我有以下拓扑，其中 x 因站点而异：
[OpenVPN client] < - > [OpenVPN Access Server] < - > [pfSense router] < - > [IPSec connected sites]
172.27.244.21 10.128.20.5 10.128.20.1 10.130.x.1
我能够从 OpenVPN 客户端或直接从 OpenVPN 访问服务器 ping IPSec 站点中的设备。有一个站点 (10.130.7.1) 我无法从 OpenVPN 客户端 ping 通，但我可以从 OpenVPN 访问服务器直接 ping 通该站点。
OpenVPN（Windows）客户端的 Ping 结果：
Pinging 10.130.2.1 with 32 bytes of data:
Reply from 10.130.2.1: bytes=32 time=160ms TTL=62
Reply from 10.130.2.1: bytes=32 time=142ms TTL=62
Reply from 10.130.2.1: bytes=32 time=126ms TTL=62
Reply from 10.130.2.1: bytes=32 time=103ms TTL=62
Pinging 10.130.17.1 with 32 bytes of data:
Reply from 10.130.17.1: bytes=32 time=46ms TTL=62
Reply from 10.130.17.1: bytes=32 time=51ms TTL=62
Reply from 10.130.17.1: bytes=32 time=55ms TTL=62
Reply from 10.130.17.1: bytes=32 time=29ms TTL=62
Pinging 10.130.7.1 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
OpenVPN 访问服务器 (SSH) 的 Ping 结果
PING 10.130.2.1 (10.130.2.1) 56(84) bytes of data.
64 bytes from 10.130.2.1: icmp_seq=1 ttl=63 time=136 ms
64 bytes from 10.130.2.1: icmp_seq=2 ttl=63 time=111 ms
64 bytes from 10.130.2.1: icmp_seq=3 ttl=63 time=122 ms
64 bytes from 10.130.2.1: icmp_seq=4 ttl=63 time=166 ms
PING 10.130.17.1 (10.130.17.1) 56(84) bytes of data.
64 bytes from 10.130.17.1: icmp_seq=1 ttl=63 time=29.1 ms
64 bytes from 10.130.17.1: icmp_seq=2 ttl=63 time=29.1 ms
64 bytes from 10.130.17.1: icmp_seq=3 ttl=63 time=29.5 ms
64 bytes from 10.130.17.1: icmp_seq=4 ttl=63 time=29.5 ms
PING 10.130.7.1 (10.130.7.1) 56(84) bytes of data.
64 bytes from 10.130.7.1: icmp_seq=1 ttl=63 time=29.5 ms
64 bytes from 10.130.7.1: icmp_seq=2 ttl=63 time=28.8 ms
64 bytes from 10.130.7.1: icmp_seq=3 ttl=63 time=28.5 ms
64 bytes from 10.130.7.1: icmp_seq=4 ttl=63 time=28.5 ms
在我看来，请求的路由似乎出了问题10.130.7.1。为了调试这个问题，我从我的 OpenVPN 客户端进行了跟踪路由：
Tracing route to 10.130.2.1 over a maximum of 30 hops
1 1 ms 1 ms 1 ms 172.27.232.1
2 2 ms 2 ms 1 ms 10.128.20.1
3 115 ms 115 ms 116 ms 10.130.2.1
Tracing route to 10.130.17.1 over a maximum of 30 hops
1 1 ms 1 ms 2 ms 172.27.232.1
2 1 ms 1 ms 1 ms 10.128.20.1
3 76 ms 38 ms 42 ms 10.130.17.1
Tracing route to 10.130.7.1 over a maximum of 30 hops
1 1 ms 2 ms 2 ms 172.27.232.1
2 * * * Request timed out.
3 * * * Request timed out.
