linux 客戶端連接上openvpn server后，ping內網得到「Destination host unreachable」
如上，謝謝各位大俠幫我看看這是怎麼回事？？ 我用相同的client的配置文件在windows上登陸vpn server，沒有任何問題，但用linux平台成功登陸vpn server后則無法ping通內網，當然仍然可以上網。我在家中通過房東的router得到192.168.1.103,tap的ip address 是172。16。16。12，辦公室內網也是192.168.1.0網段。對外網段是201.223.23.0，linux的route有三個，192.168.1.0, 172.16.16.0,201,223.23.0 , 網關是房東的192.168.1.1 , 但在linux下traceroute到172.16.16.0和192.168.1.0及201.223.23.0網段，linux都會用tap0口的網關172.16.16.1,但都得到「Destination host unreachable」我已經打開防火期和ip轉發及iptables。下面是我的一些配置：
linux的route table
=================Linux platform=================================
linux的沒有連接vpn時的路由
# netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
#
#
linux的連接vpn server后的路由
# netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
172.16.16.0 0.0.0.0 255.255.255.0 U 0 0 0 tap0
192.168.1.0 172.16.16.1 255.255.255.0 UG 0 0 0 tap0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
201.223.23.0 172.16.16.1 255.255.255.0 UG 0 0 0 tap0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
#
ping的一些現象
ping vpn的網關
# ping 172.16.16.1
PING 172.16.16.1 (172.16.16.1) 56(84) bytes of data.
From 172.16.16.12 icmp_seq=1 Destination Host Unreachable
From 172.16.16.12 icmp_seq=2 Destination Host Unreachable
From 172.16.16.12 icmp_seq=3 Destination Host Unreachable
--- 172.16.16.1 ping statistics ---
5 packets transmitted, 0 received, +3 errors, 100% packet loss, time 4001ms
, pipe 4
#
ping vpn中外網的地址
# ping 201.223.23.4
PING201.223.23.4(201.223.23.4) 56(84) bytes of data.
From 172.16.16.12 icmp_seq=0 Destination Host Unreachable
From 172.16.16.12 icmp_seq=1 Destination Host Unreachable
From 172.16.16.12 icmp_seq=2 Destination Host Unreachable
--- 201.223.23.4 ping statistics ---
6 packets transmitted, 0 received, +3 errors, 100% packet loss, time 5005ms
, pipe 4
#
ping公司的內網和外網，linux都用tap，vpn分配的網關，windows平台則一切正常。奇怪了。
這是windows和linux處理route路由的不同引起的嗎？？我覺得是路由問題，和vpn的配置文件無關！謝謝各位大俠幫忙！！server.conf和client.conf 非常的正常，幾乎和所有的sample配置文件沒有很大區別！！！我下載后貼上來。
《解決方案》
把server.conf貼出來看看
估計裡面多寫了路由吧。
《解決方案》
是啊，原來linux已經有192.168.1.0 這個route（home中的LAN），又加入了一個辦公室的LAN也是192.168.1.0網段。在登陸 log 中有個說192.168.1.0已經有了。下面是server.conf
