我有一个 dlink dir-645 路由器，它连接到 cisco 调制解调器。我的笔记本电脑（Ubuntu 15.10）通过 wifi 连接到此路由器。
我在 openvpn 连接方面遇到了问题。当笔记本电脑直接连接到调制解调器时，连接工作正常。当笔记本电脑位于路由器后面时，连接 openvpn 几秒钟后，互联网停止工作（无法 ping ip 或 dns 名称）。我以为是路由器配置问题，但在为 Windows 安装 openvpn 客户端后，我能够使用与 Ubuntu 上相同的 openvpn 配置文件建立连接。
我错过了什么？
我的 openvpn 版本：2.3.7 x86_64 我正在尝试使用网络管理器插件以及使用 cmd 行进行连接。
连接日志：
Thu Mar 17 16:13:18 2016 OpenVPN 2.3.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jul 8 2015
Thu Mar 17 16:13:18 2016 library versions: OpenSSL 1.0.2d 9 Jul 2015, LZO 2.08
Thu Mar 17 16:13:18 2016 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Thu Mar 17 16:13:18 2016 Control Channel Authentication: using '/etc/openvpn/vpn/ta.key' as a OpenVPN static key file
Thu Mar 17 16:13:18 2016 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Thu Mar 17 16:13:18 2016 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Thu Mar 17 16:13:18 2016 Socket Buffers: R=[212992->131072] S=[212992->131072]
Thu Mar 17 16:13:19 2016 UDPv4 link local: [undef]
Thu Mar 17 16:13:19 2016 UDPv4 link remote: [AF_INET]x.x.x.x:1194 <- usunięte
Thu Mar 17 16:13:19 2016 TLS: Initial packet from [AF_INET]x.x.x.x:1194, sid=18f6d2a7 029e6b8e
Thu Mar 17 16:13:20 2016 VERIFY OK: usunięte
Thu Mar 17 16:13:20 2016 VERIFY OK: nsCertType=SERVER
Thu Mar 17 16:13:20 2016 VERIFY OK: usunięte
Thu Mar 17 16:13:25 2016 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Mar 17 16:13:25 2016 Data Channel Encrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Thu Mar 17 16:13:25 2016 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Mar 17 16:13:25 2016 Data Channel Decrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Thu Mar 17 16:13:25 2016 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
Thu Mar 17 16:13:25 2016 [usunięte] Peer Connection Initiated with [AF_INET]x.x.x.x:1194
Thu Mar 17 16:13:27 2016 SENT CONTROL [usunięte]: 'PUSH_REQUEST' (status=1)
Thu Mar 17 16:13:32 2016 SENT CONTROL [usunięte]: 'PUSH_REQUEST' (status=1)
Thu Mar 17 16:13:34 2016 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route 192.168.6.0 255.255.255.0,route 192.168.200.0 255.255.255.0,route 10.0.0.0 255.255.0.0,dhcp-option DNS 192.168.1.1,dhcp-option DOMAIN usunięte,route 10.0.254.1,topology net30,ping 10,ping-restart 60,ifconfig 10.0.254.22 10.0.254.21'
Thu Mar 17 16:13:34 2016 OPTIONS IMPORT: timers and/or timeouts modified
Thu Mar 17 16:13:34 2016 OPTIONS IMPORT: --ifconfig/up options modified
Thu Mar 17 16:13:34 2016 OPTIONS IMPORT: route options modified
Thu Mar 17 16:13:34 2016 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Mar 17 16:13:34 2016 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 IFACE=wlan0 HWADDR=a4:34:d9:51:f0:a9
Thu Mar 17 16:13:34 2016 TUN/TAP device tun0 opened
Thu Mar 17 16:13:34 2016 TUN/TAP TX queue length set to 100
Thu Mar 17 16:13:34 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Mar 17 16:13:34 2016 /sbin/ip link set dev tun0 up mtu 1500
Thu Mar 17 16:13:34 2016 /sbin/ip addr add dev tun0 local 10.0.254.22 peer 10.0.254.21
Thu Mar 17 16:13:34 2016 /etc/openvpn/update-resolv-conf tun0 1500 1569 10.0.254.22 10.0.254.21 init
dhcp-option DNS 192.168.1.1
dhcp-option DOMAIN usunięte
Thu Mar 17 16:13:37 2016 /sbin/ip route add 192.168.1.0/24 via 10.0.254.21
Thu Mar 17 16:13:37 2016 /sbin/ip route add 192.168.6.0/24 via 10.0.254.21
Thu Mar 17 16:13:37 2016 /sbin/ip route add 192.168.200.0/24 via 10.0.254.21
Thu Mar 17 16:13:37 2016 /sbin/ip route add 10.0.0.0/16 via 10.0.254.21
Thu Mar 17 16:13:37 2016 /sbin/ip route add 10.0.254.1/32 via 10.0.254.21
Thu Mar 17 16:13:37 2016 Initialization Sequence Completed
Thu Mar 17 16:15:00 2016 [usunięte] Inactivity timeout (--ping-restart), restarting
Thu Mar 17 16:15:00 2016 SIGUSR1[soft,ping-restart] received, process restarting
