yegorovpavel
Junior Member | Редактировать | Профиль | Сообщение | Цитировать | Сообщить модератору
Добрый день.
Я упорно пытаюсь заставить эту связку работать уже третий день. Казалось бы, что тут может не работать? Но тем не менее, оно не работает. Итак, на Ubuntu сервер стоит сервер openvpn c конфигом
Код: port 1194
proto tcp-server
dev tun
.
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 192.168.10.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
auth none
cipher none
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn/status_server.log
log log.log
verb 5
|
Есть клиентская windows 7, с конфигом
Код: client
dev tun
proto tcp-client
remote XXXXX.ru 1194
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
auth none
cipher none
#comp-lzo
verb 5
log openvpn_client.log
status status_client.log
route 188.40.74.10
route 188.40.74.9 |
Сертификаты самоподписанные, валидацию и на сервере и на клиенте проходят, все в порядке.
Итак, соединяемся без проблем. Однако, стоит прокачать по туннелю хоть один пакетик, соединение рвется. На клиенте в логе:
Код: Tue Feb 05 11:02:48 2013 us=890454 OpenVPN 2.3.0 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Jan 8 2013
Enter Management Password:
Tue Feb 05 11:02:48 2013 us=918457 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Feb 05 11:02:48 2013 us=918457 Need hold release from management interface, waiting...
Tue Feb 05 11:02:49 2013 us=386504 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Feb 05 11:02:49 2013 us=488514 MANAGEMENT: CMD 'state on'
Tue Feb 05 11:02:49 2013 us=488514 MANAGEMENT: CMD 'log all on'
Tue Feb 05 11:02:49 2013 us=512516 MANAGEMENT: CMD 'hold off'
Tue Feb 05 11:02:49 2013 us=514517 MANAGEMENT: CMD 'hold release'
Tue Feb 05 11:02:49 2013 us=514517 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Tue Feb 05 11:02:49 2013 us=514517 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Feb 05 11:02:49 2013 us=726538 ******* WARNING *******: null cipher specified, no encryption will be used
Tue Feb 05 11:02:49 2013 us=726538 ******* WARNING *******: null MAC specified, no authentication will be used
Tue Feb 05 11:02:49 2013 us=726538 Control Channel MTU parms [ L:1507 D:140 EF:40 EB:0 ET:0 EL:0 ]
Tue Feb 05 11:02:49 2013 us=727538 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Feb 05 11:02:49 2013 us=727538 MANAGEMENT: >STATE:1360047769,RESOLVE,,,
Tue Feb 05 11:02:49 2013 us=730538 Data Channel MTU parms [ L:1507 D:1450 EF:7 EB:4 ET:0 EL:0 AF:14/7 ]
Tue Feb 05 11:02:49 2013 us=730538 Local Options String: 'V4,dev-type tun,link-mtu 1507,tun-mtu 1500,proto TCPv4_CLIENT,cipher [null-cipher],auth [null-digest],keysize 0,key-method 2,tls-client'
Tue Feb 05 11:02:49 2013 us=730538 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1507,tun-mtu 1500,proto TCPv4_SERVER,cipher [null-cipher],auth [null-digest],keysize 0,key-method 2,tls-server'
Tue Feb 05 11:02:49 2013 us=730538 Local Options hash (VER=V4): 'a12b2009'
Tue Feb 05 11:02:49 2013 us=731538 Expected Remote Options hash (VER=V4): 'c3302ad0'
Tue Feb 05 11:02:49 2013 us=731538 Attempting to establish TCP connection with [AF_INET]XXX.XXX.202.98:1194