由于请求似乎发送到 OpenVPN 访问服务器 (172.27.253.1)，因此我tcpdump从 Windows 客户端 ping 时在那里执行了以下操作：
10:27:53.900720 In ethertype IPv4 (0x0800), length 76: 172.27.244.21 > 10.130.2.1: ICMP echo request, id 1, seq 1036, length 40
10:27:53.900756 Out 6a:fd:3e:82:c5:b8 ethertype IPv4 (0x0800), length 76: 10.128.20.5 > 10.130.2.1: ICMP echo request, id 1, seq 1036, length 40
10:27:54.001502 In 00:25:90:bd:8a:4a ethertype IPv4 (0x0800), length 76: 10.130.2.1 > 10.128.20.5: ICMP echo reply, id 1, seq 1036, length 40
10:27:54.001531 Out ethertype IPv4 (0x0800), length 76: 10.130.2.1 > 172.27.244.21: ICMP echo reply, id 1, seq 1036, length 40
10:27:57.048858 In ethertype IPv4 (0x0800), length 76: 172.27.244.21 > 10.130.17.1: ICMP echo request, id 1, seq 1037, length 40
10:27:57.048909 Out 6a:fd:3e:82:c5:b8 ethertype IPv4 (0x0800), length 76: 10.128.20.5 > 10.130.17.1: ICMP echo request, id 1, seq 1037, length 40
10:27:57.077173 In 00:25:90:bd:8a:4a ethertype IPv4 (0x0800), length 76: 10.130.17.1 > 10.128.20.5: ICMP echo reply, id 1, seq 1037, length 40
10:27:57.077204 Out ethertype IPv4 (0x0800), length 76: 10.130.17.1 > 172.27.244.21: ICMP echo reply, id 1, seq 1037, length 40
10:27:59.502909 In ethertype IPv4 (0x0800), length 76: 172.27.244.21 > 10.130.7.1: ICMP echo request, id 1, seq 1038, length 40
10:27:59.502966 Out 6a:fd:3e:82:c5:b8 ethertype IPv4 (0x0800), length 76: 172.27.244.21 > 10.130.7.1: ICMP echo request, id 1, seq 1038, length 40
哈！请求通过（发出 ping 请求的 OpenVPN 客户端地址）10.130.7.1从服务器“发出” 。172.27.244.21为什么会发生这种情况？为什么它不像对和 的10.128.20.5请求那样通过 (OpenVPN 访问服务器 IP)发出？10.130.2.110.130.17.1
我不知道是否需要，但可以确定的是访问服务器的路由表
root@axx-ovpn-as01:/home/axxmin# routel
target gateway source proto scope dev tbl
default 10.128.20.1 static ens18
10.128.20.0/ 24 10.128.20.5 kernel link ens18
172.27.224.0/ 21 172.27.224.1 kernel link as0t0
172.27.232.0/ 21 172.27.232.1 kernel link as0t1
172.27.244.21 static as0t1
10.128.20.0 broadcast 10.128.20.5 kernel link ens18 local
10.128.20.5 local 10.128.20.5 kernel host ens18 local
10.128.20.255 broadcast 10.128.20.5 kernel link ens18 local
127.0.0.0 broadcast 127.0.0.1 kernel link lo local
127.0.0.0/ 8 local 127.0.0.1 kernel host lo local
127.0.0.1 local 127.0.0.1 kernel host lo local
127.255.255.255 broadcast 127.0.0.1 kernel link lo local
172.27.224.0 broadcast 172.27.224.1 kernel link as0t0 local
172.27.224.1 local 172.27.224.1 kernel host as0t0 local
172.27.231.255 broadcast 172.27.224.1 kernel link as0t0 local
172.27.232.0 broadcast 172.27.232.1 kernel link as0t1 local
172.27.232.1 local 172.27.232.1 kernel host as0t1 local
172.27.239.255 broadcast 172.27.232.1 kernel link as0t1 local
::1 local kernel lo
fe80::/ 64 kernel ens18
fe80::/ 64 kernel as0t0
fe80::/ 64 kernel as0t1
::1 local kernel lo local
fe80::1cea:a857:88ab:b687 local kernel as0t1 local
fe80::68fd:3eff:fe82:c5b8 local kernel ens18 local
fe80::a3cb:f651:4066:8cb local kernel as0t0 local
ff00::/ 8 ens18 local
ff00::/ 8 as0t0 local
ff00::/ 8 as0t1 local
答案1
问题是我10.130.7.0/24在错误的字段中为 OpenVPN Access Server 用户组配置了网络。我在字段中配置了它，Subnets assigned to this group (optional):而不是Allow Access To networks and service像对其他网络那样在字段中配置。我没有直接注意到这一点，因为不同的网络配置在不同的组中。Allow Access To networks and service也只有在Access controll启用时才可用。