Почему не работает интернет при подключении через OpenVPN у домашнего провайдера билайн?

Question

[TraVviS]

Настроил openVPN на VPS от Digital Ocean по подобному мануалу https://www.digitalocean.com/community/tutorials/o... . Всё работало, IP менялся, доступ в интернет был. Но в какой-то момент доступ пропал. Причём проблема именно с провайдером билайн. Пробовал менять роутер и подключаться через соседские сети (тоже билайн) - та же проблема. OpenVPN подключается, но доступа в интернет нет. Однако при смене провайдера на мобильный МТС - всё работает, как с телефона так и с ББ при подключении через режим модема на телефоне. Может ли провайдер блокировать использование OpenVPN или могла ли повлиять блокировка РКН ip Digital Ocean на корректную работу VPN?

Comments

[ScriptKiddo]

Попробуйте порт поменять на отличный от 1194

[TraVviS]

ScriptKiddo, пробовал менять на 443. не спасло

[ScriptKiddo]

TraVviS, прикрепите лог клиента VPN в тег code

[TraVviS]

ScriptKiddo,

spoiler

Tue May 21 10:05:20 2019 OpenVPN 2.4.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Apr 26 2018
Tue May 21 10:05:20 2019 Windows version 6.2 (Windows 8 or greater) 64bit
Tue May 21 10:05:20 2019 library versions: OpenSSL 1.1.0h  27 Mar 2018, LZO 2.10
Enter Management Password:
Tue May 21 10:05:20 2019 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue May 21 10:05:20 2019 Need hold release from management interface, waiting...
Tue May 21 10:05:20 2019 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue May 21 10:05:20 2019 MANAGEMENT: CMD 'state on'
Tue May 21 10:05:20 2019 MANAGEMENT: CMD 'log all on'
Tue May 21 10:05:20 2019 MANAGEMENT: CMD 'echo all on'
Tue May 21 10:05:20 2019 MANAGEMENT: CMD 'bytecount 5'
Tue May 21 10:05:20 2019 MANAGEMENT: CMD 'hold off'
Tue May 21 10:05:20 2019 MANAGEMENT: CMD 'hold release'
Tue May 21 10:05:20 2019 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue May 21 10:05:20 2019 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue May 21 10:05:20 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]146.185.131.47:443
Tue May 21 10:05:20 2019 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue May 21 10:05:20 2019 UDP link local: (not bound)
Tue May 21 10:05:20 2019 UDP link remote: [AF_INET]146.185.131.47:443
Tue May 21 10:05:20 2019 MANAGEMENT: >STATE:1558422320,WAIT,,,,,,
Tue May 21 10:05:20 2019 MANAGEMENT: >STATE:1558422320,AUTH,,,,,,
Tue May 21 10:05:20 2019 TLS: Initial packet from [AF_INET]146.185.131.47:443, sid=91e3b26b 9f4c95a4
Tue May 21 10:05:20 2019 VERIFY OK: depth=1, CN=ChangeMe
Tue May 21 10:05:20 2019 VERIFY KU OK
Tue May 21 10:05:20 2019 Validating certificate extended key usage
Tue May 21 10:05:20 2019 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue May 21 10:05:20 2019 VERIFY EKU OK
Tue May 21 10:05:20 2019 VERIFY OK: depth=0, CN=server
Tue May 21 10:05:20 2019 Control Channel: TLSv1.2, cipher TLSv1.2 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue May 21 10:05:20 2019 [server] Peer Connection Initiated with [AF_INET]146.185.131.47:443
Tue May 21 10:05:22 2019 MANAGEMENT: >STATE:1558422322,GET_CONFIG,,,,,,
Tue May 21 10:05:22 2019 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Tue May 21 10:05:22 2019 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0'
Tue May 21 10:05:22 2019 OPTIONS IMPORT: timers and/or timeouts modified
Tue May 21 10:05:22 2019 OPTIONS IMPORT: --ifconfig/up options modified
Tue May 21 10:05:22 2019 OPTIONS IMPORT: route options modified
Tue May 21 10:05:22 2019 OPTIONS IMPORT: route-related options modified
