VPN 客户端无法访问 LAN

Question 1

我认为你应该取消注释推送路线openvpn.conf 文件中的行，看看它是否有效。

Answer

我认为你应该取消注释推送路线openvpn.conf 文件中的行，看看它是否有效。

Question 2

假设这是你想要的：

[OVPN Clients(10.8.0.0/24)]<-tunnel->[OVPN Svr(10.84.172.76)]<-LAN->[GW(10.84.172.1)]<-LAN->[SUBNET (10.84.172.0/24)]

并且您不能简单地将 10.8.0.0/24 --> 10.84.172.76 添加到 GW 的路由表中，您必须手动向每个 LAN 系统添加持久路由。

基于 Debian：编辑/etc/network/interfaces和添加

up route add -net 10.8.0.0/24 gw 10.84.172.76 dev [your_lan_nic (not tun!)]

基于 RHEL：编辑/etc/sysconfig/network-scripts/route-eth[your lan nic #]

10.8.0.0/24 via 10.84.172.76

我强烈建议您与网关管理员联系，以便在那里添加您的路线，而不必单独处理每个框。

我还建议您对 OpenVPN 配置做一些更改。

服务器配置（包含更改的理由）：

local xx.xx.xx.xx
#port 8443 isn't officially registered with iana, but it is a default for apache tomcat ssl.
#you may be better served by using a less commonly-used port.
port 8443
#proto udp generally has significantly better performance than tcp.
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
#topology subnet is recommended over the default net30.
#you should only have to use net30 if an old Windows ovpn client needs to connect.
topology subnet
server 10.8.0.0 255.255.255.0
push "route 10.84.172.0 255.255.255.0"
;push "redirect-gateway def1 bypass-dhcp"   #leave this out for now to help diagnose routing issues.
push "dhcp-option DNS 10.84.172.117"
push "dhcp-option DNS 9.9.9.9"
duplicate-cn
keepalive 10 120
tls-auth ta.key 0
#key-direction is unneccessary.
#the tls-auth setting already includes the direction (0)
;key-direction 0
cipher AES-128-CBC
auth SHA256
comp-lzo
max-clients 10
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
#Use either log or log-append, not both.
#log overwrites the log every time the service starts.
#log-append continues to write to the file when the service starts.
log openvpn.log
;log-append openvpn.log
#you'll probably want to lower the verbosity so your logs are readable.
#verb 3 is usually plenty of information.
verb 9
#mute helps keep your logs readable by suppressing floods of the same error.
mute 20
#explicit-exit-notify helps clients reconnect should the server need to restart.
explicit-exit-notify 1

客户端配置：

client
dev tun
#as above, proto udp has much better performance than tcp
proto udp
#remote host [port] [proto] it's useful to identify the remote server.
#host can be either the IP or FQDN if you have a DNS record.
#I continue to recommend a different port.
remote xx.xx.xx.xx 8443 udp
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
remote-cert-tls server
tls-auth ta.key 1
cipher AES-128-CBC
auth SHA256
key-direction 1
comp-lzo
verb 3
mute 20

Answer