openvpn不改变IP地址

Question

我在我的 ubuntu 笔记本电脑上设置了 openvpn VPN，一切似乎都工作正常，但是当我连接时，我的 IP 地址没有改变。我尝试在我的 Mac 上使用相同的过程（使用第三方软件加载 client.ovpn），一切正常。您能帮助了解出了什么问题吗？如果我打开终端并从 openvpn 客户端连接，这是我收到的完整消息：

Mon Jan  7 11:53:59 2019 OpenVPN 2.4.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Sep  5 2018
Mon Jan  7 11:53:59 2019 library versions: OpenSSL 1.1.0g  2 Nov 2017, LZO 2.08
Mon Jan  7 11:53:59 2019 WARNING: --ns-cert-type is DEPRECATED.  Use --remote-cert-tls instead.
Mon Jan  7 11:53:59 2019 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jan  7 11:53:59 2019 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jan  7 11:53:59 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]185.21.216.152:1194
Mon Jan  7 11:53:59 2019 Socket Buffers: R=[212992->212992] S=[212992->212992]
Mon Jan  7 11:53:59 2019 UDP link local: (not bound)
Mon Jan  7 11:53:59 2019 UDP link remote: [AF_INET]185.21.216.152:1194
Mon Jan  7 11:53:59 2019 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Mon Jan  7 11:53:59 2019 TLS: Initial packet from [AF_INET]185.21.216.152:1194, sid=75702836 ec665d46
Mon Jan  7 11:53:59 2019 VERIFY OK: depth=1, C=UK, ST=Ceredigion, L=Aberystwyth, O=Feral Hosting, CN=Feral Hosting CA, emailAddress=support@feralhosting.com
Mon Jan  7 11:53:59 2019 VERIFY OK: nsCertType=SERVER
Mon Jan  7 11:53:59 2019 VERIFY OK: depth=0, C=UK, ST=Ceredigion, L=Aberystwyth, O=Feral Hosting, CN=nyx, emailAddress=support@feralhosting.com
Mon Jan  7 11:53:59 2019 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Mon Jan  7 11:53:59 2019 [nyx] Peer Connection Initiated with [AF_INET]185.21.216.152:1194
Mon Jan  7 11:54:00 2019 SENT CONTROL [nyx]: 'PUSH_REQUEST' (status=1)
Mon Jan  7 11:54:00 2019 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.32.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.32.0.90 10.32.0.89,peer-id 3,cipher AES-256-GCM'
Mon Jan  7 11:54:00 2019 OPTIONS IMPORT: timers and/or timeouts modified
Mon Jan  7 11:54:00 2019 OPTIONS IMPORT: --ifconfig/up options modified
Mon Jan  7 11:54:00 2019 OPTIONS IMPORT: route options modified
Mon Jan  7 11:54:00 2019 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mon Jan  7 11:54:00 2019 OPTIONS IMPORT: peer-id set
Mon Jan  7 11:54:00 2019 OPTIONS IMPORT: adjusting link_mtu to 1625
Mon Jan  7 11:54:00 2019 OPTIONS IMPORT: data channel crypto options modified
Mon Jan  7 11:54:00 2019 Data Channel: using negotiated cipher 'AES-256-GCM'
Mon Jan  7 11:54:00 2019 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Mon Jan  7 11:54:00 2019 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Mon Jan  7 11:54:00 2019 ROUTE_GATEWAY 192.168.0.1/255.255.255.0 IFACE=wlp2s0 HWADDR=20:16:d8:c7:61:09
Mon Jan  7 11:54:00 2019 TUN/TAP device tun0 opened
Mon Jan  7 11:54:00 2019 TUN/TAP TX queue length set to 100
Mon Jan  7 11:54:00 2019 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Mon Jan  7 11:54:00 2019 /sbin/ip link set dev tun0 up mtu 1500
Mon Jan  7 11:54:00 2019 /sbin/ip addr add dev tun0 local 10.32.0.90 peer 10.32.0.89
Mon Jan  7 11:54:00 2019 /sbin/ip route add 185.21.216.152/32 via 192.168.0.1
Mon Jan  7 11:54:00 2019 /sbin/ip route add 0.0.0.0/1 via 10.32.0.89
Mon Jan  7 11:54:00 2019 /sbin/ip route add 128.0.0.0/1 via 10.32.0.89
Mon Jan  7 11:54:00 2019 /sbin/ip route add 10.32.0.1/32 via 10.32.0.89
Mon Jan  7 11:54:00 2019 GID set to nogroup
Mon Jan  7 11:54:00 2019 UID set to nobody
Mon Jan  7 11:54:00 2019 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Mon Jan  7 11:54:00 2019 Initialization Sequence Complete

