ich habe die verbindung mit den standardeinstellungen mehrmals getestet (fritzbox als udp-basierter tun server) und zumindest mit meinem laptop hat's prima funktioniert.wonderdoc schrieb:Also dachte ich mir, ändere die Portweiterleitung auf der ServerBox auf UDP und stelle Server und Client einfach auf UDP.
Danach funktionierte das VPN aber nicht mehr.
Der Client meldet sich vermutlich am Server noch an.
Im Syslog des Servers kommt aber nur die Meldung: no route to host
diese unterscheiden sich ja "nur" im webif und der intern erzeugten konfigurationsdatei für openvpn.wonderdoc schrieb:Auf dem Server läuft das alte Paket des OpenVPN RC1 und auf dem Client das letzte Beta von knox.
Server vorher:
/ # route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.180.1 0.0.0.0 255.255.255.255 UH 2 0 0 dsl
192.168.180.2 0.0.0.0 255.255.255.255 UH 2 0 0 dsl
192.168.178.0 0.0.0.0 255.255.255.0 U 0 0 0 lan
192.168.30.0 0.0.0.0 255.255.255.0 U 0 0 0 lan
192.168.30.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
0.0.0.0 0.0.0.0 0.0.0.0 U 2 0 0 dsl
/ #
Server Start:
Feb 7 10:22:19 fritz daemon.notice openvpn[21582]: OpenVPN 2.1_rc1 mipsel-linux [SSL] [LZO2] built on Dec 17 2006
Feb 7 10:22:19 fritz daemon.notice openvpn[21582]: Static Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Feb 7 10:22:19 fritz daemon.notice openvpn[21582]: Static Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Feb 7 10:22:19 fritz daemon.notice openvpn[21582]: Static Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Feb 7 10:22:19 fritz daemon.notice openvpn[21582]: Static Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Feb 7 10:22:19 fritz daemon.notice openvpn[21582]: LZO compression initialized
Feb 7 10:22:19 fritz user.warn kernel: request_module(usbrndis)
Feb 7 10:22:19 fritz daemon.notice openvpn[21582]: TUN/TAP device tun0 opened
Feb 7 10:22:19 fritz daemon.notice openvpn[21582]: TUN/TAP TX queue length set to 100
Feb 7 10:22:19 fritz daemon.notice openvpn[21582]: /sbin/ifconfig tun0 10.0.0.1 pointopoint 10.0.0.2 mtu 1500
Feb 7 10:22:19 fritz user.warn kernel: request_module(wlan)
Feb 7 10:22:19 fritz daemon.notice openvpn[21582]: /sbin/route add -net 192.168.31.0 netmask 255.255.255.0 gw 10.0.0.2
Feb 7 10:22:19 fritz daemon.notice openvpn[21582]: Data Channel MTU parms [ L:1545 D:1450 EF:45 EB:135 ET:0 EL:0 AF:3/1 ]
Feb 7 10:22:19 fritz daemon.notice openvpn[21593]: Socket Buffers: R=[65535->131070] S=[65535->131070]
Feb 7 10:22:19 fritz daemon.notice openvpn[21593]: UDPv4 link local (bound): [undef]:32783
Feb 7 10:22:19 fritz daemon.notice openvpn[21593]: UDPv4 link remote: [undef]
Feb 7 10:23:30 fritz daemon.notice openvpn[21593]: Peer Connection Initiated with 84.xxx.xxx.xxx:2052
Feb 7 10:23:31 fritz daemon.notice openvpn[21593]: Initialization Sequence Completed
Feb 7 10:23:31 fritz daemon.err openvpn[21593]: read UDPv4 [EHOSTUNREACH]: No route to host (code=148 )
Feb 7 10:23:36 fritz daemon.err openvpn[21593]: read UDPv4 [EHOSTUNREACH]: No route to host (code=148 )
Feb 7 10:23:36 fritz daemon.err openvpn[21593]: read UDPv4 [EHOSTUNREACH]: No route to host (code=148 )
Feb 7 10:23:36 fritz daemon.err openvpn[21593]: read UDPv4 [EHOSTUNREACH]: No route to host (code=148 )
Server Nachher:
/ # route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.180.1 0.0.0.0 255.255.255.255 UH 2 0 0 dsl
10.0.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
