URL: https://linuxfr.org/forums/linux-debian-ubuntu/posts/probleme-configuration-vpn-serveur-dedie Title: Problème configuration VPN serveur dédié Authors: aurelink Date: 2016年12月30日T13:22:38+01:00 License: CC By-SA Tags: lwn Score: 0 Bonjour, Voilà j'ai écumé des tutos et ça fait 2 jours que je m'arrache les cheveux, je souhaite créé un serveur VPN sous mon serveur dédié ubuntu, apparemment le client se connecte (sur windows) mais le PC n'a pas de connexion internet. Je penche sur un problème de routage, j'utilise le port tcp 443 qui est ouvert dans le pare feu du serveur. Merci pour votre précieuse aide ^^ Voici mes fichiers conf: conf server: ```sh # # Fichier de configuration du serveur OpenVPN # # Serveur mode server proto tcp port 443 dev tun # Cles et certificats ca ca.crt cert server.crt key server.key # Ce fichier doit être gardé secret dh dh4096.pem tls-auth ta.key 1 key-direction 0 cipher AES-256-CBC # Reseau server 10.8.0.0 255.255.255.0 push "redirect-gateway def1" push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 8.8.4.4" keepalive 10 120 # Permet aux différentes clients de se contacter entre eux #client-to-client # Securite user nobody group nogroup chroot /etc/openvpn/jail persist-key persist-tun comp-lzo # Décommenter cette option si plusieurs clients utilisent un même certificat # (sinon l'un des clients sera déconnecté) #duplicate-cn # Log verb 3 mute 20 status openvpn-status.log ; log-append /var/log/openvpn.log ``` conf client: ```sh # Client client dev tun proto tcp-client remote 37.187.125.192 443 resolv-retry infinite cipher AES-256-CBC # Cles ca ca.crt cert aurelink.crt key aurelink.key tls-auth ta.key 1 key-direction 1 # Securite nobind persist-key persist-tun comp-lzo verb 3 ``` Le ifconfig: ```sh eth0 Link encap:Ethernet HWaddr 00:22:4d:ae:18:d5 inet addr:37.187.125.192 Bcast:37.187.125.255 Mask:255.255.255.0 inet6 addr: 2001:41d0:a:f6c0::1/128 Scope:Global inet6 addr: fe80::222:4dff:feae:18d5/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:890275 errors:0 dropped:0 overruns:0 frame:0 TX packets:1818979 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:66844068 (66.8 MB) TX bytes:2552885855 (2.5 GB) Interrupt:16 Memory:d0400000-d0420000 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:373 errors:0 dropped:0 overruns:0 frame:0 TX packets:373 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:32828 (32.8 KB) TX bytes:32828 (32.8 KB) tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) ``` le route: ```sh Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default 37.187.125.254 0.0.0.0 UG 0 0 0 eth0 10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0 10.8.0.2 * 255.255.255.255 UH 0 0 0 tun0 37.187.125.0 * 255.255.255.0 U 0 0 0 eth0 ``` le sysctl.conf ```sh # /etc/sysctl.conf - Configuration file for setting system variables # See /etc/sysctl.d/ for additional system variables. # See sysctl.conf (5) for information. # #kernel.domainname = example.com # Uncomment the following to stop low-level messages on console #kernel.printk = 3 4 1 3 ##############################################################3 # Functions previously found in netbase # # Uncomment the next two lines to enable Spoof protection (reverse-path filter) # Turn on Source Address Verification in all interfaces to # prevent some spoofing attacks #net.ipv4.conf.default.rp_filter=1 #net.ipv4.conf.all.rp_filter=1 # Uncomment the next line to enable TCP/IP SYN cookies # See http://lwn.net/Articles/277146/ # Note: This may impact IPv6 TCP sessions too #net.ipv4.tcp_syncookies=1 # Uncomment the next line to enable packet forwarding for IPv4 net.ipv4.ip_forward=1 # Uncomment the next line to enable packet forwarding for IPv6 # Enabling this option disables Stateless Address Autoconfiguration # based on Router Advertisements for this host #net.ipv6.conf.all.forwarding=1 ################################################################### # Additional settings - these settings can improve the network # security of the host and prevent against some network attacks # including spoofing attacks and man in the middle attacks through # redirection. Some network environments, however, require that these # settings are disabled so review and enable them as needed. # # Do not accept ICMP redirects (prevent MITM attacks) #net.ipv4.conf.all.accept_redirects = 0 #net.ipv6.conf.all.accept_redirects = 0 # _or_ # Accept ICMP redirects only for gateways listed in our default # gateway list (enabled by default) # net.ipv4.conf.all.secure_redirects = 1 # # Do not send ICMP redirects (we are not a router) #net.ipv4.conf.all.send_redirects = 0 # # Do not accept IP source route packets (we are not a router) #net.ipv4.conf.all.accept_source_route = 0 #net.ipv6.conf.all.accept_source_route = 0 # # Log Martian Packets #net.ipv4.conf.all.log_martians = 1 # # Disable IPv6 autoconf net.ipv6.conf.all.autoconf = 0 net.ipv6.conf.default.autoconf = 0 net.ipv6.conf.eth0.autoconf = 0 net.ipv6.conf.all.accept_ra = 0 net.ipv6.conf.default.accept_ra = 0 net.ipv6.conf.eth0.accept_ra = 0 ```

AltStyle によって変換されたページ (->オリジナル) /