客户端配置文件与我在 Mac 上使用的相同，因此应该正确填充。

我正在使用的client.ovpn文件如下：

client
dev tun
remote <myhostdomain> 1194
proto udp
resolv-retry infinite
nobind

# On non-Windows systems, please uncomment the following for added security:
user nobody
group nogroup

persist-key
persist-tun

ca keys/ca.crt
cert keys/myuser.crt
key keys/myuser.key
tls-auth keys/tls-auth.key 1

ns-cert-type server
comp-lzo

# Log file verbosity
verb 3
# Silence repeating messages
mute 20

有任何想法吗？

谢谢

ls -al /etc/resolv.conf 的输出：

lrwxrwxrwx 1 root root 39 Jan  7 09:14 /etc/resolv.conf -> ../run/systemd/resolve/stub-resolv.conf

cat /etc/resolv.conf 的输出：

# This file is managed by man:systemd-resolved(8). Do not edit.
#
# This is a dynamic resolv.conf file for connecting local clients to the
# internal DNS stub resolver of systemd-resolved. This file lists all
# configured search domains.
#
# Run "systemd-resolve --status" to see details about the uplink DNS servers
# currently in use.
#
# Third party programs must not access this file directly, but only through the
# symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a different way,
# replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 127.0.0.53
search Home

ps auxc 的输出 | grep -i dns ：根本没有输出

ps auxc 的输出 | grep -i 解决：

systemd+   612  0.0  0.0  71120  2440 ?        Ss   17:39   0:09 systemd-resolve

Answer 1

您的符号链接/etc/resolv.conf不正确。

ls -al /etc/resolv.conf 向我们展示：

resolv.conf -> ../run/systemd/resolve/stub-resolv.conf

这是不正确的。它应该指向 resolv.conf，如下所示：

resolv.conf -> /run/systemd/resolve/resolv.conf

所以...

sudo rm -i /etc/resolv.conf # remove the incorrect symlink

sudo ln -s /run/systemd/resolve/resolv.conf /etc/resolv.conf # recreate it correctly

然后确保ls -al /etc/resolv.conf看起来正确。cat /etc/resolv.conf应该显示与之前不同的结果...可能是 192.168.x.1（您的路由器）或另一个 dns 服务器地址（可能来自您的 VPN 提供商）。

更新#1：

将其添加到 .ovpn 文件末尾，然后sudo openvpn client_file查看 /etc/resolv.conf 在使用/不使用 VPN 的情况下是否会发生变化。

script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

更新#2：

Ubuntu 18.xx 中的 DNS 混乱。从终端命令行启动与通过网络管理器启动相比，OpenVPN 的行为有所不同。

按照我之前的说明，对 /etc/resolv.conf 符号链接进行更改，并将向上/向下脚本更改添加到 .ovpn 文件中。

此时，如果您使用sudo openvpn client.ovpn，将创建 VPN 隧道，但 /etc/resolv.conf 将无法正确更新，并且您将出现 dns 泄漏。DNS 泄漏可以在http://dnsleak.com或http://dnsleaktest.com上查看。

通过键入 来观察 /etc/resolv.conf 的内容cat /etc/resolv.conf。它可能包含类似于 192.168.x.1 的内容，即路由器的地址。

创建新的网络管理器 VPN 连接脚本。像这样导入您的 .ovpn 文件：

添加导入的脚本后，通过转到网络管理器菜单（顶部面板，右上角）连接到所需的 VPN 服务器，选择 VPN，然后选择您之前添加的 VPN 连接脚本。

再次观察 /etc/resolv.conf 的内容，它现在应该包含 VPN DNS 服务器的 IP 地址。

转到http://dnsleak.com，确认它正确显示您的新 IP 地址，然后单击“开始”按钮以确认您没有任何 dns 泄漏。