OpenVPN et problème de "gateway-redirect"

OpenVPN et problème de "gateway-redirect" - réseaux et sécurité - Linux et OS Alternatifs

Marsh Posté le 31-05-2007 à 15:45:53    


 
Bonjour à tous.
 
Voilà, j'ai installé un serveur OpenVPN sur Linux. Tout fonctionnait bien et à l'heure actuelle tout fonctionne bien... A peu de chose près. Voilà mon installation est pour l'instant très simple, j'ai un client, un serveur, et entre deux deux ou trois routeurs qui ne font rien d'autre que router (jusque là tout va bien smile ).
 
le soucis que j'ai à l'heure actuelle est celui-ci. Je voudrais que toutes les communications de mon client passe par le VPN vers mon serveur VPN, qui lui relayera vers l'Internet par derrière. Donc pour cela, mon serveur VPN doit être la route par défaut du client. Cela est possible grâce à l'option "gateway-redirect" du fichier de conf du serveur VPN. J'ai activé cette option, effectivement la gateway par défaut du client est changée... Mais pas par l'adresse du serveur VPN !!! LE serveur VPN (avec comme adresse 10.8.0.1) envoie au client : "voici ta gateway par défaut : 10.8.0.5" (ça varie, des fois il lui dit 10.8.0.9.ou .10 ou... Selon ses envies). Or, ces adresses n'existent pas sur mon réseau, je rappelle j'ai basiquement un client un serveur quelques routeurs au milieu en 192.168.x.x et c'est tout. Avant tout fonctionnait bien, le serveur envoyait au client : "c'est moi ta gateway 10.8.0.1", maintenant il lui envoie une adresse foireuse... :'( quelqu'un aurait une idée ? Voici au cas où les fichiers de conf de mon serveur et de mon client :
 
 
Serveur :
 