192.168.180.2 0.0.0.0 255.255.255.255 UH 2 0 0 dsl
192.168.178.0 0.0.0.0 255.255.255.0 U 0 0 0 lan
192.168.31.0 10.0.0.2 255.255.255.0 UG 0 0 0 tun0
192.168.30.0 0.0.0.0 255.255.255.0 U 0 0 0 lan
192.168.30.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
0.0.0.0 0.0.0.0 0.0.0.0 U 2 0 0 dsl
/ #
Client vorher:
/ $ route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.180.1 0.0.0.0 255.255.255.255 UH 2 0 0 dsl
192.168.180.2 0.0.0.0 255.255.255.255 UH 2 0 0 dsl
192.168.178.0 0.0.0.0 255.255.255.0 U 0 0 0 lan
192.168.31.0 0.0.0.0 255.255.255.0 U 0 0 0 lan
192.168.31.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
0.0.0.0 0.0.0.0 0.0.0.0 U 2 0 0 dsl
/ $
Client Start:
Feb 7 10:23:30 fritz daemon.notice openvpn[1486]: OpenVPN 2.1_rc1 mipsel-linux [SSL] [LZO2] [EPOLL] built on Jan 17 2007
Feb 7 10:23:30 fritz daemon.warn openvpn[1486]: WARNING: file '/tmp/flash/static.key' is group or others accessible
Feb 7 10:23:30 fritz daemon.notice openvpn[1486]: Static Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Feb 7 10:23:30 fritz daemon.notice openvpn[1486]: Static Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Feb 7 10:23:30 fritz daemon.notice openvpn[1486]: Static Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Feb 7 10:23:30 fritz daemon.notice openvpn[1486]: Static Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Feb 7 10:23:30 fritz daemon.notice openvpn[1486]: LZO compression initialized
Feb 7 10:23:30 fritz daemon.notice openvpn[1486]: TUN/TAP device tun0 opened
Feb 7 10:23:30 fritz daemon.notice openvpn[1486]: TUN/TAP TX queue length set to 100
Feb 7 10:23:30 fritz daemon.notice openvpn[1486]: /sbin/ifconfig tun0 10.0.0.2 pointopoint 10.0.0.1 mtu 1500
Feb 7 10:23:30 fritz daemon.notice openvpn[1486]: /sbin/route add -net 192.168.30.0 netmask 255.255.255.0 gw 10.0.0.1
Feb 7 10:23:30 fritz daemon.notice openvpn[1486]: Data Channel MTU parms [ L:1545 D:1450 EF:45 EB:135 ET:0 EL:0 AF:3/1 ]
Feb 7 10:23:31 fritz daemon.notice openvpn[1495]: Socket Buffers: R=[110592->131072] S=[110592->131072]
Feb 7 10:23:31 fritz daemon.notice openvpn[1495]: UDPv4 link local: [undef]
Feb 7 10:23:31 fritz daemon.notice openvpn[1495]: UDPv4 link remote: 217.xx.xx.xx:32783
Client nachher:
/ $ route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.0.0.1 0.0.0.0 255.255.255.255 UH 0 0 0 tun0
192.168.180.1 0.0.0.0 255.255.255.255 UH 2 0 0 dsl
192.168.180.2 0.0.0.0 255.255.255.255 UH 2 0 0 dsl
192.168.178.0 0.0.0.0 255.255.255.0 U 0 0 0 lan
192.168.31.0 0.0.0.0 255.255.255.0 U 0 0 0 lan
192.168.31.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
192.168.30.0 10.0.0.1 255.255.255.0 UG 0 0 0 tun0
0.0.0.0 0.0.0.0 0.0.0.0 U 2 0 0 dsl
/ $
leider kann man da nicht so richtig viel sehen, die verbose einstellung vom openvpn ist zu niedrig. am besten mal openvpn über webif starten, dann mit killall -9 openvpn stoppen, manuell das verbose level in /var/mod/etc/openvpn-lzo.conf ändern auf 4, und dann openvpn per hand startenwonderdoc schrieb:Hier mal die angeforderten Infos.
openvpn --config /var/mod/etc/openvpn-lzo.conf --daemon
"udp 0.0.0.0:1194 0.0.0.0:1194 # OpenVPN",
damit hatte ich auch probleme und bin einfach wieder auf manuelles ar7.cfg bearbeiten umgestiegen.wonderdoc schrieb:Die Portweiterleitung auf der Serverbox habe ich mit dem VirtualIP-Paket genacht.
also port 1194 auf VirtualIP 192.168.30.254 per FB-WebIf weitergeleitet.