Tue May 21 10:05:22 2019 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue May 21 10:05:22 2019 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue May 21 10:05:22 2019 Outgoing Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue May 21 10:05:22 2019 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue May 21 10:05:22 2019 Incoming Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue May 21 10:05:22 2019 interactive service msg_channel=0
Tue May 21 10:05:22 2019 ROUTE_GATEWAY 192.168.88.1/255.255.255.0 I=19 HWADDR=70:85:c2:4a:ad:67
Tue May 21 10:05:22 2019 open_tun
Tue May 21 10:05:22 2019 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{7C1E5EB3-63FD-43A1-906C-C382376B314C}.tap
Tue May 21 10:05:22 2019 TAP-Windows Driver Version 9.21 
Tue May 21 10:05:22 2019 Set TAP-Windows TUN subnet mode network/local/netmask = 10.8.0.0/10.8.0.2/255.255.255.0 [SUCCEEDED]
Tue May 21 10:05:22 2019 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.2/255.255.255.0 on interface {7C1E5EB3-63FD-43A1-906C-C382376B314C} [DHCP-serv: 10.8.0.254, lease-time: 31536000]
Tue May 21 10:05:22 2019 Successful ARP Flush on interface [12] {7C1E5EB3-63FD-43A1-906C-C382376B314C}
Tue May 21 10:05:22 2019 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Tue May 21 10:05:22 2019 MANAGEMENT: >STATE:1558422322,ASSIGN_IP,,10.8.0.2,,,,
Tue May 21 10:05:22 2019 Block_DNS: WFP engine opened
Tue May 21 10:05:22 2019 Block_DNS: Using existing sublayer
Tue May 21 10:05:22 2019 Block_DNS: Added permit filters for exe_path
Tue May 21 10:05:22 2019 Block_DNS: Added block filters for all interfaces
Tue May 21 10:05:22 2019 Block_DNS: Added permit filters for TAP interface
Tue May 21 10:05:27 2019 TEST ROUTES: 1/1 succeeded len=0 ret=1 a=0 u/d=up
Tue May 21 10:05:27 2019 C:\WINDOWS\system32\route.exe ADD 146.185.131.47 MASK 255.255.255.255 192.168.88.1
Tue May 21 10:05:27 2019 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=35 and dwForwardType=4
Tue May 21 10:05:27 2019 Route addition via IPAPI succeeded [adaptive]
Tue May 21 10:05:27 2019 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.1
Tue May 21 10:05:27 2019 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=3 and dwForwardType=4
Tue May 21 10:05:27 2019 Route addition via IPAPI succeeded [adaptive]
Tue May 21 10:05:27 2019 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.1
Tue May 21 10:05:27 2019 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=3 and dwForwardType=4
Tue May 21 10:05:27 2019 Route addition via IPAPI succeeded [adaptive]
Tue May 21 10:05:27 2019 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue May 21 10:05:27 2019 Initialization Sequence Completed
Tue May 21 10:05:27 2019 MANAGEMENT: >STATE:1558422327,CONNECTED,SUCCESS,10.8.0.2,146.185.131.47,443,,
Tue May 21 10:05:43 2019 C:\WINDOWS\system32\route.exe DELETE 146.185.131.47 MASK 255.255.255.255 192.168.88.1
Tue May 21 10:05:43 2019 Route deletion via IPAPI succeeded [adaptive]
Tue May 21 10:05:43 2019 C:\WINDOWS\system32\route.exe DELETE 0.0.0.0 MASK 128.0.0.0 10.8.0.1
Tue May 21 10:05:43 2019 Route deletion via IPAPI succeeded [adaptive]
Tue May 21 10:05:43 2019 C:\WINDOWS\system32\route.exe DELETE 128.0.0.0 MASK 128.0.0.0 10.8.0.1
Tue May 21 10:05:43 2019 Route deletion via IPAPI succeeded [adaptive]
Tue May 21 10:05:43 2019 Closing TUN/TAP interface
Tue May 21 10:05:43 2019 TAP: DHCP address released
Tue May 21 10:05:43 2019 SIGTERM[hard,] received, process exiting
Tue May 21 10:05:43 2019 MANAGEMENT: >STATE:1558422343,EXITING,SIGTERM,,,,,

[ScriptKiddo]

TraVviS, оговорился. Спрячьте под спойлер

[ScriptKiddo]

TraVviS, По логам ничего необычного не видно. Попробуйте поставить порт 1195 для проверки

[TraVviS]

ScriptKiddo, поменял порт в etc/openvpn/server.conf и в клиентском .ovpn на 1195. Нужно где-то еще?

