我正在尝试按照以下指南绑定两个互联网上行链路以提高 VPN 速度： 如何绑定两个（多个）互联网连接以提高速度和故障转移
但我遇到了一些问题：
我已经研究了好几天但毫无成果。
首先，我的网络拓扑：https://i.stack.imgur.com/tgbNS.png
在我的场景中，请看一下我的配置：
客户端：
vim /etc/网络/接口
auto ens160
iface ens160 inet static
address 192.168.50.254
netmask 255.255.255.0
gateway 192.168.50.1
post-up /usr/local/bin/vpn-start
pre-down /usr/local/bin/vpn-stop
我的路由在 vpn-start 中设置正确吗？
# vim /usr/local/bin/vpn-start
#!/bin/bash
openvpn --config /etc/openvpn/tap0.conf
openvpn --config /etc/openvpn/tap1.conf
ip link add bond0 type bond
ip addr add 10.80.0.2/30 dev bond0
ip link set tap0 master bond0
ip link set tap1 master bond0
ip link set bond0 up mtu 1440
ip route add 192.168.50.0/24 via 10.80.0.1 <--Is this right?
防火墙配置怎么样？
version 6
lan="ens160"
vpn="bond+"
interface "${lan}" lan
policy accept
interface "${vpn}" vpn
policy accept
router vpn2lan inface "${vpn}" outface "${lan}"
policy accept
服务器端：
tap0.conf：
# disable encryption, traffic continues unencrypted anyways
auth none
cipher none
dev tap0
mode p2p
port 1194
local 192.168.0.250 <-- Local ip or public ip?
proto udp
log /var/log/tap0.log
verb 3
ping 2
ping-restart 10
persist-tun
compress lz4-v2
daemon
防火墙配置：
version 6
server_vpn_ports="udp/1194-1195"
client_vpn_ports="default"
snat4 to 192.168.0.250 outface ens33 dst not 192.168.0.250 <-- What does this mean? local ip or public ip?
interface ens33 web
protection strong
server ssh accept
server vpn accept
# more servers here as per your needs
client all accept
interface bond0 vpn
policy accept
router4 web2vpn inface ens33 outface bond0 dst 192.168.50.0/24,10.80.0.2 <--Is this right?
client all accept
在我完成所有设置后，链接似乎已经建立：
客户端：
root@ubcloud:~# cat /proc/net/bonding/bond0
Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
Bonding Mode: load balancing (round-robin)
MII Status: down
MII Polling Interval (ms): 0
Up Delay (ms): 0
Down Delay (ms): 0
客户端tap1.log：
Sat Aug 1 06:44:39 2020 ******* WARNING *******: All encryption and authentication features disabled -- All data will be tunnelled as clear text and will not be protected against man-in-the-middle changes. PLEASE DO RECONSIDER THIS CONFIGURATION!
Sat Aug 1 06:44:39 2020 Preserving previous TUN/TAP instance: tap1
Sat Aug 1 06:44:39 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]118.152.247.193:1195
Sat Aug 1 06:44:39 2020 Socket Buffers: R=[212992->212992] S=[212992->212992]
Sat Aug 1 06:44:39 2020 UDP link local (bound): [AF_INET]192.168.50.254:1195
Sat Aug 1 06:44:39 2020 UDP link remote: [AF_INET]118.152.247.193:1195
Sat Aug 1 06:44:39 2020 Peer Connection Initiated with [AF_INET]118.152.247.193:1195
Sat Aug 1 06:44:41 2020 Initialization Sequence Completed
从客户端 ping 隧道 IP：
root@ubcloud:~# ping 10.80.0.2
PING 10.80.0.2 (10.80.0.2) 56(84) bytes of data.
64 bytes from 10.80.0.2: icmp_seq=1 ttl=64 time=0.019 ms
64 bytes from 10.80.0.2: icmp_seq=2 ttl=64 time=0.025 ms
64 bytes from 10.80.0.2: icmp_seq=3 ttl=64 time=0.026 ms
^C
--- 10.80.0.2 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2050ms
rtt min/avg/max/mdev = 0.019/0.023/0.026/0.005 ms
root@ubcloud:~# ping 10.80.0.1
PING 10.80.0.1 (10.80.0.1) 56(84) bytes of data.
