Vpn

不同主機中的多個 openvpn 客戶端

  • December 18, 2016

我正在嘗試同時執行多個 openvpn 實例，執行單個實例時一切正常，但我希望有幾個實例，每個實例連接到不同的主機，並從那裡能夠使用我的介面想。

我正在嘗試這樣：

法國.ovpn

client
dev tun
proto udp
remote france.privateinternetaccess.com
lport 1190
resolv-retry infinite
persist-key
persist-tun
cipher aes-128-cbc
auth sha1
tls-client
remote-cert-tls server
auth-user-pass /etc/openvpn/piaauth.txt
comp-lzo
verb 1
reneg-sec 0
crl-verify /etc/openvpn/crl.rsa.2048.pem
ca /etc/openvpn/ca.rsa.2048.crt
disable-occ
lport 1189
rport 1198

|

sudo /usr/sbin/openvpn --config /etc/openvpn/France.ovpn --dev tun0

Fri Dec 16 16:59:32 2016 OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Feb  2 2016
Fri Dec 16 16:59:32 2016 library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.08
Fri Dec 16 16:59:32 2016 WARNING: file '/etc/openvpn/piaauth.txt' is group or others accessible
Fri Dec 16 16:59:32 2016 UDPv4 link local (bound): [undef]
Fri Dec 16 16:59:32 2016 UDPv4 link remote: [AF_INET]108.61.122.121:1198
Fri Dec 16 16:59:32 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Dec 16 16:59:32 2016 [113b1963081eb5270c22e4405fb71051] Peer Connection Initiated with [AF_INET]108.61.122.121:1198
Fri Dec 16 16:59:34 2016 TUN/TAP device tun0 opened
Fri Dec 16 16:59:34 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Dec 16 16:59:34 2016 /sbin/ip link set dev tun0 up mtu 1500
Fri Dec 16 16:59:34 2016 /sbin/ip addr add dev tun0 local 10.43.10.6 peer 10.43.10.5
Fri Dec 16 16:59:34 2016 Initialization Sequence Completed

在此之後一切正常。但是當我執行下一個 ovpn 實例時，我得到了一些錯誤。

多倫多

client
dev tun
proto udp
remote ca-toronto.privateinternetaccess.com
resolv-retry infinite
persist-key
persist-tun
cipher aes-128-cbc
auth sha1
tls-client
remote-cert-tls server
auth-user-pass /etc/openvpn/piaauth.txt
comp-lzo
verb 1
reneg-sec 0
crl-verify /etc/openvpn/crl.rsa.2048.pem
ca /etc/openvpn/ca.rsa.2048.crt
disable-occ
lport 1192
rport 1198

|

sudo /usr/sbin/openvpn --config /etc/openvpn/Toronto.ovpn --dev tun1

Fri Dec 16 16:59:57 2016 OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Feb  2 2016
Fri Dec 16 16:59:57 2016 library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.08
Fri Dec 16 16:59:57 2016 WARNING: file '/etc/openvpn/piaauth.txt' is group or others accessible
Fri Dec 16 16:59:57 2016 UDPv4 link local (bound): [undef]
Fri Dec 16 16:59:57 2016 UDPv4 link remote: [AF_INET]172.98.67.16:1198
Fri Dec 16 16:59:57 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Dec 16 16:59:58 2016 [484ec5eff7d70137ae07ee3ec5e62b80] Peer Connection Initiated with [AF_INET]172.98.67.16:1198
Fri Dec 16 17:00:00 2016 TUN/TAP device tun1 opened
Fri Dec 16 17:00:00 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Dec 16 17:00:00 2016 /sbin/ip link set dev tun1 up mtu 1500
Fri Dec 16 17:00:00 2016 /sbin/ip addr add dev tun1 local 10.84.10.6 peer 10.84.10.5
RTNETLINK answers: File exists
Fri Dec 16 17:00:00 2016 ERROR: Linux route add command failed: external program exited with error status: 2
RTNETLINK answers: File exists
Fri Dec 16 17:00:00 2016 ERROR: Linux route add command failed: external program exited with error status: 2
Fri Dec 16 17:00:00 2016 Initialization Sequence Completed

