我们的办公室很小，目前由于疫情，员工需要远程办公，因此我们正在尝试配置 OpenVPN，以便他们可以访问内部应用程序。使用以下教程我能够从办公网络内部连接 openvpn。但是，如果我切换到办公网络以外的其他互联网连接，VPN 就无法连接。Wireshark 显示 P_Control_Hard_Reset_Client_V2。由于我能够进行内部连接，所以我不认为服务器端会出现任何问题，但是我认为我在路由 UDP 连接时犯了一些错误。我们有一个基本的 D-Link DIR-600M 路由器，我在“高级”和“私有服务器”选项下添加了内部服务器 IP 以及要转发的端口 1149（所有带有 UDP 端口 1194 的公共 IP 请求都将路由到 192.168.0.3 UDP 1194 端口）。我还向 ISP 核实过，他们说端口 1194 UDP 是开放的。但是，如果我尝试使用我们的公共 IP 进行连接，OpenVPN 则无法连接。 我的配置：我已经在一台物理计算机下使用 KVM 安装了 VPN 服务器和 CA Cerver。它们都通过桥接连接，并分配了特定的 IP。VPN 为 192.168.0.2，CA 为 192.168.0.3，有什么建议吗？
我收到以下错误
Sun Jul 19 09:35:42 2020 OpenVPN 2.4.9 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 24 2020
Sun Jul 19 09:35:42 2020 library versions: OpenSSL 1.1.1c FIPS 28 May 2019, LZO 2.08
Sun Jul 19 09:35:42 2020 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Sun Jul 19 09:35:42 2020 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Sun Jul 19 09:35:42 2020 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Sun Jul 19 09:35:42 2020 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Sun Jul 19 09:35:42 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]MY_PUBLIC_IP:1194
Sun Jul 19 09:35:42 2020 Socket Buffers: R=[212992->212992] S=[212992->212992]
Sun Jul 19 09:35:42 2020 UDP link local: (not bound)
Sun Jul 19 09:35:42 2020 UDP link remote: [AF_INET]MY_PUBLIC_IP:1194
Sun Jul 19 09:35:42 2020 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Sun Jul 19 09:36:42 2020 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Jul 19 09:36:42 2020 TLS Error: TLS handshake failed
Sun Jul 19 09:36:42 2020 SIGUSR1[soft,tls-error] received, process restarting
Sun Jul 19 09:36:42 2020 Restart pause, 5 second(s)
Sun Jul 19 09:36:48 2020 RESOLVE: Cannot resolve host address: vpn.MY_SERVERE.net:1194 (Name or service not known)
Sun Jul 19 09:36:53 2020 RESOLVE: Cannot resolve host address: vpn.MY_SERVERE.net:1194 (Name or service not known)
Sun Jul 19 09:36:53 2020 Could not determine IPv4/IPv6 protocol
Sun Jul 19 09:36:53 2020 SIGUSR1[soft,init_instance] received, process restarting
Sun Jul 19 09:36:53 2020 Restart pause, 5 second(s)
Sun Jul 19 09:36:58 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]MY_PUBLIC_IP:1194
Sun Jul 19 09:36:58 2020 Socket Buffers: R=[212992->212992] S=[212992->212992]
Sun Jul 19 09:36:58 2020 UDP link local: (not bound)
Sun Jul 19 09:36:58 2020 UDP link remote: [AF_INET]MY_PUBLIC_IP:1194
但是如果我从 Office 网络尝试，它会成功连接
Sun Jul 19 10:05:27 2020 OpenVPN 2.4.9 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 24 2020
Sun Jul 19 10:05:27 2020 library versions: OpenSSL 1.1.1c FIPS 28 May 2019, LZO 2.08
Sun Jul 19 10:05:27 2020 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Sun Jul 19 10:05:27 2020 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Sun Jul 19 10:05:27 2020 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Sun Jul 19 10:05:27 2020 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Sun Jul 19 10:05:27 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]192.168.0.3:1194
Sun Jul 19 10:05:27 2020 Socket Buffers: R=[212992->212992] S=[212992->212992]
Sun Jul 19 10:05:27 2020 UDP link local: (not bound)
Sun Jul 19 10:05:27 2020 UDP link remote: [AF_INET]192.168.0.3:1194
Sun Jul 19 10:05:27 2020 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Sun Jul 19 10:05:27 2020 TLS: Initial packet from [AF_INET]192.168.0.3:1194, sid=5890c8ed 6c43a44a
Sun Jul 19 10:05:27 2020 VERIFY OK: depth=1, CN=plusplus.net
Sun Jul 19 10:05:27 2020 VERIFY KU OK
Sun Jul 19 10:05:27 2020 Validating certificate extended key usage
Sun Jul 19 10:05:27 2020 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sun Jul 19 10:05:27 2020 VERIFY EKU OK
Sun Jul 19 10:05:27 2020 VERIFY OK: depth=0, CN=vpn.plusplus.net
Sun Jul 19 10:05:27 2020 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
Sun Jul 19 10:05:27 2020 [vpn.plusplus.net] Peer Connection Initiated with [AF_INET]192.168.0.3:1194
Sun Jul 19 10:05:28 2020 SENT CONTROL [vpn.plusplus.net]: 'PUSH_REQUEST' (status=1)
Sun Jul 19 10:05:28 2020 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5,peer-id 0,cipher AES-256-GCM'
Sun Jul 19 10:05:28 2020 OPTIONS IMPORT: timers and/or timeouts modified
Sun Jul 19 10:05:28 2020 OPTIONS IMPORT: --ifconfig/up options modified
Sun Jul 19 10:05:28 2020 OPTIONS IMPORT: route options modified
Sun Jul 19 10:05:28 2020 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Jul 19 10:05:28 2020 OPTIONS IMPORT: peer-id set
Sun Jul 19 10:05:28 2020 OPTIONS IMPORT: adjusting link_mtu to 1624
Sun Jul 19 10:05:28 2020 OPTIONS IMPORT: data channel crypto options modified
Sun Jul 19 10:05:28 2020 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sun Jul 19 10:05:28 2020 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sun Jul 19 10:05:28 2020 ROUTE_GATEWAY 192.168.0.111/255.255.255.0 IFACE=wlp1s0 HWADDR=a8:a7:95:67:0f:23
Sun Jul 19 10:05:28 2020 TUN/TAP device tun0 opened
Sun Jul 19 10:05:28 2020 TUN/TAP TX queue length set to 100
Sun Jul 19 10:05:28 2020 /sbin/ip link set dev tun0 up mtu 1500
Sun Jul 19 10:05:28 2020 /sbin/ip addr add dev tun0 local 10.8.0.6 peer 10.8.0.5
Sun Jul 19 10:05:28 2020 /sbin/ip route add 10.8.0.1/32 via 10.8.0.5
Sun Jul 19 10:05:28 2020 GID set to nobody
Sun Jul 19 10:05:28 2020 UID set to nobody
Sun Jul 19 10:05:28 2020 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sun Jul 19 10:05:28 2020 Initialization Sequence Completed
尝试检查 UDP 1194
nc -v -u MY_PUBLIC_IP 1194
Ncat: Version 7.70 ( https://nmap.org/ncat )
Ncat: Connected to MY_PUBLIC_IP:1194.
路由器页面2