sensor# more office.conf
mode server
daemon vpn-serv_ext
tls-server
# Which local IP address should OpenVPN
# listen on? (optional)
local 201.223.23.41
# Which TCP/UDP port should OpenVPN listen on?
# If you want to run multiple OpenVPN instances
# on the same machine, use a different port
# number for each one. You will need to
# open up this port on your firewall.
port 1194
# TCP or UDP server?
;proto tcp
proto udp
fragment 1300
mssfix
# "dev tun" will create a routed IP tunnel,
office.conf 9%mode server
daemon vpn-serv_ext
tls-server
# Which local IP address should OpenVPN
# listen on? (optional)
local 201.223.23.41
# Which TCP/UDP port should OpenVPN listen on?
# If you want to run multiple OpenVPN instances
# on the same machine, use a different port
# number for each one. You will need to
# open up this port on your firewall.
port 1194
# TCP or UDP server?
;proto tcp
proto udp
fragment 1300
mssfix
# "dev tun" will create a routed IP tunnel,
# "dev tap" will create an ethernet tunnel.
# Use "dev tap" if you are ethernet bridging.
# If you want to control access policies
# over the VPN, you must create firewall
# rules for the the TUN/TAP interface.
# On non-Windows systems, you can give
# an explicit unit number, such as tun0.
# On Windows, use "dev-node" for this.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
dev tap0
fast-io
#learn-address /usr/local/etc/openvpn/fw_manage.pl
# SSL/TLS root certificate (ca), certificate
# (cert), and private key (key). Each client
# and the server must have their own cert and
# key file. The server and all clients will
# use the same ca file.
#
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh1024.pem
# Maintain a record of client <-> virtual IP address
# associations in this file. If OpenVPN goes down or
# is restarted, reconnecting clients can be assigned
# the same virtual IP address from the pool that was
# previously assigned.
#ifconfig-pool-persist server.txt
# Push routes to the client to allow it
# to reach other private subnets behind
# the server. Remember that these
# private subnets will also need
# to know to route the OpenVPN client
# address pool (10.8.0.0/255.255.255.0)
# back to the OpenVPN server.
#ifconfig 172.16.16.1 255.255.255.0
#ifconfig-pool 172.16.16.2 172.16.16.254 255.255.255.0
push "route-gateway 192.168.1.9"
;push "route-delay 15"
push "route 201.223.23.0.0 255.255.255.0"
push "route 192.168.1.0 255.255.255.0"---------------------此處網段和家中的LAN重複。
# Uncomment this directive to allow different
# clients to be able to "see" each other.
# By default, clients will only see the server.
# To force clients to only see the server, you
# will also need to appropriately firewall the
# server's TUN/TAP interface.
client-to-client
# Uncomment this directive if multiple clients
# might connect with the same certificate/key
# files or common names. This is recommended
# only for testing purposes. For production use,
# each client should have its own certificate/key
# pair.
#
# IF YOU HAVE NOT GENERATED INDIVIDUAL
# CERTIFICATE/KEY PAIRS FOR EACH CLIENT,
# EACH HAVING ITS OWN UNIQUE "COMMON NAME",
# UNCOMMENT THIS LINE OUT.
;duplicate-cn
# The keepalive directive causes ping-like
# messages to be sent back and forth over
# the link so that each side knows when
# the other side has gone down.
# Ping every 10 seconds, assume that remote
# peer is down if no ping received during
# a 120 second time period.
#keepalive 10 120
keepalive 5 60
# For extra security beyond that provided
# by SSL/TLS, create an "HMAC firewall"
# to help block DoS attacks and UDP port flooding.
#
# Generate with:
# openvpn --genkey --secret ta.key
#
# The server and each client must have
# a copy of this key.
# The second parameter should be '0'
# on the server and '1' on the clients.
tls-auth ta.key 0
# Select a cryptographic cipher.
# This config item must be copied to
# the client config file as well.
cipher BF-CBC # Blowfish (default)
;cipher AES-128-CBC # AES
;cipher DES-EDE3-CBC # Triple-DES
# Enable compression on the VPN link.
# If you enable it here, you must also
# enable it in the client config file.
comp-lzo
# The maximum number of concurrently connected
# clients we want to allow.
;max-clients 100
# It's a good idea to reduce the OpenVPN
# daemon's privileges after initialization.
#
# You can uncomment this out on
# non-Windows systems.
user openvpn
group openvpn
# The persist options will try to avoid
# accessing certain resources on restart
# that may no longer be accessible because
# of the privilege downgrade.
persist-key
persist-tun
# Output a short status file showing
# current connections, truncated
# and rewritten every minute.
status office-status.log
# By default, log messages will go to the syslog (or
# on Windows, if running as a service, they will go to
# the "\Program Files\OpenVPN\log" directory).
# Use log or log-append to override this default.
# "log" will truncate the log file on OpenVPN startup,
# while "log-append" will append to it. Use one
# or the other (but not both).
;log openvpn.log
;log-append openvpn.log
# Set the appropriate level of log
# file verbosity.
#
# 0 is silent, except for fatal errors
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
verb 4
# Silence repeating messages. At most 20
# sequential messages of the same message
# category will be output to the log.
;mute 20
《解決方案》
push "route 201.223.23.0.0 255.255.255.0"
push "route 192.168.1.0 255.255.255.0"---------------------此處網段和家中的LAN重複。
上面兩行都去掉
把家裡的內網地址修改成另外一段
《解決方案》
原帖由 wenzk 於 2006-11-13 22:10 發表
push "route 201.223.23.0.0 255.255.255.0"
push "route 192.168.1.0 255.255.255.0"---------------------此處網段和家中的LAN重複。
上面兩行都去掉
把家裡的內網地址修改成另外一段
－－－－有時根本無法要求別人換另外一個IP地址，伺服器端的配置還暫時不敢動，至少windows用戶接入正常。
我又換了一個朋友家的接入，得到一個真實ip 地址。
連接isp上網后如下
# netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
24.87.40.0 0.0.0.0 255.255.252.0 U 0 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
0.0.0.0 24.87.40.1 0.0.0.0 UG 0 0 0 eth0
#
成功接入openvpn后netstat如下：
# netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
192.168.1.0 172.16.16.1 255.255.255.0 UG 0 0 0 tap0
172.16.16.0 0.0.0.0 255.255.255.0 U 0 0 0 tap0
201,223.23.0 172.16.16.1 255.255.255.0 UG 0 0 0 tap0
24.87.40.0 0.0.0.0 255.255.252.0 U 0 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
0.0.0.0 24.87.40.1 0.0.0.0 UG 0 0 0 eth0
#
但癥狀依然一樣，無法ping通網關172.16.16.1,得到「destination host unreachable」的信息
通過arp得到
# arp
Address HWtype HWaddress Flags Mask Iface
172.16.16.1 (incomplete) tap0
24.87.40.1 ether 00:13:5F:07:63:05 C eth0
#
用tcpdump －tap0得到下面一些信息：
16:13:02.309610 arp who-has 172.16.16.1 tell 172.16.16.12
16:13:03.309438 arp who-has 172.16.16.1 tell 172.16.16.12
16:13:04.309304 arp who-has 172.16.16.1 tell 172.16.16.12
16:13:05.314145 arp who-has 172.16.16.1 tell 172.16.16.12
16:13:05.847804 ff:ff:ff:00:f5:10 > 66:00:22:ff:ff:ff, ethertype Unknown (0x3f2a), length 121:
0x0000: 1908 0045 0001 48c7 e000 00ff 11f2 c400 ...E..H.........