From 10.80.0.2 icmp_seq=1 Destination Host Unreachable
From 10.80.0.2 icmp_seq=2 Destination Host Unreachable
From 10.80.0.2 icmp_seq=3 Destination Host Unreachable
服务器端：
root@ubcloud:~# cat /proc/net/bonding/bond0
Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
Bonding Mode: load balancing (round-robin)
MII Status: up
MII Polling Interval (ms): 0
Up Delay (ms): 0
Down Delay (ms): 0
Slave Interface: tap0
MII Status: up
Speed: 10 Mbps
Duplex: full
Link Failure Count: 0
Permanent HW addr: a6:fa:e9:55:79:2c
Slave queue ID: 0
Slave Interface: tap1
MII Status: up
Speed: 10 Mbps
Duplex: full
Link Failure Count: 0
Permanent HW addr: ae:b9:4a:50:b0:dc
Slave queue ID: 0
服务器tap0.log：
root@ubcloud:~# cat /var/log/tap0.log
Sat Aug 1 06:43:27 2020 disabling NCP mode (--ncp-disable) because not in P2MP client or server mode
Sat Aug 1 06:43:27 2020 OpenVPN 2.4.9 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Oct 30 2019
Sat Aug 1 06:43:27 2020 library versions: OpenSSL 1.1.1 11 Sep 2018, LZO 2.08
Sat Aug 1 06:43:27 2020 ******* WARNING *******: All encryption and authentication features disabled -- All data will be tunnelled as clear text and will not be protected against man-in-the-middle changes. PLEASE DO RECONSIDER THIS CONFIGURATION!
Sat Aug 1 06:43:27 2020 TUN/TAP device tap0 opened
Sat Aug 1 06:43:27 2020 TUN/TAP TX queue length set to 100
Sat Aug 1 06:43:27 2020 Could not determine IPv4/IPv6 protocol. Using AF_INET
Sat Aug 1 06:43:27 2020 Socket Buffers: R=[212992->212992] S=[212992->212992]
Sat Aug 1 06:43:27 2020 UDPv4 link local (bound): [AF_INET]192.168.0.250:1194
Sat Aug 1 06:43:27 2020 UDPv4 link remote: [AF_UNSPEC]
Sat Aug 1 06:43:30 2020 Peer Connection Initiated with [AF_INET]172.227.224.139:1194
Sat Aug 1 06:43:30 2020 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sat Aug 1 06:43:30 2020 Initialization Sequence Completed
从服务器 ping 隧道 IP：
root@ubcloud:~# ping 10.80.0.1
PING 10.80.0.1 (10.80.0.1) 56(84) bytes of data.
64 bytes from 10.80.0.1: icmp_seq=1 ttl=64 time=0.048 ms
64 bytes from 10.80.0.1: icmp_seq=2 ttl=64 time=0.059 ms
^C
--- 10.80.0.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1030ms
rtt min/avg/max/mdev = 0.048/0.053/0.059/0.009 ms
root@ubcloud:~# ping 10.80.0.2
PING 10.80.0.2 (10.80.0.2) 56(84) bytes of data.
From 10.80.0.1 icmp_seq=1 Destination Host Unreachable
From 10.80.0.1 icmp_seq=2 Destination Host Unreachable
From 10.80.0.1 icmp_seq=3 Destination Host Unreachable
你知道我做错了什么吗？如何在客户端上设置路由，以便 LAN 中的所有流量都让 LAN 中的流量通过隧道从服务器出去？
再次感谢！
答案1
我认为您应该考虑升级 VPN 基础设施而不是绑定作为解决方法。
2 个绑定的 VPN 链路永远不会像单个链路中具有所需带宽的专用 VPN 连接那样好。
答案2
从类似问题在我们的姊妹网站网络工程上提问：
从理论上讲，“将”链路“绑定”在一起是个好主意，但在实践中效果并不好。如果您尝试将单个连接拆分为两个链路，您将得到无序数据包，尤其是在两个不同的网络上，这会大大降低您的吞吐量。您最好只使用一个链路。
远程用户的 VPN 软件不够复杂，无法建立两个 VPN 连接，然后做出路由决策以使用最佳路径。我不知道有任何这样的产品。您可能需要创建一些自定义的东西，但我怀疑这不值得付出努力。