OpenVPN 连接有效但未分配网关

Question

我尝试在 vps 上设置 openvpn 并且我能够建立到服务器的连接，但是网关没有分配给客户端。

这是我的配置文件：

客户端配置：

client
dev tun
proto udp
remote foo.bar 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
redirect-gateway
comp-lzo
verb 3
pull

服务器配置：

port 1194
proto udp
dev tun
ca easy-rsa/2.0/keys/ca.crt
cert easy-rsa/2.0/keys/server.crt
key easy-rsa/2.0/keys/server.key
dh easy-rsa/2.0/keys/dh2048.pem
server 172.30.90.0 255.255.255.192
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
keepalive 10 120
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
log-append openvpn.log
verb 3

ifconfig 客户端：

tun0: flags=8851<UP,POINTOPOINT,RUNNING,SIMPLEX,MULTICAST> mtu 1500
inet 172.30.90.6 --> 172.30.90.5 netmask 0xffffffff
open (pid 42823)

服务器上的 iptables 规则：

iptables -L

Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
ACCEPT udp -- anywhere anywhere state NEW udp dpt:openvpn
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
target prot opt source destination
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target prot opt source destination 

我想通过 VPN 路由整个流量。我已经添加了重定向网关，所以它应该可以工作。我真的看不出这里有什么问题，我希望你能帮助我解决这个问题。

谢谢！

Answer 1

连接VPN后，在客户端执行route -nor命令netstat -rn，查看是否分配了网关地址。

检查您是否已执行以下操作：

在服务器上：

将网关推送到客户端：

将其添加到文件：/etc/openvpn/server.conf

push "redirect-gateway def1"

将其添加到文件：/etc/sysctl.conf

net.ipv4.ip_forward=1

或者发出以下命令为当前会话设置此变量：

echo 1 > /proc/sys/net/ipv4/ip_forward

发出以下命令来配置 iptables 以通过 VPN 正确转发流量：

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s [vpn client subnet] -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s [vpn client subnet] -o eth0 -j MASQUERADE

来源