0x0010: 0000 00ff ffff ff00 4400 4301 3472 be01 ........D.C.4r..
0x0020: 0106 0069 08dd 8f00 0964 032c 0f00 7461 ...i.....d.,..ta
0x0030: 702c 4000 209e 3400 0008 6382 5363 3501 p,@...4...c.Sc5.
0x0040: 0137 0a01 0306 0f70 714e 4f5f fc39 0205 .7.....pqNO_.9..
0x0050: dc3d .=
16:13:06.313980 arp who-has 172.16.16.1 tell 172.16.16.12
16:13:07.313862 arp who-has 172.16.16.1 tell 172.16.16.12
16:13:08.324690 arp who-has 172.16.16.1 tell 172.16.16.12
16:13:09.324543 arp who-has 172.16.16.1 tell 172.16.16.12
說明tap0 一直在找172.16.16.1 網關。謝謝大家，幫我看看，真是邪門了！！
《解決方案》
這次的route沒有重複的，linux應該不會混淆了啊！！
《解決方案》
push "route 201.223.23.0.0 255.255.255.0"
去掉這句
如果你不換網段，你就無法訪問伺服器段地址。
《解決方案》
我已經增加了客戶端iptables下的tap0 接受和in※out及轉發，但用iptables －list沒有看到專門的tap0 轉發和接受，這個正常嗎？已經關閉了防火牆！
現在總的情況是arp命令下面都沒有對端伺服器的MAC地址 ，說 「incomplete」 server的log 有時報錯說「no route to host」
現在什麼路由都想從172.16.16.12出去。但172.16.16.1的server端tap0口都不通啊。真奇怪，CentOS的routing是否和windows不同啊，linux的正準備重裝linux了。
《解決方案》
# Which local IP address should OpenVPN
# listen on? (optional)
local 201.223.23.41
push "route 201.223.23.0.0 255.255.255.0"
push "route 192.168.1.0 255.255.255.0"---------------------此處網段和家中的LAN重複。
從你的配置文件中可以看出，你的伺服器所在的網段是201.223.23.0/24這個網段。
如果OpenVPN的client連接上后，本機會增加一跳路由
去往201.223.23.0/24的數據都從VPN走，因為走VPN呀，所以數據要發給203.233.23.41這個主機，所以查找路由表，該怎麼轉發
經過N次查找，發現還是發送給VPN程序，但是這個時候你的機器已經沒有去往VPN Server的路由了。所以要麼去掉這條，要麼增加
push "route remote_host 255.255.255.255 net_gateway"
對於換IP段的問題。其實很簡單
你在不拉專線，也不通過任何軟體進行橋接，你在家配置上201.223.23.0/24的地址可以正常訪問公司的伺服器嗎？
肯定是不行的，在互聯網上，任何處於同一個廣播域的IP應該都在一個網段內（使用arp代理等技術除外）
假如你有61.1.1.0/24這段地址，但是你想在2個lan下使用，你在每個lan下的子網掩碼肯定必須大於255.255.255.0，否則這2個lan是無法通信的。一般常見的方法是把這段IP分成2斷
61.1.1.0/25
61.1.1.128/25
這個是網路基礎的問題了，其實不應該在這個地方過於詳細的討論。
PS: 用OpenVPN無所謂windows和Linux的說法，配置文件都一樣，我的配置文件就是在WIN和Linux之間來回複製使用。
《解決方案》
謝謝！非常感謝！雖然沒有看懂，不加路由它自己也能走！！我做另外一個試驗看到手工加了201和192兩個網段相反不能ping一個內網了，原來沒有任何push語句，不知道vpn什麼地方加上的201和192網段，怪了，加上了SSH不能訪問了。再次感謝！回去說服boss！