Tue Feb 05 11:02:49 2013 us=731538 MANAGEMENT: >STATE:1360047769,TCP_CONNECT,,,
Tue Feb 05 11:02:49 2013 us=732538 TCP connection established with [AF_INET]XXX.XXX.202.98:1194
Tue Feb 05 11:02:49 2013 us=732538 TCPv4_CLIENT link local: [undef]
Tue Feb 05 11:02:49 2013 us=732538 TCPv4_CLIENT link remote: [AF_INET]XXX.XXX.202.98:1194
Tue Feb 05 11:02:49 2013 us=732538 MANAGEMENT: >STATE:1360047769,WAIT,,,
Tue Feb 05 11:02:49 2013 us=733539 MANAGEMENT: >STATE:1360047769,AUTH,,,
Tue Feb 05 11:02:49 2013 us=733539 TLS: Initial packet from [AF_INET]XXX.XXX.202.98:1194, sid=f1b53e8e d09942b2
Tue Feb 05 11:02:49 2013 us=982563 VERIFY OK: depth=1, C=RU, ST=TL, L=Novomoskovsk, O=PEgorov, OU=Unit, CN=pegorov, name=pegorov, emailAddress=yegorov.p@gmail.com
Tue Feb 05 11:02:49 2013 us=983564 VERIFY OK: depth=0, C=RU, ST=TL, L=Novomoskovsk, O=PEgorov, OU=Unit, CN=XXXXX.ru, name=XXXXX.ru, emailAddress=yegorov.p@gmail.com
Tue Feb 05 11:02:50 2013 us=503616 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Feb 05 11:02:50 2013 us=503616 [XXXXX.ru] Peer Connection Initiated with [AF_INET]XXX.XXX.202.98:1194
Tue Feb 05 11:02:51 2013 us=531718 MANAGEMENT: >STATE:1360047771,GET_CONFIG,,,
Tue Feb 05 11:02:52 2013 us=559821 SENT CONTROL [XXXXX.ru]: 'PUSH_REQUEST' (status=1)
Tue Feb 05 11:02:52 2013 us=759841 PUSH: Received control message: 'PUSH_REPLY,route 192.168.10.1,topology net30,ping 10,ping-restart 120,ifconfig 192.168.10.6 192.168.10.5'
Tue Feb 05 11:02:52 2013 us=760841 OPTIONS IMPORT: timers and/or timeouts modified
Tue Feb 05 11:02:52 2013 us=760841 OPTIONS IMPORT: --ifconfig/up options modified
Tue Feb 05 11:02:52 2013 us=760841 OPTIONS IMPORT: route options modified
Tue Feb 05 11:02:52 2013 us=767842 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Feb 05 11:02:52 2013 us=767842 MANAGEMENT: >STATE:1360047772,ASSIGN_IP,,192.168.10.6,
Tue Feb 05 11:02:52 2013 us=767842 open_tun, tt->ipv6=0
Tue Feb 05 11:02:52 2013 us=769842 TAP-WIN32 device [OpenVPN] opened: \\.\Global\{1808BC88-FE68-4E2B-9B3A-904AFC29450A}.tap
Tue Feb 05 11:02:52 2013 us=769842 TAP-Windows Driver Version 9.9
Tue Feb 05 11:02:52 2013 us=769842 TAP-Windows MTU=1500
Tue Feb 05 11:02:52 2013 us=772842 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.10.6/255.255.255.252 on interface {1808BC88-FE68-4E2B-9B3A-904AFC29450A} [DHCP-serv: 192.168.10.5, lease-time: 31536000]
Tue Feb 05 11:02:52 2013 us=773843 Successful ARP Flush on interface [17] {1808BC88-FE68-4E2B-9B3A-904AFC29450A}
Tue Feb 05 11:02:57 2013 us=815347 TEST ROUTES: 3/3 succeeded len=3 ret=1 a=0 u/d=up
Tue Feb 05 11:02:57 2013 us=815347 MANAGEMENT: >STATE:1360047777,ADD_ROUTES,,,
Tue Feb 05 11:02:57 2013 us=815347 C:\Windows\system32\route.exe ADD 188.40.74.10 MASK 255.255.255.255 192.168.10.5
Tue Feb 05 11:02:57 2013 us=819347 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Feb 05 11:02:57 2013 us=819347 Route addition via IPAPI succeeded [adaptive]
Tue Feb 05 11:02:57 2013 us=819347 C:\Windows\system32\route.exe ADD 188.40.74.9 MASK 255.255.255.255 192.168.10.5