spoiler

Tue May 21 11:04:55 2019 OpenVPN 2.4.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Apr 26 2018
Tue May 21 11:04:55 2019 Windows version 6.2 (Windows 8 or greater) 64bit
Tue May 21 11:04:55 2019 library versions: OpenSSL 1.1.0h  27 Mar 2018, LZO 2.10
Enter Management Password:
Tue May 21 11:04:55 2019 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue May 21 11:04:55 2019 Need hold release from management interface, waiting...
Tue May 21 11:04:55 2019 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue May 21 11:04:56 2019 MANAGEMENT: CMD 'state on'
Tue May 21 11:04:56 2019 MANAGEMENT: CMD 'log all on'
Tue May 21 11:04:56 2019 MANAGEMENT: CMD 'echo all on'
Tue May 21 11:04:56 2019 MANAGEMENT: CMD 'bytecount 5'
Tue May 21 11:04:56 2019 MANAGEMENT: CMD 'hold off'
Tue May 21 11:04:56 2019 MANAGEMENT: CMD 'hold release'
Tue May 21 11:04:56 2019 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue May 21 11:04:56 2019 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue May 21 11:04:56 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]146.185.131.47:1195
Tue May 21 11:04:56 2019 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue May 21 11:04:56 2019 UDP link local: (not bound)
Tue May 21 11:04:56 2019 UDP link remote: [AF_INET]146.185.131.47:1195
Tue May 21 11:04:56 2019 MANAGEMENT: >STATE:1558425896,WAIT,,,,,,
Tue May 21 11:05:56 2019 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Tue May 21 11:05:56 2019 TLS Error: TLS handshake failed
Tue May 21 11:05:56 2019 SIGUSR1[soft,tls-error] received, process restarting
Tue May 21 11:05:56 2019 MANAGEMENT: >STATE:1558425956,RECONNECTING,tls-error,,,,,
Tue May 21 11:05:56 2019 Restart pause, 5 second(s)
Tue May 21 11:05:59 2019 SIGTERM[hard,init_instance] received, process exiting
Tue May 21 11:05:59 2019 MANAGEMENT: >STATE:1558425959,EXITING,init_instance,,,,,

[ScriptKiddo]

TraVviS, если по гайду настраивали - то еще нужно с помощью UFW открыть

[TraVviS]

ScriptKiddo, верно, спасибо! В итоге ничего не изменилось.