Code :
  1. #################################################
  2. # Sample OpenVPN 2.0 config file for            #
  3. # multi-client server.                          #
  4. #                                               #
  5. # This file is for the server side              #
  6. # of a many-clients <-> one-server              #
  7. # OpenVPN configuration.                        #
  8. #                                               #
  9. # OpenVPN also supports                         #
  10. # single-machine <-> single-machine             #
  11. # configurations (See the Examples page         #
  12. # on the web site for more info).               #
  13. #                                               #
  14. # This config should work on Windows            #
  15. # or Linux/BSD systems.  Remember on            #
  16. # Windows to quote pathnames and use            #
  17. # double backslashes, e.g.:                     #
  18. # "C:\\Program Files\\OpenVPN\\config\\foo.key" #
  19. #                                               #
  20. # Comments are preceded with '#' or ';'         #
  21. #################################################
  23. # Which local IP address should OpenVPN
  24. # listen on? (optional)
  25. ;local a.b.c.d
  27. # Which TCP/UDP port should OpenVPN listen on?
  28. # If you want to run multiple OpenVPN instances
  29. # on the same machine, use a different port
  30. # number for each one.  You will need to
  31. # open up this port on your firewall.
  32. port 1194
  34. # TCP or UDP server?
  35. ;proto tcp
  36. proto udp
  38. # "dev tun" will create a routed IP tunnel,
  39. # "dev tap" will create an ethernet tunnel.
  40. # Use "dev tap0" if you are ethernet bridging
  41. # and have precreated a tap0 virtual interface
  42. # and bridged it with your ethernet interface.
  43. # If you want to control access policies
  44. # over the VPN, you must create firewall
  45. # rules for the the TUN/TAP interface.
  46. # On non-Windows systems, you can give
  47. # an explicit unit number, such as tun0.
  48. # On Windows, use "dev-node" for this.
  49. # On most systems, the VPN will not function
  50. # unless you partially or fully disable
  51. # the firewall for the TUN/TAP interface.
  52. ;dev tap
  53. dev tun
  55. # Windows needs the TAP-Win32 adapter name
  56. # from the Network Connections panel if you
  57. # have more than one.  On XP SP2 or higher,
  58. # you may need to selectively disable the
  59. # Windows firewall for the TAP adapter.
  60. # Non-Windows systems usually don't need this.
  61. ;dev-node MyTap
  63. # SSL/TLS root certificate (ca), certificate
  64. # (cert), and private key (key).  Each client
  65. # and the server must have their own cert and
  66. # key file.  The server and all clients will
  67. # use the same ca file.
  68. #
  69. # See the "easy-rsa" directory for a series
  70. # of scripts for generating RSA certificates
  71. # and private keys.  Remember to use
  72. # a unique Common Name for the server
  73. # and each of the client certificates.
  74. #
  75. # Any X509 key management system can be used.
  76. # OpenVPN can also use a PKCS #12 formatted key file
  77. # (see "pkcs12" directive in man page).
  78. ca ca.crt
  79. cert VPNserver.crt
  80. key VPNserver.key  # This file should be kept secret
  82. # Diffie hellman parameters.
  83. # Generate your own with:
  84. #   openssl dhparam -out dh1024.pem 1024
  85. # Substitute 2048 for 1024 if you are using
  86. # 2048 bit keys.
  87. dh dh1024.pem
  89. # Configure server mode and supply a VPN subnet
  90. # for OpenVPN to draw client addresses from.
  91. # The server will take 10.8.0.1 for itself,
  92. # the rest will be made available to clients.
  93. # Each client will be able to reach the server
  94. # on 10.8.0.1. Comment this line out if you are
  95. # ethernet bridging. See the man page for more info.
  97. server 10.8.0.0 255.255.255.0
  99. # Maintain a record of client <-> virtual IP address
  100. # associations in this file.  If OpenVPN goes down or
  101. # is restarted, reconnecting clients can be assigned
  102. # the same virtual IP address from the pool that was
  103. # previously assigned.
  104. ifconfig-pool-persist ipp.txt
  106. # Configure server mode for ethernet bridging.
  107. # You must first use your OS's bridging capability
  108. # to bridge the TAP interface with the ethernet
  109. # NIC interface.  Then you must manually set the
  110. # IP/netmask on the bridge interface, here we
  111. # assume 10.8.0.4/255.255.255.0.  Finally we
  112. # must set aside an IP range in this subnet
  113. # (start=10.8.0.50 end=10.8.0.100) to allocate
  114. # to connecting clients.  Leave this line commented
  115. # out unless you are ethernet bridging.
  116. ;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
  118. # Push routes to the client to allow it
  119. # to reach other private subnets behind
  120. # the server.  Remember that these
  121. # private subnets will also need
  122. # to know to route the OpenVPN client
  123. # address pool (10.8.0.0/255.255.255.0)
  124. # back to the OpenVPN server.
  125. ;push "route 192.168.0.0 255.255.255.0"
  126. ;push "route 192.168.20.0 255.255.255.0"
  128. # To assign specific IP addresses to specific
  129. # clients or if a connecting client has a private
  130. # subnet behind it that should also have VPN access,
  131. # use the subdirectory "ccd" for client-specific
  132. # configuration files (see man page for more info).
  134. # EXAMPLE: Suppose the client
  135. # having the certificate common name "Thelonious"
  136. # also has a small subnet behind his connecting
  137. # machine, such as 192.168.40.128/255.255.255.248.
  138. # First, uncomment out these lines:
  139. ;client-config-dir ccd
