Linux
在 vpn 連接上,我收到“Linux route add command failed”,但我沒有在 server.conf 上推送任何路由
我有一個 Ubuntu 16.04 伺服器。我配置了 2 個客戶端和伺服器。目標是將這兩個客戶端連接到伺服器並從一個連接到另一個。我可以在 Linux Mint 上連接,通過右鍵點擊 Internet 連接圖示並指定 .ovpn 文件來添加 vpn 連接。不幸的是,我無法使用 Raspberry Pi Stretch 連接同一伺服器和第二個類似的客戶端配置:
sudo openvpn --config client2.ovpn
我越來越
ERROR: Linux route add command failed: external program exited with error status: 2
完整回复:
Wed Nov 20 11:33:49 2019 OpenVPN 2.4.7 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 20 2019 Wed Nov 20 11:33:49 2019 library versions: OpenSSL 1.1.1c 28 May 2019, LZO 2.10 Wed Nov 20 11:33:49 2019 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts Wed Nov 20 11:33:50 2019 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication Wed Nov 20 11:33:50 2019 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication Wed Nov 20 11:33:50 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]51.75.127.237:1194 Wed Nov 20 11:33:50 2019 Socket Buffers: R=[163840->163840] S=[163840->163840] Wed Nov 20 11:33:50 2019 UDP link local: (not bound) Wed Nov 20 11:33:50 2019 UDP link remote: [AF_INET]xx.xx.xx.xx:1194 Wed Nov 20 11:33:50 2019 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay Wed Nov 20 11:33:50 2019 TLS: Initial packet from [AF_INET]xx.xx.xx.xx:1194, sid=bd06e3d1 f7c41b7e Wed Nov 20 11:33:50 2019 VERIFY OK: depth=1, C=PL, ST=PDK, L=X, O=K, OU=K, CN=K CA, name=server, emailAddress=some_email Wed Nov 20 11:33:50 2019 VERIFY KU OK Wed Nov 20 11:33:50 2019 Validating certificate extended key usage Wed Nov 20 11:33:50 2019 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication Wed Nov 20 11:33:50 2019 VERIFY EKU OK Wed Nov 20 11:33:50 2019 VERIFY OK: depth=1, C=PL, ST=PDK, L=X, O=K, OU=K, CN=K CA, name=server, emailAddress=some_email Wed Nov 20 11:33:50 2019 Control Channel: TLSv1.2, cipher TLSv1.2 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA Wed Nov 20 11:33:50 2019 [server] Peer Connection Initiated with [AF_INET]xx.xx.xx.xx:1194 Wed Nov 20 11:33:51 2019 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1) Wed Nov 20 11:33:51 2019 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9' Wed Nov 20 11:33:51 2019 OPTIONS IMPORT: timers and/or timeouts modified Wed Nov 20 11:33:51 2019 OPTIONS IMPORT: --ifconfig/up options modified Wed Nov 20 11:33:51 2019 OPTIONS IMPORT: route options modified Wed Nov 20 11:33:51 2019 Outgoing Data Channel: Cipher 'AES-128-CBC' initialized with 128 bit key Wed Nov 20 11:33:51 2019 Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication Wed Nov 20 11:33:51 2019 Incoming Data Channel: Cipher 'AES-128-CBC' initialized with 128 bit key Wed Nov 20 11:33:51 2019 Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication Wed Nov 20 11:33:51 2019 ROUTE_GATEWAY 192.168.8.1/255.255.255.0 IFACE=eth1 HWADDR=0c:5b:8f:27:9a:64 Wed Nov 20 11:33:51 2019 TUN/TAP device tun1 opened Wed Nov 20 11:33:51 2019 TUN/TAP TX queue length set to 100 Wed Nov 20 11:33:51 2019 /sbin/ip link set dev tun1 up mtu 1500 Wed Nov 20 11:33:51 2019 /sbin/ip addr add dev tun1 local 10.8.0.10 peer 10.8.0.9 Wed Nov 20 11:33:51 2019 /etc/openvpn/update-resolv-conf tun1 1500 1570 10.8.0.10 10.8.0.9 init Wed Nov 20 11:33:51 2019 /sbin/ip route add 10.8.0.0/24 via 10.8.0.9 RTNETLINK answers: File exists Wed Nov 20 11:33:51 2019 ERROR: Linux route add command failed: external program exited with error status: 2 Wed Nov 20 11:33:51 2019 GID set to nogroup Wed Nov 20 11:33:51 2019 UID set to nobody Wed Nov 20 11:33:51 2019 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this Wed Nov 20 11:33:51 2019 Initialization Sequence Completed
我的 server.conf:
port 1194 proto udp dev tun ca ca.crt cert server.crt key server.key # This file should be kept secret dh dh2048.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt client-to-client keepalive 10 120 tls-auth ta.key 0 # This file is secret key-direction 0 cipher AES-128-CBC # AES auth SHA256 comp-lzo user nobody group nogroup persist-key persist-tun status openvpn-status.log verb 3
我的客戶.ovpn:
client dev tun proto udp remote xx.xx.xx.xx 1194 resolv-retry infinite nobind user nobody group nogroup persist-key persist-tun remote-cert-tls server cipher AES-128-CBC auth SHA256 key-direction 1 comp-lzo verb3 script-security 2 up /etc/openvpn/update-resolv-conf down /etc/openvpn/update-resolv-conf <ca> ... </ca> <cert> ... </cert> <key> ... </key> <tls-auth> ... </tls-auth>
非常感謝您的任何想法。
您正在推送一條路由,即到您的 OpenVPN 網關(和/或子網)的路由:
/sbin/ip route add 10.8.0.0/24 via 10.8.0.9
正在呼叫,您的錯誤源於您已經擁有到該主機或子網的路由。檢查您在客戶端(例如)上的活動路線ip r
以確認。由於VORACLE,您也不應該將 LZO 壓縮與加密一起使用
通常,
RTNETLINK answers: File exists
當 OpenVPN 客戶端嘗試添加客戶端電腦上已存在的路由時,會發生錯誤。然後,OpenVPN 將生成一條錯誤消息:錯誤:Linux 路由添加命令失敗:外部程序以錯誤狀態退出:2
您可以檢查此客戶端電腦的網路設置以確保您沒有任何
10.8.0.0/24
網路路由嗎?