Asus n56u прошивка Padavan, как настроить OpenVpn client?

Question

sasha-ld @sasha-ld

Asus n56u прошивка Padavan, как настроить OpenVpn client?

Есть роутер MI с прошивкой от Asus n56u Padavan, настраиваю подключение к серверу OpenVpn, показывает что подключился, но после подключения на компе пропадает интернет. Может нужно как то настроить маршрутизацию, на сервере или на роутере, скажите если кто знает.

Вопрос задан более трёх лет назад
2271 просмотр

4 комментария

Подписаться 1 Сложный 4 комментария

sasha-ld @sasha-ld Автор вопроса

Конфиг сервера

local x.x.x.x
port 4443
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 94.140.14.14"
push "dhcp-option DNS 94.140.15.15"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nobody
persist-key
persist-tun
verb 3
crl-verify crl.pem
explicit-exit-notify
status openvpn-status.log
log /var/log/openvpn.log
verb 3

Конфиг клиента

client
dev tun
proto udp
remote x.x.x.x 4443
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
ignore-unknown-option block-outside-dns
block-outside-dns
verb 3
<ca>
<cert>
<key>
<tls-crypt>

Лог сервера:

OpenVPN 2.4.11 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 21 2021
library versions: OpenSSL 1.1.1g FIPS  21 Apr 2020, LZO 2.08
Diffie-Hellman initialized with 2048 bit key
CRL: loaded 1 CRLs from file crl.pem
Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
TUN/TAP device tun0 opened
TUN/TAP TX queue length set to 100
/sbin/ip link set dev tun0 up mtu 1500
/sbin/ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255
Could not determine IPv4/IPv6 protocol. Using AF_INET
Socket Buffers: R=[212992->212992] S=[212992->212992]
UDPv4 link local (bound): [AF_INET]x.x.x.x:4443
UDPv4 link remote: [AF_UNSPEC]
GID set to nobody
UID set to nobody
MULTI: multi_init called, r=256 v=256
IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
ifconfig_pool_read(), in='black,10.8.0.2', TODO: IPv6
succeeded -> ifconfig_pool_set()
ifconfig_pool_read(), in='mi,10.8.0.3', TODO: IPv6
succeeded -> ifconfig_pool_set()
IFCONFIG POOL LIST
black,10.8.0.2
mi,10.8.0.3
Initialization Sequence Completed
95.85.102.15:38248 TLS: Initial packet from [AF_INET]95.85.102.15:38248, sid=4fbdbd4d 4ea039e9
95.85.102.15:38248 VERIFY OK: depth=1, CN=ChangeMe
95.85.102.15:38248 VERIFY OK: depth=0, CN=black
95.85.102.15:38248 peer info: IV_VER=3.git::58b92569
95.85.102.15:38248 peer info: IV_PLAT=win
95.85.102.15:38248 peer info: IV_NCP=2
95.85.102.15:38248 peer info: IV_TCPNL=1
95.85.102.15:38248 peer info: IV_PROTO=2
95.85.102.15:38248 peer info: IV_AUTO_SESS=1
95.85.102.15:38248 peer info: IV_GUI_VER=OCWindows_3.2.3-1851
95.85.102.15:38248 peer info: IV_SSO=openurl
95.85.102.15:38248 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
95.85.102.15:38248 [black] Peer Connection Initiated with [AF_INET]95.85.102.15:38248
black/95.85.102.15:38248 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
black/95.85.102.15:38248 MULTI: Learn: 10.8.0.2 -> black/95.85.102.15:38248
black/95.85.102.15:38248 MULTI: primary virtual IP for black/95.85.102.15:38248: 10.8.0.2
black/95.85.102.15:38248 PUSH: Received control message: 'PUSH_REQUEST'
black/95.85.102.15:38248 SENT CONTROL [black]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 94.140.14.14,dhcp-option DNS 94.140.15.15,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
black/95.85.102.15:38248 Data Channel: using negotiated cipher 'AES-256-GCM'
black/95.85.102.15:38248 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
black/95.85.102.15:38248 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
black/95.85.102.15:38248 IP packet with unknown IP version=0 seen
black/95.85.102.15:38248 SIGTERM[soft,remote-exit] received, client-instance exiting
95.85.102.15:25237 TLS: Initial packet from [AF_INET]95.85.102.15:25237, sid=770b27fc f3cb47db
95.85.102.15:25237 VERIFY OK: depth=1, CN=ChangeMe
95.85.102.15:25237 VERIFY OK: depth=0, CN=mi
95.85.102.15:25237 peer info: IV_VER=2.4.6
95.85.102.15:25237 peer info: IV_PLAT=linux
95.85.102.15:25237 peer info: IV_PROTO=2
95.85.102.15:25237 peer info: IV_NCP=2
95.85.102.15:25237 peer info: IV_LZ4=1
95.85.102.15:25237 peer info: IV_LZ4v2=1
95.85.102.15:25237 peer info: IV_LZO=1
95.85.102.15:25237 peer info: IV_COMP_STUB=1
95.85.102.15:25237 peer info: IV_COMP_STUBv2=1
95.85.102.15:25237 peer info: IV_TCPNL=1
95.85.102.15:25237 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
95.85.102.15:25237 [mi] Peer Connection Initiated with [AF_INET]95.85.102.15:25237
mi/95.85.102.15:25237 MULTI_sva: pool returned IPv4=10.8.0.3, IPv6=(Not enabled)
mi/95.85.102.15:25237 MULTI: Learn: 10.8.0.3 -> mi/95.85.102.15:25237
mi/95.85.102.15:25237 MULTI: primary virtual IP for mi/95.85.102.15:25237: 10.8.0.3
mi/95.85.102.15:25237 PUSH: Received control message: 'PUSH_REQUEST'
mi/95.85.102.15:25237 SENT CONTROL [mi]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 94.140.14.14,dhcp-option DNS 94.140.15.15,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.3 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
mi/95.85.102.15:25237 Data Channel: using negotiated cipher 'AES-256-GCM'
mi/95.85.102.15:25237 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
mi/95.85.102.15:25237 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key