  140. ;route 192.168.40.128 255.255.255.248
  141. # Then create a file ccd/Thelonious with this line:
  142. #   iroute 192.168.40.128 255.255.255.248
  143. # This will allow Thelonious' private subnet to
  144. # access the VPN.  This example will only work
  145. # if you are routing, not bridging, i.e. you are
  146. # using "dev tun" and "server" directives.
  148. # EXAMPLE: Suppose you want to give
  149. # Thelonious a fixed VPN IP address of 10.9.0.1.
  150. # First uncomment out these lines:
  151. ;client-config-dir ccd
  152. ;route 10.9.0.0 255.255.255.252
  153. # Then add this line to ccd/Thelonious:
  154. #   ifconfig-push 10.9.0.1 10.9.0.2
  156. # Suppose that you want to enable different
  157. # firewall access policies for different groups
  158. # of clients.  There are two methods:
  159. # (1) Run multiple OpenVPN daemons, one for each
  160. #     group, and firewall the TUN/TAP interface
  161. #     for each group/daemon appropriately.
  162. # (2) (Advanced) Create a script to dynamically
  163. #     modify the firewall in response to access
  164. #     from different clients.  See man
  165. #     page for more info on learn-address script.
  166. ;learn-address ./script
  168. # If enabled, this directive will configure
  169. # all clients to redirect their default
  170. # network gateway through the VPN, causing
  171. # all IP traffic such as web browsing and
  172. # and DNS lookups to go through the VPN
  173. # (The OpenVPN server machine may need to NAT
  174. # the TUN/TAP interface to the internet in
  175. # order for this to work properly).
  176. # CAVEAT: May break client's network config if
  177. # client's local DHCP server packets get routed
  178. # through the tunnel.  Solution: make sure
  179. # client's local DHCP server is reachable via
  180. # a more specific route than the default route
  181. # of 0.0.0.0/0.0.0.0.
  183. push "redirect-gateway"
  185. # Certain Windows-specific network settings
  186. # can be pushed to clients, such as DNS
  187. # or WINS server addresses.  CAVEAT:
  188. # http://openvpn.net/faq.html#dhcpcaveats
  189. ;push "dhcp-option DNS 10.8.0.1"
  190. ;push "dhcp-option WINS 10.8.0.1"
  192. # Uncomment this directive to allow different
  193. # clients to be able to "see" each other.
  194. # By default, clients will only see the server.
  195. # To force clients to only see the server, you
  196. # will also need to appropriately firewall the
  197. # server's TUN/TAP interface.
  198. ;client-to-client
  200. # Uncomment this directive if multiple clients
  201. # might connect with the same certificate/key
  202. # files or common names.  This is recommended
  203. # only for testing purposes.  For production use,
  204. # each client should have its own certificate/key
  205. # pair.
  206. #
  207. # IF YOU HAVE NOT GENERATED INDIVIDUAL
  208. # CERTIFICATE/KEY PAIRS FOR EACH CLIENT,
  209. # EACH HAVING ITS OWN UNIQUE "COMMON NAME",
  210. # UNCOMMENT THIS LINE OUT.
  211. ;duplicate-cn
  213. # The keepalive directive causes ping-like
  214. # messages to be sent back and forth over
  215. # the link so that each side knows when
  216. # the other side has gone down.
  217. # Ping every 10 seconds, assume that remote
  218. # peer is down if no ping received during
  219. # a 120 second time period.
  220. keepalive 10 120
  222. # For extra security beyond that provided
  223. # by SSL/TLS, create an "HMAC firewall"
  224. # to help block DoS attacks and UDP port flooding.
  225. #
  226. # Generate with:
  227. #   openvpn --genkey --secret ta.key
  228. #
  229. # The server and each client must have
  230. # a copy of this key.
  231. # The second parameter should be '0'
  232. # on the server and '1' on the clients.
  233. ;tls-auth ta.key 0 # This file is secret
  235. # Select a cryptographic cipher.
  236. # This config item must be copied to
  237. # the client config file as well.
  238. ;cipher BF-CBC        # Blowfish (default)
  239. ;cipher AES-128-CBC   # AES
  240. ;cipher DES-EDE3-CBC  # Triple-DES
  242. # Enable compression on the VPN link.
  243. # If you enable it here, you must also
  244. # enable it in the client config file.
  245. comp-lzo
  247. # The maximum number of concurrently connected
  248. # clients we want to allow.
  249. ;max-clients 100
  251. # It's a good idea to reduce the OpenVPN
  252. # daemon's privileges after initialization.
  253. #
  254. # You can uncomment this out on
  255. # non-Windows systems.
  256. ;user nobody
  257. ;group nogroup
  258. user openvpn
  259. group openvpn
  261. # The persist options will try to avoid
  262. # accessing certain resources on restart
  263. # that may no longer be accessible because
  264. # of the privilege downgrade.
  265. persist-key
  266. persist-tun
  268. # Output a short status file showing
  269. # current connections, truncated
  270. # and rewritten every minute.
  271. status openvpn-status.log
  273. # By default, log messages will go to the syslog (or
  274. # on Windows, if running as a service, they will go to
  275. # the "\Program Files\OpenVPN\log" directory).
  276. # Use log or log-append to override this default.
  277. # "log" will truncate the log file on OpenVPN startup,
  278. # while "log-append" will append to it.  Use one
  279. # or the other (but not both).
  280. ;log         openvpn.log
  281. ;log-append  openvpn.log
  283. # Set the appropriate level of log
  284. # file verbosity.
  285. #
  286. # 0 is silent, except for fatal errors
  287. # 4 is reasonable for general usage
  288. # 5 and 6 can help to debug connection problems
  289. # 9 is extremely verbose
  290. verb 3
  292. # Silence repeating messages.  At most 20
  293. # sequential messages of the same message
  294. # category will be output to the log.
  295. ;mute 20


