Forum Domoticz en français

bonjour,
es que quelqu'un a un tuto pour faire un vpn via openvpn sur RPi qui a marché pour lui car j'ai pris 15 tuto sur le net et ils ne marchent pas alors que dans les log il n'y a aucune erreurs, je pense que mon problème vient du route.

serveur (rpi):

Code : Tout sélectionner

local 192.168.10.50
#mode server
dev tun
proto udp
port 1194

ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
cipher AES-128-CBC # algorithme de chiffrement
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0 # 0 pour le serveur

server 10.8.0.0 255.255.255.0
ifconfig 10.8.0.1 10.8.0.2

push "route 10.8.0.1 255.255.255.255"
push "route 10.8.0.0 255.255.255.0"

push "route 192.168.10.50 255.255.255.0"
push "redirect-gateway def1"

#set the dns servers
#push "dhcp-option DNS 8.8.8.8"
#push "dhcp-option DNS 8.8.4.4"
push "dhcp-option DNS 192.168.10.1"

user nobody
group nogroup
#chroot /etc/openvpn/jail # chroot de openvpn
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 3
mute 20
client-to-client
log-append /var/log/openvpn.log
comp-lzo
duplicate-cn
keepalive 10 120

log

Code : Tout sélectionner

Fri Jun 12 11:45:29 2015 OpenVPN 2.2.1 arm-linux-gnueabihf [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built$
Fri Jun 12 11:45:29 2015 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing $
Fri Jun 12 11:45:29 2015 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Fri Jun 12 11:45:29 2015 Diffie-Hellman initialized with 1024 bit key
Fri Jun 12 11:45:29 2015 Control Channel Authentication: using '/etc/openvpn/easy-rsa/keys/ta.key' as a OpenVPN static key file
Fri Jun 12 11:45:29 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jun 12 11:45:29 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jun 12 11:45:30 2015 TLS-Auth MTU parms [ L:18 D:14 EF:8 EB:15 ET:0 EL:250 ]
Fri Jun 12 11:45:30 2015 Socket Buffers: R=[163840->131072] S=[163840->131072]
Fri Jun 12 11:45:30 2015 ROUTE default_gateway=192.168.10.1
Fri Jun 12 11:45:30 2015 TUN/TAP device tun0 opened
Fri Jun 12 11:45:30 2015 TUN/TAP TX queue length set to 100
Fri Jun 12 11:45:30 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Jun 12 11:45:30 2015 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Fri Jun 12 11:45:30 2015 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Fri Jun 12 11:45:30 2015 Data Channel MTU parms [ L:18 D:14 EF:8 EB:15 ET:0 EL:250 AF:13/1 ]
Fri Jun 12 11:45:30 2015 GID set to nogroup
Fri Jun 12 11:45:30 2015 UID set to nobody
Fri Jun 12 11:45:30 2015 UDPv4 link local (bound): [AF_INET]192.168.10.50:1194
Fri Jun 12 11:45:30 2015 UDPv4 link remote: [undef]
Fri Jun 12 11:45:30 2015 MULTI: multi_init called, r=256 v=256
Fri Jun 12 11:45:30 2015 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Fri Jun 12 11:45:30 2015 Initialization Sequence Completed

iptables

Code : Tout sélectionner

#!/bin/sh
#iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 192.168.10.50

IPT="/sbin/iptables"

# Flush old rules, old custom tables
$IPT --flush
$IPT --delete-chain

# Set default policies for all three default chains
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT DROP

# Enable free use of loopback interfaces
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT

# Accept inbound TCP packets
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Accept inbound UDP packets for OPENVPN
$IPT -A INPUT -p udp --dport 1194 -j ACCEPT

# Accept all trafic from LAN
$IPT -A INPUT -p udp -s 192.168.1.0/24 -j ACCEPT
$IPT -A INPUT -p tcp -s 192.168.1.0/24 -j ACCEPT

# Accept all trafic from VPN
$IPT -A INPUT -p udp -s 10.8.0.0/24 -j ACCEPT
$IPT -A INPUT -p tcp -s 10.8.0.0/24 -j ACCEPT

#Autoriser toutes les sorties
$IPT -A OUTPUT -p tcp -j ACCEPT
$IPT -A OUTPUT -p udp -j ACCEPT

#Accept openvpn connections
$IPT -t nat -A INPUT -i eth0 -p udp -m udp --dport 1194 -j ACCEPT

# Allow TUN interface connections to OpenVPN server
$IPT -A INPUT -i tun+ -j ACCEPT

$IPT -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A FORWARD -s 10.8.0.0/24 -j ACCEPT
$IPT -A FORWARD -j REJECT
$IPT -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

echo 1 > /proc/sys/net/ipv4/ip_forward

client (windows)

