[問答] OPENVPN 設定問題

[ando5566 (販賣夢想的人)]

最近在win10架設了openVPN server, 使用中華電信非固定制ip申請固定ip

透過wifi撥號連線

另外找了一台win10電腦當client

設置好後發現client可以連線到server, 但實際去測where my ip

並非從VPN server的ip出去

以下是連線的log


2021-10-02 12:14:53 Initialization Sequence Completed
2021-10-02 12:14:53 MANAGEMENT:
>STATE:1633148093,CONNECTED,SUCCESS,10.8.0.1,,,114.32.191.84,1194
2021-10-02 12:15:29 203.74.156.241:49862 Outgoing Control Channel
Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2021-10-02 12:15:29 203.74.156.241:49862 Incoming Control Channel
Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2021-10-02 12:15:29 203.74.156.241:49862 TLS: Initial packet from
[AF_INET]203.74.156.241:49862, sid=4eeccd2a 1c02051c
2021-10-02 12:15:29 203.74.156.241:49862 VERIFY OK: depth=0, CN=client1
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_VER=3.git::98bf7f7f
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_PLAT=win
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_NCP=2
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_TCPNL=1
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_PROTO=30
2021-10-02 12:15:29 203.74.156.241:49862 peer info:
IV_CIPHERS=AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-256-CBC
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_AUTO_SESS=1
2021-10-02 12:15:29 203.74.156.241:49862 peer info:
IV_GUI_VER=OCWindows_3.3.1-2222
2021-10-02 12:15:29 203.74.156.241:49862 peer info: IV_SSO=openurl,crtext
2021-10-02 12:15:29 203.74.156.241:49862 Control Channel: TLSv1.3, cipher
TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
2021-10-02 12:15:29 203.74.156.241:49862 [client1] Peer Connection Initiated
with [AF_INET]203.74.156.241:49862
2021-10-02 12:15:29 client1/203.74.156.241:49862 MULTI_sva: pool returned
IPv4=10.8.0.6, IPv6=(Not enabled)
2021-10-02 12:15:29 client1/203.74.156.241:49862 MULTI: Learn: 10.8.0.6 ->
client1/203.74.156.241:49862
2021-10-02 12:15:29 client1/203.74.156.241:49862 MULTI: primary virtual IP
for client1/203.74.156.241:49862: 10.8.0.6
2021-10-02 12:15:29 client1/203.74.156.241:49862 Data Channel: using
negotiated cipher 'AES-256-GCM'
2021-10-02 12:15:29 client1/203.74.156.241:49862 Outgoing Data Channel:
Cipher 'AES-256-GCM' initialized with 256 bit key
2021-10-02 12:15:29 client1/203.74.156.241:49862 Incoming Data Channel:
Cipher 'AES-256-GCM' initialized with 256 bit key
2021-10-02 12:15:29 client1/203.74.156.241:49862 SENT CONTROL [client1]:
'PUSH_REPLY,route 10.8.0.0 255.255.255.0,redirect-gateway def1
bypass-dhcp,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig
10.8.0.6 10.8.0.5,peer-id 0,cipher AES-256-GCM' (status=1)
2021-10-02 12:15:29 client1/203.74.156.241:49862 PUSH: Received control
message: 'PUSH_REQUEST'




--
※ 發信站: 批踢踢實業坊(ptt.cc), 來自: 114.32.191.84 (臺灣)
※ 文章網址: https://www.ptt.cc/bbs/Network/M.1633149032.A.9DA.html
→ ando5566: 謝謝回答
→ deadwood: 你沒設定full-tunnel吧,route 10.8.0.0 255.255.255.0
→ deadwood: 這就表示只有10.8.0.0/24的流量會進VPN
→ deadwood: 還有，你的server如何把VPN 進來的流量NAT出去?
→ deadwood: windows 10可不像 windows server可以直接設定NAT
→ ando5566: 我用Ubuntu 架設server，是否能避免此問題？
→ deadwood: 應該可以，畢竟linux內建iptables可以做NAT
→ deadwood: 不過我建議用softether vpn在windows上架VPN比較簡單
→ deadwood: VPN server軟體內建NAT功能，也支援openvpn client連線