 
Client :
 

Code :
  1. ##############################################
  2. # Sample client-side OpenVPN 2.0 config file #
  3. # for connecting to multi-client server.     #
  4. #                                            #
  5. # This configuration can be used by multiple #
  6. # clients, however each client should have   #
  7. # its own cert and key files.                #
  8. #                                            #
  9. # On Windows, you might want to rename this  #
  10. # file so it has a .ovpn extension           #
  11. ##############################################
  13. # Specify that we are a client and that we
  14. # will be pulling certain config file directives
  15. # from the server.
  17. client
  19. # Use the same setting as you are using on
  20. # the server.
  21. # On most systems, the VPN will not function
  22. # unless you partially or fully disable
  23. # the firewall for the TUN/TAP interface.
  25. ;dev tap
  26. dev tun
  28. # Windows needs the TAP-Win32 adapter name
  29. # from the Network Connections panel
  30. # if you have more than one.  On XP SP2,
  31. # you may need to disable the firewall
  32. # for the TAP adapter.
  34. ;dev-node MyTap
  36. # Are we connecting to a TCP or
  37. # UDP server?  Use the same setting as
  38. # on the server.
  40. ;proto tcp
  41. proto udp
  43. # The hostname/IP and port of the server.
  44. # You can have multiple remote entries
  45. # to load balance between the servers.
  47. remote 192.168.100.10 1194
  48. ;remote my-server-2 1194
  50. # Choose a random host from the remote
  51. # list for load-balancing.  Otherwise
  52. # try hosts in the order specified.
  54. ;remote-random
  56. # Keep trying indefinitely to resolve the
  57. # host name of the OpenVPN server.  Very useful
  58. # on machines which are not permanently connected
  59. # to the internet such as laptops.
  61. resolv-retry infinite
  63. # Most clients don't need to bind to
  64. # a specific local port number.
  66. nobind
  68. # Downgrade privileges after initialization (non-Windows only)
  70. ;user nobody
  71. ;group nobody
  73. # Try to preserve some state across restarts.
  75. persist-key
  76. persist-tun
  78. # If you are connecting through an
  79. # HTTP proxy to reach the actual OpenVPN
  80. # server, put the proxy server/IP and
  81. # port number here.  See the man page
  82. # if your proxy server requires
  83. # authentication.
  85. ;http-proxy-retry # retry on connection failures
  86. ;http-proxy [proxy server] [proxy port #]
  88. # Wireless networks often produce a lot
  89. # of duplicate packets.  Set this flag
  90. # to silence duplicate packet warnings.
  92. ;mute-replay-warnings
  94. # SSL/TLS parms.
  95. # See the server config file for more
  96. # description.  It's best to use
  97. # a separate .crt/.key file pair
  98. # for each client.  A single ca
  99. # file can be used for all clients.
  101. ca ca.crt
  103. cert Client02.crt
  105. key Client02.key
  107. # Verify server certificate by checking
  108. # that the certicate has the nsCertType
  109. # field set to "server".  This is an
  110. # important precaution to protect against
  111. # a potential attack discussed here:
  112. #  http://openvpn.net/howto.html#mitm
  113. #
  114. # To use this feature, you will need to generate
  115. # your server certificates with the nsCertType
  116. # field set to "server".  The build-key-server
  117. # script in the easy-rsa folder will do this.
  119. ;ns-cert-type server
  121. # If a tls-auth key is used on the server
  122. # then every client must also have the key.
  124. ;tls-auth ta.key 1
  126. # Select a cryptographic cipher.
  127. # If the cipher option is used on the server
  128. # then you must also specify it here.
  130. ;cipher x
  132. # Enable compression on the VPN link.
  133. # Don't enable this unless it is also
  134. # enabled in the server config file.
  136. comp-lzo
  138. # Set log file verbosity.
  140. verb 3
  142. # Silence repeating messages
  144. ;mute 20


 
 
Logs affichés sur le client :
 