Code : Tout sélectionner

client
dev tun
proto udp
remote REMOTE 1194
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings 
ns-cert-type server 
key-direction 1 
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\client.crt"
key "C:\\Program Files\\OpenVPN\\config\\client.key"
tls-auth "C:\\Program Files\\OpenVPN\\config\\ta.key" 1 #1 pour le client
cipher AES-128-CBC
comp-lzo
verb 3
mute 20

log

Code : Tout sélectionner

Fri Jun 12 13:01:33 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Mar  4 2015
Fri Jun 12 13:01:33 2015 library versions: OpenSSL 1.0.1l 15 Jan 2015, LZO 2.08
Fri Jun 12 13:01:33 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Fri Jun 12 13:01:33 2015 Need hold release from management interface, waiting...
Fri Jun 12 13:01:33 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Fri Jun 12 13:01:33 2015 MANAGEMENT: CMD 'state on'
Fri Jun 12 13:01:33 2015 MANAGEMENT: CMD 'log all on'
Fri Jun 12 13:01:33 2015 MANAGEMENT: CMD 'hold off'
Fri Jun 12 13:01:33 2015 MANAGEMENT: CMD 'hold release'
Fri Jun 12 13:01:34 2015 Control Channel Authentication: using 'C:\Program Files\OpenVPN\config\ta.key' as a OpenVPN static key file
Fri Jun 12 13:01:34 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jun 12 13:01:34 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jun 12 13:01:34 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]
Fri Jun 12 13:01:34 2015 MANAGEMENT: >STATE:14341894,RESOLVE,,,
Fri Jun 12 13:01:34 2015 UDPv4 link local: [undef]
Fri Jun 12 13:01:34 2015 UDPv4 link remote: [AF_INET]REMOTE:1194
Fri Jun 12 13:01:34 2015 MANAGEMENT: >STATE:14341894,WAIT,,,
Fri Jun 12 13:02:34 2015 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Fri Jun 12 13:02:34 2015 TLS Error: TLS handshake failed
Fri Jun 12 13:02:34 2015 SIGUSR1[soft,tls-error] received, process restarting
Fri Jun 12 13:02:34 2015 MANAGEMENT: >STATE:14341894,RECONNECTING,tls-error,,
Fri Jun 12 13:02:34 2015 Restart pause, 2 second(s)
Fri Jun 12 13:02:36 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]
Fri Jun 12 13:02:36 2015 MANAGEMENT: >STATE:14341894,RESOLVE,,,
Fri Jun 12 13:02:36 2015 UDPv4 link local: [undef]
Fri Jun 12 13:02:36 2015 UDPv4 link remote: [AF_INET]REMOTE:1194
Fri Jun 12 13:02:36 2015 MANAGEMENT: >STATE:1434107456,WAIT,,,

port 1194 ouverts et redirigés dans la box

je sais pas pour ca ne marche pas ??????

Salut,

Est ce qu'en local ca fonctionne déjà ?

je ping le server sur le rpi

que veux tu dire en local ?

ton client (Windows ? ) ne parvient pas à atteindre ton serveur OpenVPN, sur le port 1194
es-tu sûr d'avoir routé le protocole UDP 1194, sur ton routeur ?

vil1driver souhaite savoir si tu arrives à établir un VPN entre un PC branché sur ton LAN, et le serveur RPi ( sans avoir besoin du routage de la box ) ?

oui port 1194 udp bien ouvert

ping PC local 192.xxx -> rpi vpn 10.8.0.1 => echec

le ping indique seulement que ton RPi est connecté au réseau,

pour appeler le serveur OpenVPN, tu dois utiliser l'adresse 192.168..... de ton RPi ( et non l'adresse 10.0...... )

mais en l'occurence, si tu ne peux ouvrir de VPN, c'est que le serveur OpenVPN n'est pas actif sur ton RPi

le reseau local marche (connexion ssh)
le ping du vpn 10.8.0.1 marche

Désolé, je n'arrive pas à te suivre : 3 posts + haut, tu dis 'échec' , et maintenant tu dis 'ça marche' ....

Non le Ping du rpi sur le vpn (même machine ) donc le serveur vpn a l'air de marcher

bon cela ne marche toujours pas.
Vous savez si il y a des logs de connexions (entrante/sortante) ?

mon ifconfig du tunnel :

Code : Tout sélectionner

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet adr:10.8.0.1  P-t-P:10.8.0.2  Masque:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 lg file transmission:100
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

mon ping:

Code : Tout sélectionner

pi@raspberrypi /var/log $ ping 10.8.0.1
PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
64 bytes from 10.8.0.1: icmp_req=1 ttl=64 time=0.228 ms
64 bytes from 10.8.0.1: icmp_req=2 ttl=64 time=0.179 ms
64 bytes from 10.8.0.1: icmp_req=3 ttl=64 time=0.288 ms
64 bytes from 10.8.0.1: icmp_req=4 ttl=64 time=0.188 ms
64 bytes from 10.8.0.1: icmp_req=5 ttl=64 time=0.229 ms
64 bytes from 10.8.0.1: icmp_req=6 ttl=64 time=0.187 ms
64 bytes from 10.8.0.1: icmp_req=7 ttl=64 time=0.175 ms
^C
--- 10.8.0.1 ping statistics ---
7 packets transmitted, 7 received, 0% packet loss, time 6001ms
rtt min/avg/max/mdev = 0.175/0.210/0.288/0.040 ms

Forum Domoticz en français

OpenVpn

OpenVpn

Re: OpenVpn

Re: OpenVpn

Re: OpenVpn

Re: OpenVpn

Re: OpenVpn

Re: OpenVpn

Re: OpenVpn

Re: OpenVpn

Re: OpenVpn