Написано более трёх лет назад

sasha-ld @sasha-ld Автор вопроса

лог сервера

95.85.102.15:24406 VERIFY OK: depth=1, CN=ChangeMe
95.85.102.15:24406 VERIFY OK: depth=0, CN=mi
95.85.102.15:24406 peer info: IV_VER=2.4.6
95.85.102.15:24406 peer info: IV_PLAT=linux
95.85.102.15:24406 peer info: IV_PROTO=2
95.85.102.15:24406 peer info: IV_NCP=2
95.85.102.15:24406 peer info: IV_LZ4=1
95.85.102.15:24406 peer info: IV_LZ4v2=1
95.85.102.15:24406 peer info: IV_LZO=1
95.85.102.15:24406 peer info: IV_COMP_STUB=1
95.85.102.15:24406 peer info: IV_COMP_STUBv2=1
95.85.102.15:24406 peer info: IV_TCPNL=1
95.85.102.15:24406 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
95.85.102.15:24406 [mi] Peer Connection Initiated with [AF_INET]95.85.102.15:24406
mi/95.85.102.15:24406 MULTI_sva: pool returned IPv4=10.8.0.3, IPv6=(Not enabled)
mi/95.85.102.15:24406 MULTI: Learn: 10.8.0.3 -> mi/95.85.102.15:24406
mi/95.85.102.15:24406 MULTI: primary virtual IP for mi/95.85.102.15:24406: 10.8.0.3
mi/95.85.102.15:24406 PUSH: Received control message: 'PUSH_REQUEST'
mi/95.85.102.15:24406 SENT CONTROL [mi]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 94.140.14.14,dhcp-option DNS 94.140.15.15,route-gateway 10.8.0.1$
mi/95.85.102.15:24406 Data Channel: using negotiated cipher 'AES-256-GCM'
mi/95.85.102.15:24406 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
mi/95.85.102.15:24406 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key