spoiler

Tue May 21 11:17:34 2019 OpenVPN 2.4.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Apr 26 2018
Tue May 21 11:17:34 2019 Windows version 6.2 (Windows 8 or greater) 64bit
Tue May 21 11:17:34 2019 library versions: OpenSSL 1.1.0h  27 Mar 2018, LZO 2.10
Enter Management Password:
Tue May 21 11:17:34 2019 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue May 21 11:17:34 2019 Need hold release from management interface, waiting...
Tue May 21 11:17:35 2019 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue May 21 11:17:35 2019 MANAGEMENT: CMD 'state on'
Tue May 21 11:17:35 2019 MANAGEMENT: CMD 'log all on'
Tue May 21 11:17:35 2019 MANAGEMENT: CMD 'echo all on'
Tue May 21 11:17:35 2019 MANAGEMENT: CMD 'bytecount 5'
Tue May 21 11:17:35 2019 MANAGEMENT: CMD 'hold off'
Tue May 21 11:17:35 2019 MANAGEMENT: CMD 'hold release'
Tue May 21 11:17:35 2019 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue May 21 11:17:35 2019 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue May 21 11:17:35 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]146.185.131.47:1195
Tue May 21 11:17:35 2019 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue May 21 11:17:35 2019 UDP link local: (not bound)
Tue May 21 11:17:35 2019 UDP link remote: [AF_INET]146.185.131.47:1195
Tue May 21 11:17:35 2019 MANAGEMENT: >STATE:1558426655,WAIT,,,,,,
Tue May 21 11:17:35 2019 MANAGEMENT: >STATE:1558426655,AUTH,,,,,,
Tue May 21 11:17:35 2019 TLS: Initial packet from [AF_INET]146.185.131.47:1195, sid=5824675c 497765e4
Tue May 21 11:17:35 2019 VERIFY OK: depth=1, CN=ChangeMe
Tue May 21 11:17:35 2019 VERIFY KU OK
Tue May 21 11:17:35 2019 Validating certificate extended key usage
Tue May 21 11:17:35 2019 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue May 21 11:17:35 2019 VERIFY EKU OK
Tue May 21 11:17:35 2019 VERIFY OK: depth=0, CN=server
Tue May 21 11:17:35 2019 Control Channel: TLSv1.2, cipher TLSv1.2 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue May 21 11:17:35 2019 [server] Peer Connection Initiated with [AF_INET]146.185.131.47:1195
Tue May 21 11:17:36 2019 MANAGEMENT: >STATE:1558426656,GET_CONFIG,,,,,,
Tue May 21 11:17:36 2019 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Tue May 21 11:17:36 2019 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0'
Tue May 21 11:17:36 2019 OPTIONS IMPORT: timers and/or timeouts modified
Tue May 21 11:17:36 2019 OPTIONS IMPORT: --ifconfig/up options modified
Tue May 21 11:17:36 2019 OPTIONS IMPORT: route options modified
Tue May 21 11:17:36 2019 OPTIONS IMPORT: route-related options modified
Tue May 21 11:17:36 2019 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue May 21 11:17:36 2019 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue May 21 11:17:36 2019 Outgoing Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue May 21 11:17:36 2019 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue May 21 11:17:36 2019 Incoming Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue May 21 11:17:36 2019 interactive service msg_channel=0
Tue May 21 11:17:36 2019 ROUTE_GATEWAY 192.168.88.1/255.255.255.0 I=19 HWADDR=70:85:c2:4a:ad:67
Tue May 21 11:17:36 2019 open_tun
Tue May 21 11:17:36 2019 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{7C1E5EB3-63FD-43A1-906C-C382376B314C}.tap
Tue May 21 11:17:36 2019 TAP-Windows Driver Version 9.21 
Tue May 21 11:17:36 2019 Set TAP-Windows TUN subnet mode network/local/netmask = 10.8.0.0/10.8.0.2/255.255.255.0 [SUCCEEDED]
Tue May 21 11:17:36 2019 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.2/255.255.255.0 on interface {7C1E5EB3-63FD-43A1-906C-C382376B314C} [DHCP-serv: 10.8.0.254, lease-time: 31536000]
Tue May 21 11:17:36 2019 Successful ARP Flush on interface [12] {7C1E5EB3-63FD-43A1-906C-C382376B314C}
Tue May 21 11:17:36 2019 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Tue May 21 11:17:36 2019 MANAGEMENT: >STATE:1558426656,ASSIGN_IP,,10.8.0.2,,,,
Tue May 21 11:17:36 2019 Block_DNS: WFP engine opened
Tue May 21 11:17:36 2019 Block_DNS: Using existing sublayer
Tue May 21 11:17:36 2019 Block_DNS: Added permit filters for exe_path
Tue May 21 11:17:36 2019 Block_DNS: Added block filters for all interfaces
Tue May 21 11:17:36 2019 Block_DNS: Added permit filters for TAP interface
Tue May 21 11:17:41 2019 TEST ROUTES: 1/1 succeeded len=0 ret=1 a=0 u/d=up
Tue May 21 11:17:41 2019 C:\WINDOWS\system32\route.exe ADD 146.185.131.47 MASK 255.255.255.255 192.168.88.1
Tue May 21 11:17:41 2019 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=35 and dwForwardType=4
Tue May 21 11:17:41 2019 Route addition via IPAPI succeeded [adaptive]
Tue May 21 11:17:41 2019 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.1
Tue May 21 11:17:41 2019 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=3 and dwForwardType=4
Tue May 21 11:17:41 2019 Route addition via IPAPI succeeded [adaptive]
Tue May 21 11:17:41 2019 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.1
Tue May 21 11:17:41 2019 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=3 and dwForwardType=4
Tue May 21 11:17:41 2019 Route addition via IPAPI succeeded [adaptive]
Tue May 21 11:17:41 2019 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue May 21 11:17:41 2019 Initialization Sequence Completed
Tue May 21 11:17:41 2019 MANAGEMENT: >STATE:1558426661,CONNECTED,SUCCESS,10.8.0.2,146.185.131.47,1195,,

Answer 1

[Виктор]

Я предположу, не может ли у вас быть пересечения подсетей?
Например, у билайна серая сеть 10.*.*.*, при подключении VPN, эта же самая сеть у вас начинает маршрутизироваться через него?

Comments

[TraVviS]

Не могли бы Вы чуть подробнее подсказать, что и где нужно проверить?

[Виктор]

Прошу вас указать
1) какая сеть на интерфейсе с билайном, адрес (если серый), маска, шлюз
2) какая сеть у вас поднимается при запуске с openVPN, адрес, маска, шлюз с вашей стороны

[TraVviS]

Виктор,

spoiler

рис.1

[Виктор]

Увидел, удалите картинки пожалуйста, на всякий случай.

Вы когда Ovpn поднимаете, у вас появляется ещё один сетевой адаптер в списке в Windows?
Можете мне скинуть его настройки, как вы делали на первом скриншоте для билайна?

[TraVviS]

Виктор, да, подключается еще одна сеть TAP Windows Adapter V9

spoiler

рис.2

[Виктор]

TraVviS, Понял, тоже можно удалять, мой вариант отпадает, подсети разные.
Послушаю умных людей )

[TraVviS]

Виктор, спасибо!

[Вит]

давайте попробуем по шагам
1. проверка, что соединение установилось
1.1 можно ли пропинговать ip адрес openvpn туннеля на стороне сервера?
1.2 что есть в логах openvpn на стороне сервера
2. при условии подтверждения 1 - что с маршрутами? вывод команды netstat -r