AES-128-GCM"到您的服务器配置中。

不过，为了优化速度，你可以通过调整网络选项获得更多好处。例如https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux。

相关内容