лог роутера

Aug 15 09:13:07 MI-4C: starting OpenVPN client...
Aug 15 09:13:07 openvpn-cli[481]: Unrecognized option or missing or extra parameter(s) in client.conf:27: block-outside-dns (2.4.6)
Aug 15 09:13:07 openvpn-cli[481]: OpenVPN 2.4.6 mipsel-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Aug 15 09:13:07 openvpn-cli[481]: library versions: OpenSSL 1.1.1a  20 Nov 2018, LZO 2.10
Aug 15 09:13:07 openvpn-cli[482]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Aug 15 09:13:07 openvpn-cli[482]: Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Aug 15 09:13:07 openvpn-cli[482]: Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Aug 15 09:13:07 openvpn-cli[482]: Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Aug 15 09:13:07 openvpn-cli[482]: Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Aug 15 09:13:07 openvpn-cli[482]: TCP/UDP: Preserving recently used remote address: [AF_INET]x.x.x.x:4443
Aug 15 09:13:07 openvpn-cli[482]: Socket Buffers: R=[155648->155648] S=[155648->155648]
Aug 15 09:13:07 openvpn-cli[482]: UDPv4 link local: (not bound)
Aug 15 09:13:07 openvpn-cli[482]: UDPv4 link remote: [AF_INET]x.x.x.x:4443
Aug 15 09:13:08 openvpn-cli[482]: TLS: Initial packet from [AF_INET]x.x.x.x:4443, sid=e2751acd f35a491c
Aug 15 09:13:08 openvpn-cli[482]: VERIFY OK: depth=1, CN=ChangeMe
Aug 15 09:13:08 openvpn-cli[482]: VERIFY KU OK
Aug 15 09:13:08 openvpn-cli[482]: Validating certificate extended key usage
Aug 15 09:13:08 openvpn-cli[482]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Aug 15 09:13:08 openvpn-cli[482]: VERIFY EKU OK
Aug 15 09:13:08 openvpn-cli[482]: VERIFY OK: depth=0, CN=server
Aug 15 09:13:08 openvpn-cli[482]: Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
Aug 15 09:13:08 openvpn-cli[482]: [server] Peer Connection Initiated with [AF_INET]x.x.x.x:4443
Aug 15 09:13:09 openvpn-cli[482]: SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Aug 15 09:13:10 openvpn-cli[482]: PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 94.140.14.14,dhcp-option DNS 94.140.15.15,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.3 255.255.255.0,peer-id 0,cipher AES-256-GCM'
Aug 15 09:13:10 openvpn-cli[482]: OPTIONS IMPORT: timers and/or timeouts modified
Aug 15 09:13:10 openvpn-cli[482]: OPTIONS IMPORT: --ifconfig/up options modified
Aug 15 09:13:10 openvpn-cli[482]: OPTIONS IMPORT: route options modified
Aug 15 09:13:10 openvpn-cli[482]: OPTIONS IMPORT: route-related options modified
Aug 15 09:13:10 openvpn-cli[482]: OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Aug 15 09:13:10 openvpn-cli[482]: OPTIONS IMPORT: peer-id set
Aug 15 09:13:10 openvpn-cli[482]: OPTIONS IMPORT: adjusting link_mtu to 1624
Aug 15 09:13:10 openvpn-cli[482]: OPTIONS IMPORT: data channel crypto options modified
Aug 15 09:13:10 openvpn-cli[482]: Data Channel: using negotiated cipher 'AES-256-GCM'
Aug 15 09:13:10 openvpn-cli[482]: Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Aug 15 09:13:10 openvpn-cli[482]: Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Aug 15 09:13:10 openvpn-cli[482]: TUN/TAP device tun0 opened
Aug 15 09:13:10 openvpn-cli[482]: TUN/TAP TX queue length set to 100
Aug 15 09:13:10 openvpn-cli[482]: do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Aug 15 09:13:10 openvpn-cli[482]: /sbin/ifconfig tun0 10.8.0.3 netmask 255.255.255.0 mtu 1500 broadcast 10.8.0.255
Aug 15 09:13:10 openvpn-cli[482]: ovpnc.script tun0 1500 1552 10.8.0.3 255.255.255.0 init
Aug 15 09:13:10 dnsmasq[272]: read /etc/hosts - 3 addresses
Aug 15 09:13:10 dnsmasq[272]: read /etc/storage/dnsmasq/hosts - 0 addresses
Aug 15 09:13:10 dnsmasq-dhcp[272]: read /etc/dnsmasq/dhcp/dhcp-hosts.rc
Aug 15 09:13:10 dnsmasq[272]: using nameserver 94.140.14.14#53
Aug 15 09:13:10 dnsmasq[272]: using nameserver 94.140.15.15#53
Aug 15 09:13:10 vpnc-script: tun0 up
Aug 15 09:13:10 openvpn-cli[482]: /sbin/route add -net x.x.x.x netmask 255.255.255.255 gw 192.168.1.1
Aug 15 09:13:10 openvpn-cli[482]: /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.8.0.1
Aug 15 09:13:10 openvpn-cli[482]: /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.8.0.1
Aug 15 09:13:10 openvpn-cli[482]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Aug 15 09:13:10 openvpn-cli[482]: Initialization Sequence Completed

Написано более трёх лет назад