Tue Feb 05 11:02:57 2013 us=823347 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Feb 05 11:02:57 2013 us=824348 Route addition via IPAPI succeeded [adaptive]
Tue Feb 05 11:02:57 2013 us=824348 C:\Windows\system32\route.exe ADD 192.168.10.1 MASK 255.255.255.255 192.168.10.5
Tue Feb 05 11:02:57 2013 us=828348 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Feb 05 11:02:57 2013 us=828348 Route addition via IPAPI succeeded [adaptive]
Tue Feb 05 11:02:57 2013 us=828348 Initialization Sequence Completed
Tue Feb 05 11:02:57 2013 us=828348 MANAGEMENT: >STATE:1360047777,CONNECTED,SUCCESS,192.168.10.6,XXX.XXX.202.98
Tue Feb 05 11:03:00 2013 us=475613 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #41 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Tue Feb 05 11:03:00 2013 us=475613 Fatal decryption error (process_incoming_link), restarting
Tue Feb 05 11:03:00 2013 us=475613 TCP/UDP: Closing socket
Tue Feb 05 11:03:00 2013 us=475613 SIGUSR1[soft,decryption-error] received, process restarting
Tue Feb 05 11:03:00 2013 us=475613 MANAGEMENT: >STATE:1360047780,RECONNECTING,decryption-error,,
Tue Feb 05 11:03:00 2013 us=476613 Restart pause, 5 second(s)
Tue Feb 05 11:03:04 2013 us=480013 MANAGEMENT: Client disconnected
Tue Feb 05 11:03:04 2013 us=480013 Assertion failed at buffer.c:331
Tue Feb 05 11:03:04 2013 us=480013 Exiting due to fatal error
WRWWWWRRRRRRWWRWRWRRWWRWRWRRWWRWRWRRWWRWRWRRWWRWRWRRWWRWRWRWWWWRWRRRWWWRWRWRRWWRWRWRRWWRWRWRRWWRWRWRRWWRRRRRRRWWRWRWRRWWRWRWRRWWRWWWWRRRRRRWWWRRRWWrWRwrWrWRwRwRwrWRwRwRwRwrWrWrWRwrWrWRwrWrWRwrWrWRwRwRwrWRwRwRwRwRwrWRwrWRwRwrWrWrWRwrWRwRwrWRwRwRwrWRwRwrWRwRwrWRwRwRwrWRwrWRwRwrWRwRwrWRwrWR |
И теперь самое интересное. Берем этот же клиентский конфиг, эту же клиентскую машинку и перезагружаемся в макось (хакинтош), запускаем там туннельбрик - все ок, работает сутками, прокачивает гигабайты трафика. Берем клиентскую Ubuntu, скармливаем ей конфиг и сертификаты - все тоже прекрасно. Я думал, дело в винде. На 6 других компах под семеркой, разной конфигурации, в разных сетях, в общем, совсем разных - не работает. Ругается на долбаный Authenticate/Decrypt packet error: bad packet ID.
На сервере
Код: root@homeserver:/etc/apt/sources.list.d# openvpn --version
OpenVPN 2.2.2 i486-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] built on Dec 15 2011
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
$ ./configure --enable-pthread --enable-password-save --host=i486-linux-gnu --build=i486-linux-gnu --prefix=/usr --mandir=${prefix}/share/man --with-ifconfig-path=/sbin/ifconfig --with-route-path=/sbin/route build_alias=i486-linux-gnu host_alias=i486-linux-gnu CFLAGS=-g -O2 LDFLAGS=-Wl,-Bsymbolic-functions CPPFLAGS= --no-create --no-recursion
Compile time defines: ENABLE_CLIENT_SERVER ENABLE_DEBUG ENABLE_EUREPHIA ENABLE_FRAGMENT ENABLE_HTTP_PROXY ENABLE_MANAGEMENT ENABLE_MULTIHOME ENABLE_PASSWORD_SAVE ENABLE_PORT_SHARE ENABLE_SOCKS USE_CRYPTO USE_LIBDL USE_LZO USE_PKCS11 USE_SSL
|
На клиенте
Код:| OpenVPN 2.3.0 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Jan 8 2013 |
Кто что посоветует? |