Can OpenVPN handle the situation where both ends of the connection are dynamic?
Yes.
A prerequiste of this method is that you subscribe to a service such as dyndns.org that lets you conveniently point an internet domain name to a dynamic address (or you can do it yourself if you have control over a DNS server that exists on a machine having a static IP address).
The crux of this method is in the 'timeouts' section of the config file below, or more specifically the 'ping' and 'ping-restart' options. Basically, if for whatever reason, OpenVPN doesn't receive a ping from its peer during a 300 second period (as would happen if its peer changed addresses), it will restart. When it restarts, it will re-resolve myremote.mydomain.com to get the new IP address. This method assumes that you are using a dynamic DNS service that lets you immediately update your domain name with your current dynamic address.
Using this technique, OpenVPN will essentially "follow" a dynamic DNS address as it changes.
Here is the config file example:
remote myremote.mydomain.com
dev tun
ifconfig 10.1.0.2 10.1.0.1
up ./up-script # optional
# crypto config
replay-persist replay-persist-file # optional (1.4.0 or above)
# TLS config (or omit TLS security by using a pre-shared key
# such as 'secret static.key').
tls-client
ca key/my-ca.crt
cert key/my-cert.crt
key key/my-key.key
tls-auth key/my-tls-password # optional
# timeouts
ping 15
ping-restart 300 # 5 minutes
resolv-retry 300 # 5 minutes
persist-tun
persist-key
# compression (optional)
comp-lzo
# UID (optional)
user nobody
group nobody
# verbosity (optional)
verb 4
On the other end of the connection, you would duplicate the above config file but change 'remote' appropriately, and swap the ifconfig addresses.
if [ "$OPENVPN_LZO_KEEPALIVE" == "yes" ]; then
echo "keepalive $OPENVPN_LZO_KEEPALIVE_PING $OPENVPN_LZO_KEEPALIVE_TIMEOUT"
if [ "$OPENVPN_LZO_MODE" == "client" ]; then
echo "resolv-retry infinite"
fi
fi
export OPENVPN_LZO_KEEPALIVE='yes'
export OPENVPN_LZO_KEEPALIVE_PING='10'
export OPENVPN_LZO_KEEPALIVE_TIMEOUT='120'
oopswonderdoc schrieb:Das Package wird auch runtergeladen, allerdings ist noch die alte fehlerhafte openvpn-lzo_conf enthalten.
STEP 3: PACK
packing var.tar
creating filesystem image
ERROR: filesystem image is 131072 bytes too big
make: *** [firmware] Fehler 1
Die Änderung passt nun.update: aktuelles paket auf server geladen...
Warum begrenzt unter den Client-Einstellungen das Serverfeld auf 16 Zeichen?openvpn-lzo-2.1_rc1\root\usr\lib\cgi-bin\openvpn-lzo.cgi schrieb:sec_begin '$(lang de:"Client-Einstellungen" en:"Client Configuration")'
cat << EOF
<p>Server: <input id="remote" type="text" maxlength="16" name="remote" value="$(httpd -e "$OPENVPN_LZO_REMOTE")"><br /><small>Server $(lang de:"Hostname oder IP-Adresse" en:"Hostname or IP-Address")</small></p>
<p><input type="hidden" name="dhcp_client" value=""><input id="k9" type="checkbox" name="dhcp_client" value="yes"$pull_chk><label for="k9">$(lang de:"IP-Adresse vom Server empfangen (nur " en:"Recieve IP Address from the Server (only for") TAP)</label></p>
<p><input type="hidden" name="pull" value=""><input id="k7" type="checkbox" name="pull" value="yes"$pull_chk><label for="k7">$(lang de:"Optionen vom Server empfangen (nur mit Zertifikaten)" en:"Pull options from Server (only when used with certificates)")</label></p>
EOF