Thu Mar 17 16:15:00 2016 Restart pause, 2 second(s)
Thu Mar 17 16:15:02 2016 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Thu Mar 17 16:15:02 2016 Socket Buffers: R=[212992->131072] S=[212992->131072]
Thu Mar 17 16:16:23 2016 RESOLVE: Cannot resolve host address: home.absilion.com: Temporary failure in name resolution
Thu Mar 17 16:17:38 2016 RESOLVE: signal received during DNS resolution attempt
Thu Mar 17 16:17:38 2016 /sbin/ip route del 10.0.254.1/32
Thu Mar 17 16:17:38 2016 /sbin/ip route del 10.0.0.0/16
Thu Mar 17 16:17:38 2016 /sbin/ip route del 192.168.200.0/24
Thu Mar 17 16:17:38 2016 /sbin/ip route del 192.168.6.0/24
Thu Mar 17 16:17:38 2016 /sbin/ip route del 192.168.1.0/24
Thu Mar 17 16:17:38 2016 Closing TUN/TAP interface
Thu Mar 17 16:17:38 2016 /sbin/ip addr del dev tun0 local 10.0.254.22 peer 10.0.254.21
Thu Mar 17 16:17:38 2016 /etc/openvpn/update-resolv-conf tun0 1500 1569 10.0.254.22 10.0.254.21 init
Thu Mar 17 16:17:38 2016 SIGTERM[hard,init_instance] received, process exiting
Openvpn 配置文件：
# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client
# enable openvpn running scripts (enable to update resolv.conf)
script-security 2
# fix DNS via VPN connection
;up /etc/openvpn/update-resolv-conf
;down /etc/openvpn/update-resolv-conf
# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun
# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote HOST 1194
# Keep trying indefinitely to resolve the
# host name of the OpenVPN server. Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite
# Most clients don't need to bind to
# a specific local port number.
nobind
# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nobody
# For MS Windows
route-method exe
route-delay 2
# Try to preserve some state across restarts.
persist-key
persist-tun
# Wireless networks often produce a lot
# of duplicate packets. Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings
# SSL/TLS parms.
# See the server config file for more
# description. It's best to use
# a separate .crt/.key file pair
# for each client. A single ca
# file can be used for all clients.
ca cacert.pem
cert clientcert.pem
key clientkey.pem
# avoid sha1
auth sha256
# TLS-Auth, makes portscanning and DOS-attacks harder for the bad guys.
tls-auth ta.key 1
# Decent default
cipher AES-256-CBC
# Only connect to nodes with a certificate tagged as server.
ns-cert-type server
# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
;comp-lzo
# Set log file verbosity.
verb 3
# Silence repeating messages
mute 20
答案1
此日志行中明显存在此问题：
2016 年 3 月 17 日星期四 16:13:37 /sbin/ip route 通过 10.0.254.21 添加 192.168.1.0/24
Openvpn 导致您的本地 LAN 的流量通过隧道接口路由。以下日志行显示 10.0.254.21 是您的隧道连接的远端：
2016 年 3 月 17 日星期四 16:13:34 /sbin/ip addr add dev tun0 本地 10.0.254.22 对等 10.0.254.21
推测可能是您的 openvpn 服务器配置中的“push route”命令导致设置 192.168.1.0/24 的路由。请参阅手册页的此部分：
--client 辅助指令，用于简化 OpenVPN 客户端模式的配置。此指令相当于：
pull tls-client--pull 此选项必须在连接到多客户端服务器的客户端上使用。它指示 OpenVPN 应该接受服务器推送的选项，前提是这些选项是合法的可推送选项集的一部分（请注意 --pull 选项是 --client 隐含的）。
In particular, --pull allows the server to push routes to the client, so you should not use --pull or --client in situations where you don't trust the server to have control over the client's routing ta‐ ble.
如果可行，最简单的解决方案是更改 LAN 的 IP 地址空间，即，将路由器上的 DHCP 服务器配置为 192.168.2.0/255。也许这就是在添加路由器设备之前调制解调器所做的？如果您希望通过 VPN 隧道连接 192.168.1.0/24 地址范围内的远程 LAN，则此解决方案是最佳解决方案。
如果您不需要访问远程 192.168.1.0/24 网络，并且不想重新编号 LAN，则还有其他选择。如果您可以基于每个客户端控制 openvpn 服务器配置，则可以删除 192.168.1.0/24 的“推送路由”命令。请参阅Openvpn 社区 HOWTO，在提到“ccd”目录的部分中。
另一种可能性是覆盖本地 openvpn 配置文件中的服务器。作为起点，您可以将“route-nopull”添加到配置文件中并手动配置路由。即让 openvpn 连接，然后输入：
/sbin/ip route add 192.168.6.0/24 via 10.0.254.21
/sbin/ip route add 192.168.200.0/24 via 10.0.254.21
/sbin/ip route add 10.0.0.0/16 via 10.0.254.21
/sbin/ip route add 10.0.254.1/32 via 10.0.254.21