如何在同一主机上从 OpenVPN 服务器路由到 OpenVPN 客户端？

Question

解决方案涉及在客户端配置目录文件中使用 nftables 和 openvpn iroute 命令进行网络地址转换和伪装。以下是更改：

HostB $ nft list ruleset
    table inet filter {
        set cluster-ips {
            type ipv4_addr
            elements = { 10.140.17.141 }
        }

        set tunnel-nets {
            type ipv4_addr
            elements = { 10.120.177.168 }
        }

        set ports-allowed {
            type inet_service
            elements = { 443, /* other ports needed by applications */ }
        }

        chain INPUT {
            type filter hook input priority filter; policy accept;
            ip saddr @tunnel-nets tcp dport @ports-allowed ip daddr @cluster-ips accept
            ip saddr @tunnel-nets udp dport @ports-allowed ip daddr @cluster-ips accept
        }

        chain OUTPUT {
            type filter hook output priority filter; policy accept;
            ip saddr @cluster-ips ip daddr @tunnel-nets accept
        }

        chain FORWARD {
            type filter hook forward priority filter; policy accept;
            iifname "tun0" oifname "tun010*" ct state established,related counter
            iifname "tun010*" oifname "tun0" ct state established,related counter 
        }
    }
    table ip nat {
        set downstream_ports_allowed {
            type inet_service
            elements = { 443, /* other ports needed by applications */ }
        }

        set upstream_ports_allowed {
            type inet_service
            elements = { 22, /* other ports needed by applications */ }
        }

        chain prerouting {
            type nat hook prerouting priority dstnat; policy accept;
            ip daddr 10.140.17.141 iifname "tun0" tcp dport @downstream_ports_allowed counter dnat to 10.141.67.5
            ip daddr 10.120.177.168 iifname "tun010*" tcp dport @upstream_ports_allowed counter dnat to 10.120.177.168
        }

        chain postrouting {
            type nat hook postrouting priority srcnat; policy accept;
            oifname "tun0" masquerade
            oifname "tun010*" masquerade
        }
    }
HostB $ cat /etc/openvpn/server/server.conf
    client-config-dir ccd
    topology subnet
    push "route 10.140.17.141 255.255.255.255"
    route 10.120.177.168 255.255.255.255
HostB $ cat /etc/openvpn/server/ccd/gateway_10_120_177_168
    iroute 10.120.177.168 255.255.255.255
HostC $ cat /etc/openvpn/server.conf
    client-config-dir ccd
    topology subnet
    route 10.120.177.168
HostC $ cat /etc/openvpn/ccd/tun010140017141
    iroute 10.120.177.168

Answer 1

解决方案涉及在客户端配置目录文件中使用 nftables 和 openvpn iroute 命令进行网络地址转换和伪装。以下是更改：

HostB $ nft list ruleset
    table inet filter {
        set cluster-ips {
            type ipv4_addr
            elements = { 10.140.17.141 }
        }

        set tunnel-nets {
            type ipv4_addr
            elements = { 10.120.177.168 }
        }

        set ports-allowed {
            type inet_service
            elements = { 443, /* other ports needed by applications */ }
        }

        chain INPUT {
            type filter hook input priority filter; policy accept;
            ip saddr @tunnel-nets tcp dport @ports-allowed ip daddr @cluster-ips accept
            ip saddr @tunnel-nets udp dport @ports-allowed ip daddr @cluster-ips accept
        }

        chain OUTPUT {
            type filter hook output priority filter; policy accept;
            ip saddr @cluster-ips ip daddr @tunnel-nets accept
        }

        chain FORWARD {
            type filter hook forward priority filter; policy accept;
            iifname "tun0" oifname "tun010*" ct state established,related counter
            iifname "tun010*" oifname "tun0" ct state established,related counter 
        }
    }
    table ip nat {
        set downstream_ports_allowed {
            type inet_service
            elements = { 443, /* other ports needed by applications */ }
        }

        set upstream_ports_allowed {
            type inet_service
            elements = { 22, /* other ports needed by applications */ }
        }

        chain prerouting {
            type nat hook prerouting priority dstnat; policy accept;
            ip daddr 10.140.17.141 iifname "tun0" tcp dport @downstream_ports_allowed counter dnat to 10.141.67.5
            ip daddr 10.120.177.168 iifname "tun010*" tcp dport @upstream_ports_allowed counter dnat to 10.120.177.168
        }

        chain postrouting {
            type nat hook postrouting priority srcnat; policy accept;
            oifname "tun0" masquerade
            oifname "tun010*" masquerade
        }
    }
HostB $ cat /etc/openvpn/server/server.conf
    client-config-dir ccd
    topology subnet
    push "route 10.140.17.141 255.255.255.255"
    route 10.120.177.168 255.255.255.255
HostB $ cat /etc/openvpn/server/ccd/gateway_10_120_177_168
    iroute 10.120.177.168 255.255.255.255
HostC $ cat /etc/openvpn/server.conf
    client-config-dir ccd
    topology subnet
    route 10.120.177.168
HostC $ cat /etc/openvpn/ccd/tun010140017141
    iroute 10.120.177.168

如何在同一主机上从 OpenVPN 服务器路由到 OpenVPN 客户端？

答案1

相关内容