Code :
  1. Wed May 30 10:01:38 2007 OpenVPN 2.0.5 Win32-MinGW [SSL] [LZO] built on Nov  2 2005
  2. Wed May 30 10:01:38 2007 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
  3. Wed May 30 10:01:38 2007 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
  4. Wed May 30 10:01:38 2007 LZO compression initialized
  5. Wed May 30 10:01:38 2007 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
  6. Wed May 30 10:01:38 2007 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
  7. Wed May 30 10:01:38 2007 Local Options hash (VER=V4): '41690919'
  8. Wed May 30 10:01:38 2007 Expected Remote Options hash (VER=V4): '530fdded'
  9. Wed May 30 10:01:38 2007 UDPv4 link local: [undef]
  10. Wed May 30 10:01:38 2007 UDPv4 link remote: 192.168.100.10:1194
  11. Wed May 30 10:01:38 2007 TLS: Initial packet from 192.168.100.10:1194, sid=81ac3d67 05db3950
  12. Wed May 30 10:01:39 2007 VERIFY OK: depth=1, /C=FR/ST=France/L=Issy/O=Aramis/CN=VPNserver/emailAddress=contact@aramis.fr
  13. Wed May 30 10:01:39 2007 VERIFY OK: depth=0, /C=FR/ST=France/O=Aramis/CN=VPNserver/emailAddress=contact@aramis.fr
  14. Wed May 30 10:01:42 2007 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
  15. Wed May 30 10:01:42 2007 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
  16. Wed May 30 10:01:42 2007 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
  17. Wed May 30 10:01:42 2007 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
  18. Wed May 30 10:01:42 2007 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
  19. Wed May 30 10:01:42 2007 [VPNserver] Peer Connection Initiated with 192.168.100.10:1194
  20. Wed May 30 10:01:43 2007 SENT CONTROL [VPNserver]: 'PUSH_REQUEST' (status=1)
  21. Wed May 30 10:01:43 2007 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway,route 10.8.0.1,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
  22. Wed May 30 10:01:43 2007 OPTIONS IMPORT: timers and/or timeouts modified
  23. Wed May 30 10:01:43 2007 OPTIONS IMPORT: --ifconfig/up options modified
  24. Wed May 30 10:01:43 2007 OPTIONS IMPORT: route options modified
  25. Wed May 30 10:01:43 2007 TAP-WIN32 device [Connexion au réseau local 2] opened: \\.\Global\{A020DE63-2556-44B0-91AB-42187758D9DE}.tap
  26. Wed May 30 10:01:43 2007 TAP-Win32 Driver Version 8.1
  27. Wed May 30 10:01:43 2007 TAP-Win32 MTU=1500
  28. Wed May 30 10:01:43 2007 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {A020DE63-2556-44B0-91AB-42187758D9DE} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
  29. Wed May 30 10:01:43 2007 Successful ARP Flush on interface [3] {A020DE63-2556-44B0-91AB-42187758D9DE}
  30. Wed May 30 10:01:43 2007 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
  31. Wed May 30 10:01:43 2007 Route: Waiting for TUN/TAP interface to come up...
  32. Wed May 30 10:01:44 2007 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
  33. Wed May 30 10:01:44 2007 Route: Waiting for TUN/TAP interface to come up...
  34. Wed May 30 10:01:45 2007 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
  35. Wed May 30 10:01:45 2007 Route: Waiting for TUN/TAP interface to come up...
  36. Wed May 30 10:01:47 2007 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
  37. Wed May 30 10:01:47 2007 Route: Waiting for TUN/TAP interface to come up...
  38. Wed May 30 10:01:48 2007 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
  39. Wed May 30 10:01:48 2007 route ADD 192.168.100.10 MASK 255.255.255.255 192.168.102.11
  40. Wed May 30 10:01:48 2007 Route addition via IPAPI succeeded
  41. Wed May 30 10:01:48 2007 route DELETE 0.0.0.0 MASK 0.0.0.0 192.168.102.11
  42. Wed May 30 10:01:48 2007 Route deletion via IPAPI succeeded
  43. Wed May 30 10:01:48 2007 route ADD 0.0.0.0 MASK 0.0.0.0 10.8.0.5
  44. Wed May 30 10:01:48 2007 Route addition via IPAPI succeeded
  45. Wed May 30 10:01:48 2007 route ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
  46. Wed May 30 10:01:48 2007 Route addition via IPAPI succeeded
  47. Wed May 30 10:01:48 2007 Initialization Sequence Completed


 
Voilà comme on voit sur les logs il ajoute 10.8.0.5 comme route par défaut et je comprend vraiment pas ce que ca vient faire là, comme déjà dit mon dispositif est basique et il n'y a pas de matériel à l'adresse 10.8.0.5... Je ne comprend pas, si quelqu'un a une idée, je l'en remercie d'avance !!!

Reply

Marsh Posté le 31-05-2007 à 15:45:53   

Reply

Sujets relatifs:

Leave a Replay

Make sure you enter the(*)required information where indicate.HTML code is not allowed