我一直在本地运行 openvpn 服务器。它与许多物理客户端配合良好。我已经设置了一个 Amazon EC2 Debian 9 实例并安装了 openvpn 客户端，就像我通常做的那样，但我无法让它通过 VPN 响应来自服务器的 ping。ping 隧道接口 (10.4.90.58) 有效，但 ping eth0 地址 (172.31.1.165) 无效。所有路由似乎都已正确推送
从客户端到服务器和共享子网的 ping 操作正常。
客户端配置文件
client
dev tun
proto udp
remote myplace.com.au 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca keys/esca.crt
cert keys/ear1.crt
key keys/ear1.key
remote-cert-tls server
comp-lzo yes
verb 4
mute 20
server.conf 的相关部分
port 1194
proto udp
dev tun
# Certs
ca keys/ca.crt
cert keys/server.crt
key keys/server.key # This file should be kept secret
dh keys/dh1024.pem
# Addresses
server 10.4.90.0 255.255.255.0
client-config-dir ccd
push "route 192.168.90.0 255.255.255.0"
push "route 192.168.20.0 255.255.255.0"
# Amazon Subnet - Not working
route 172.31.0.0 255.255.240.0
push "route 172.31.0.0 255.255.240.0"
# A Working Client
route 192.168.50.0 255.255.255.0
push "route 192.168.50.0 255.255.255.0"
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
status openvpn-status.log
client-to-client
persist-key
persist-tun
unique vpn certs
verb 4
ccd 文件 ccd/ear1
iroute 172.31.0.0 255.255.240.0
服务器接口
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc cbq state UP qlen 1000
link/ether 28:92:4a:35:63:d6 brd ff:ff:ff:ff:ff:ff
inet 10.0.0.90/24 brd 10.0.0.255 scope global eth0
inet6 2001:8000:103f:d600:2a92:4aff:fe35:63d6/64 scope global dynamic
valid_lft 3399sec preferred_lft 3399sec
inet6 fe80::2a92:4aff:fe35:63d6/64 scope link
valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
link/ether 28:92:4a:35:63:d8 brd ff:ff:ff:ff:ff:ff
inet 192.168.90.1/24 brd 192.168.90.255 scope global eth1
inet6 fe80::2a92:4aff:fe35:63d8/64 scope link
valid_lft forever preferred_lft forever
12: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
link/none
inet 10.4.90.1 peer 10.4.90.2/32 scope global tun0
服务器路由
10.4.90.2 dev tun0 proto kernel scope link src 10.4.90.1
192.168.20.0/24 dev eth2 proto kernel scope link src 192.168.20.1
10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.90
192.168.30.0/24 via 10.4.90.2 dev tun0
10.4.90.0/24 via 10.4.90.2 dev tun0
192.168.90.0/24 dev eth1 proto kernel scope link src 192.168.90.1
172.31.0.0/20 via 10.4.90.2 dev tun0
default via 10.0.0.1 dev eth0
客户端接口
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc pfifo_fast state UP group default qlen 1000
link/ether 02:91:54:a2:0d:5a brd ff:ff:ff:ff:ff:ff
inet 172.31.1.165/20 brd 172.31.15.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::91:54ff:fea2:d5a/64 scope link
valid_lft forever preferred_lft forever
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
link/none
inet 10.4.90.58 peer 10.4.90.57/32 scope global tun0
valid_lft forever preferred_lft forever
inet6 fe80::3d1c:f4f4:d17e:b0fc/64 scope link flags 800
valid_lft forever preferred_lft forever
客户端路线
default via 172.31.0.1 dev eth0
10.4.90.0/24 via 10.4.90.57 dev tun0
10.4.90.57 dev tun0 proto kernel scope link src 10.4.90.58
172.31.0.0/20 dev eth0 proto kernel scope link src 172.31.1.165
192.168.20.0/24 via 10.4.90.57 dev tun0
192.168.30.0/24 via 10.4.90.57 dev tun0
192.168.90.0/24 via 10.4.90.57 dev tun0
答案1
问题出在 MTU
将以下内容添加到 client.conf 即可解决此问题
link-mtu 1542