Mam ruter, na którym mam zainstalowanego Debiana 6. Na nim chcę zrobić VPN jako most. Wszystko działa puki nie włączę VPN.
eth0 - interfejs zewnętrzny
eth1 - interfejs wewnętrzny
fox - nazwa hostu routera
Dokładnie jest tak, jeśli vpn jest wyłączony to mam tak:
Kod: Zaznacz cały
root@fox:~# ip route
87.204.10.240/29 dev eth0 proto kernel scope link src 87.204.10.242
192.168.69.0/24 dev eth1 proto kernel scope link src 192.168.69.1
default via 87.204.10.241 dev eth0Kod: Zaznacz cały
root@fox:~# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
87.204.10.240 * 255.255.255.248 U 0 0 0 eth0
192.168.69.0 * 255.255.255.0 U 0 0 0 eth1
default 87-204-10-241.i 0.0.0.0 UG 0 0 0 eth0Kod: Zaznacz cały
root@fox:~# ip route
87.204.10.240/29 dev eth0 proto kernel scope link src 87.204.10.242
192.168.69.0/24 dev br0 proto kernel scope link src 192.168.69.1
default via 192.168.69.1 dev br0 scope link
default via 87.204.10.241 dev eth0Kod: Zaznacz cały
root@fox:~# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
87.204.10.240 * 255.255.255.248 U 0 0 0 eth0
192.168.69.0 * 255.255.255.0 U 0 0 0 br0
default fox.local 0.0.0.0 UG 0 0 0 br0
default 87.204.10.241 0.0.0.0 UG 0 0 0 eth0W firewallu mam dopisane takie regułki:
Kod: Zaznacz cały
iptables -A INPUT -p udp --dport 1194 -j ACCEPT
iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A FORWARD -i br0 -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 192.168.69.0/24 -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING -s 192.168.69.0/24 -o eth0 -j MASQUERADEPodaję konfig mostu:
Kod: Zaznacz cały
#!/bin/sh
### BEGIN INIT INFO
# Provides: bridge
# Required-Start: $remote_fs $syslog
# Required-Stop: $remote_fs $syslog
# Default-Start: 2 3 4 5
# Default-Stop:
# Short-Description: Bridge for OpenVPN
### END INIT INFO
# Define Bridge Interface
br="br0"
# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1".
tap="tap0"
# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth1"
eth_ip="192.168.69.1"
eth_netmask="255.255.255.0"
eth_broadcast="192.168.69.255"
gw="192.168.69.1"
#################################
# Set up Ethernet bridge on Linux
# Requires: bridge-utils
#################################
start_bridge () {
for t in $tap; do
openvpn --mktun --dev $t
done
brctl addbr $br
brctl addif $br $eth
for t in $tap; do
brctl addif $br $t
done
for t in $tap; do
ifconfig $t 0.0.0.0 promisc up
done
ifconfig $eth 0.0.0.0 promisc up
ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast up
route add default gw $gw $br
}
####################################
# Tear Down Ethernet bridge on Linux
####################################
stop_bridge () {
ifconfig $br down
brctl delbr $br
for t in $tap; do
openvpn --rmtun --dev $t
done
ifconfig $eth $eth_ip netmask $eth_netmask broadcast $eth_broadcast up
route add default gw $gw $eth
}
####################################
# OPTIONS
####################################
case "$1" in
start)
echo -n "Starting Bridge"
start_bridge
;;
stop)
echo -n "Stopping Bridge"
stop_bridge
;;
restart)
stop_bridge
sleep 2
start_bridge
;;
*)
# echo "Usage: $0 {start|stop|restart}" >&2
exit 1
;;
esac
Kod: Zaznacz cały
port 1194
proto udp
dev tap0
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
ifconfig-pool-persist ipp.txt
server-bridge 192.168.69.233 255.255.255.0 192.168.69.234 192.168.69.254
keepalive 10 120
comp-lzo
persist-key
persist-tun
log /var/log/openvpn.log
log-append /var/log/openvpn.log
status /var/log/openvpn-status.log
verb 3
#===================================================#
# Client Settings
#===================================================#
# If you need to push routes you can do so here for example:
#push "route 192.168.69.0 255.255.255.0 192.168.69.1"
push "ping 10"
push "ping-restart 60"
push "redirect-gateway def1"
#push "dhcp-option DOMAIN example.local"
push "dhcp-option DNS 192.168.69.1"
#push "dhcp-option DNS 83.238.255.76"
#push "dhcp-option WINS 192.168.255.1"
push "route-delay 5"
push "echo "
push "echo Welcome to the Network!"
push "echo "
Jeśli potrzeba czegoś więcej, to mówcie!
Z góry dziękuję za pomoc!