OpenVPN 和 pfsense 埠配置
我想在 pfsense 中配置 OpenVpn 以連接到虛擬伺服器內的專用網路,我按照一些說明進行操作,並閱讀了很多內容,我遇到了同樣的問題,這就是我所做的:
- 生成 CA 證書
- 生成伺服器證書
- 創建使用者並為該使用者生成證書
- 將 nat 中的出站配置到 vpn 網路(10.0.0.0/24),然後應用嚮導
- 安裝創建到防火牆中的規則 yo 允許 vpn
- 安裝 openvpn 導出外掛並下載配置
- 我嘗試使用粘度、openvpn 客戶端和 tunnelblick
現在客戶端的問題在於握手,但我認為問題出在 pfsense 防火牆中,即使我嘗試連接,控制 vpn 埠的規則也是 0/0。
如果我用 nmap 掃描埠,我會這樣做:
1194/tcp filtered openvpn 1194/udp open|filtered openvpn
有任何想法嗎?
那麼 openvpn.log 給我看這個
Dec 21 13:50:55 Firewall openvpn[6124]: OpenVPN 2.3.11 amd64-portbld-freebsd10.3 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Jul 19 2016 Dec 21 13:50:55 Firewall openvpn[6124]: library versions: OpenSSL 1.0.1s-freebsd 1 Mar 2016, LZO 2.09 Dec 21 13:50:55 Firewall openvpn[6222]: WARNING: using --duplicate-cn and --client-config-dir together is probably not what you want Dec 21 13:50:55 Firewall openvpn[6222]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts Dec 21 13:50:55 Firewall openvpn[6222]: Control Channel Authentication: using '/var/etc/openvpn/server1.tls-auth' as a OpenVPN static key file Dec 21 13:50:55 Firewall openvpn[6222]: TUN/TAP device ovpns1 exists previously, keep at program end Dec 21 13:50:55 Firewall openvpn[6222]: TUN/TAP device /dev/tun1 opened Dec 21 13:50:55 Firewall openvpn[6222]: ioctl(TUNSIFMODE): Device busy: Device busy (errno=16) Dec 21 13:50:55 Firewall openvpn[6222]: do_ifconfig, tt->ipv6=1, tt->did_ifconfig_ipv6_setup=0 Dec 21 13:50:55 Firewall openvpn[6222]: /sbin/ifconfig ovpns1 10.0.0.1 10.0.0.2 mtu 1500 netmask 255.255.255.0 up Dec 21 13:50:55 Firewall openvpn[6222]: /usr/local/sbin/ovpn-linkup ovpns1 1500 1557 10.0.0.1 255.255.255.0 init Dec 21 13:50:55 Firewall openvpn[6222]: UDPv4 link local (bound): [AF_INET]XX.XXX.XXX.XXX:1194 Dec 21 13:50:55 Firewall openvpn[6222]: UDPv4 link remote: [undef] Dec 21 13:50:55 Firewall openvpn[6222]: Initialization Sequence Completed
您可以看到一個警告,但我不明白這是什麼意思,另一個日誌文件 filter.log 顯示了很多資訊,但我通過 vpn 進行 grep,1194,我什麼也沒得到,我到底在尋找什麼?對此感到抱歉,但這是我第一次嘗試使用 vpn,我不知道該怎麼做。
嘗試後:
tcpdump -n -e -ttt -i pflog0
15 分鐘後我什麼也沒得到,嘗試使用 openvpn 客戶端:
tcpdump: WARNING: pflog0: no IPv4 address assigned tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on pflog0, link-type PFLOG (OpenBSD pflog file), capture size 65535 bytes ^C 0 packets captured 0 packets received by filter 0 packets dropped by kernel
但是,如果使用 nmap 進行埠掃描,我會這樣做:
tcpdump: WARNING: pflog0: no IPv4 address assigned tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on pflog0, link-type PFLOG (OpenBSD pflog file), capture size 65535 bytes 00:00:00.000000 rule 5..16777216/0(match): block in on vmx0: IP8 bad-len 0 00:00:00.002001 rule 5..16777216/0(match): block in on vmx0: IP1 bad-len 0 00:01:09.092480 rule 5..16777216/0(match): block in on vmx0: IP10 bad-len 0 00:00:00.001754 rule 5..16777216/0(match): block in on vmx0: IP12 bad-len 0 8 packets captured 8 packets received by filter 0 packets dropped by kernel
防火牆在監聽openvpn伺服器的1194埠沒有收到任何數據包,有什麼方法可以測試埠嗎?或者以某種方式將包發送到 1194 埠並查看是否有效?