這裡ip link和ip addr都失敗了。

這是我的路由表

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         10.43.10.5      128.0.0.0       UG    0      0        0 tun0
default         192.168.1.1     0.0.0.0         UG    0      0        0 enp3s0
10.43.10.1      10.43.10.5      255.255.255.255 UGH   0      0        0 tun0
10.43.10.5      *               255.255.255.255 UH    0      0        0 tun0
10.84.10.1      10.84.10.5      255.255.255.255 UGH   0      0        0 tun1
10.84.10.5      *               255.255.255.255 UH    0      0        0 tun1
108.61.122.121. 192.168.1.1     255.255.255.255 UGH   0      0        0 enp3s0
128.0.0.0       10.43.10.5      128.0.0.0       UG    0      0        0 tun0
link-local      *               255.255.0.0     U     1000   0        0 enp3s0
172.98.67.16    192.168.1.1     255.255.255.255 UGH   0      0        0 enp3s0
192.168.1.0     *               255.255.255.0   U     0      0        0 enp3s0

這是我的 ifconfig

enp3s0    Link encap:Ethernet  HWaddr 
         inet addr:192.168.1.128  Bcast:192.168.1.255  Mask:255.255.255.0
         inet6 addr: fe80::beae:c5ff:fe5a:7ec/64 Scope:Link
         UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
         RX packets:1146017 errors:0 dropped:0 overruns:0 frame:0
         TX packets:727717 errors:0 dropped:0 overruns:0 carrier:0
         collisions:0 txqueuelen:1000 
         RX bytes:1500194552 (1.5 GB)  TX bytes:117446235 (117.4 MB)
         Interrupt:40 

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
         inet addr:10.43.10.6  P-t-P:10.43.10.5  Mask:255.255.255.255
         UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
         RX packets:2143 errors:0 dropped:0 overruns:0 frame:0
         TX packets:1715 errors:0 dropped:0 overruns:0 carrier:0
         collisions:0 txqueuelen:100 
         RX bytes:2312566 (2.3 MB)  TX bytes:170653 (170.6 KB)

tun1      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
         inet addr:10.84.10.6  P-t-P:10.84.10.5  Mask:255.255.255.255
         UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
         RX packets:0 errors:0 dropped:0 overruns:0 frame:0
         TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
         collisions:0 txqueuelen:100 
         RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

我想我只需要配置一些路由，對嗎？

第一個 VPN 實例添加 2 條由伺服器推送的路由，使用push "redirect-gateway def1. 選項def10.0.0.0/1使用and覆蓋預設網關128.0.0.0/1。

第二個 VPN 實例嘗試相同，但未能添加這 2 條路由，因為它們已經存在。只允許 1 個預設路由。

您至少有 2 個選項：

  1. route-noexec向 VPN 實例 2 的客戶端配置添加指令

–route-noexec

不要自動添加或刪除路由。而是使用環境變數將路由傳遞給 –route-up 腳本。

現在路線將被拉出，但不會添加到您的系統中。您可以使用腳本進行自己的路由。例子：

route-up add-routes.sh
  1. 或者將指令添加route-noexec到兩個 VPN 實例的客戶端配置中

添加路由腳本並設置基於策略的路由。

引用自：https://serverfault.com/questions/821168

相關問答

Vpn

連接到從外部無法訪問的 vpn 的機器

  • September 27, 2018
檢視問答
Vpn

將特定埠上的 OpenVPN 流量轉發到不同的 OpenVPN 伺服器

  • June 3, 2017
檢視問答
Vpn

無法在我的 Ubuntu 中添加靜態路由，SIOCADDRT：網路無法訪問

  • April 4, 2016
檢視問答
Vpn

如何找到我的 VPN 網關？

  • March 28, 2016
檢視問答
Windows

在 Window Server 2008 R2 上配置 OpenVPN 客戶端可以連接伺服器的區域網路

  • August 9, 2014
檢視問答
Vpn

OpenVPN - 客戶端流量不完全通過 VPN 路由

  • October 17, 2013
檢視問答