好吧,我檢查了配置,我認為沒問題,這是:
dev ovpns1 verb 1 dev-type tun tun-ipv6 dev-node /dev/tun1 writepid /var/run/openvpn_server1.pid #user nobody #group nobody script-security 3 daemon keepalive 10 60 ping-timer-rem persist-tun persist-key proto udp cipher AES-256-CBC auth SHA256 up /usr/local/sbin/ovpn-linkup down /usr/local/sbin/ovpn-linkdown client-connect /usr/local/sbin/openvpn.attributes.sh client-disconnect /usr/local/sbin/openvpn.attributes.sh local XXX.XXX.XXX.XXX #public ip tls-server server 10.0.0.0 255.255.255.0 client-config-dir /var/etc/openvpn-csc/server1 username-as-common-name auth-user-pass-verify "/usr/local/sbin/ovpn_auth_verify user 'Local Database' false server1" via-env tls-verify "/usr/local/sbin/ovpn_auth_verify tls 'Server_CRT' 1" lport 1194 management /var/etc/openvpn/server1.sock unix max-clients 2 push "route 192.168.0.0 255.255.255.0" push "redirect-gateway def1" client-to-client ca /var/etc/openvpn/server1.ca cert /var/etc/openvpn/server1.cert key /var/etc/openvpn/server1.key dh /etc/dh-parameters.2048 tls-auth /var/etc/openvpn/server1.tls-auth 0 persist-remote-ip float topology subnet
如果執行 sockstat | grep 1194 像工作一樣工作:
root openvpn 84783 6 udp4 XXX.XXX.XXX.XXX:1194 *:*
我想我們還在繼續,現在當我嘗試連接客戶端時,在 openvpn 日誌中我看到了這個:
Jan 14 22:30:16 Firewall openvpn[73374]: MANAGEMENT: Client connected from /var/etc/openvpn/server1.sock Jan 14 22:30:16 Firewall openvpn[73374]: MANAGEMENT: CMD 'status 2' Jan 14 22:30:17 Firewall openvpn[73374]: MULTI: REAP range 176 -> 192 Jan 14 22:30:17 Firewall openvpn[73374]: MANAGEMENT: CMD 'quit' Jan 14 22:30:17 Firewall openvpn[73374]: MANAGEMENT: Client disconnected
在客戶端我看到這個:
Jan 14 22:31:14: UDPv4 link remote: [AF_INET]xxx.xxx.xxx.xxx:1194 Jan 14 22:32:14: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) Jan 14 22:32:14: TLS Error: TLS handshake failed Jan 14 22:32:14: SIGUSR1[soft,tls-error] received, process restarting Jan 14 22:32:15: UDPv4 link local (bound): [undef] Jan 14 22:32:15: UDPv4 link remote: [AF_INET]xxx.xxx.xxx.xxx:1194
好吧,在與我的伺服器提供商交談並檢查他的網路一切執行正常後,他們在我的伺服器前面使用了防火牆,謝謝大家的幫助!
找出它是否是防火牆的最佳方法是查看它的日誌。
編輯:我的意思是你應該看看 pf 日誌。pf 應該記錄它所做的任何拒絕,這可能會確認或拒絕您對它是防火牆的懷疑。我沒有使用 pfsense,但是在 FreeBSD 上查看 pf 日誌會是這樣的:tcpdump -n -e -ttt -r /var/log/pflog或者您可以使用****tcpdump -n -e -ttt實時觀看**-i pflog0**。