ParanoYak | Bonjour,
J'ai installé un serveur OpenVPN sur mon Raspberry Pi and tout fonctionne quand je me connecte avec un ordinateur depuis un wifi quelconque ou bien un réseau 4G. J'ai configuré OpenVPN de passer par le port TCP 443 pour ne pas être bloqué par d'éventuels par-feux.
Malheureusement, lorsque j'essaie de me connecter à mon VPN depuis le boulot, cela ne fonctionne pas bien que le port 443 semble ouvert (j'arrive à accéder aux sites en https et lorsque je fais telnet serveur.ddns.net 443 il y a aussi connexion. Donc je devrais bien avoir un accès sur mon serveur sur le port 443.
Lorsque je tente une connexion, j'ai le message suivant :
Spoiler :
Tue Jun 30 17:09:42 2015 us=479762 NOTE: --mute triggered...
Tue Jun 30 17:09:42 2015 us=479762 265 variation(s) on previous 20 message(s) suppressed by --mute
Tue Jun 30 17:09:42 2015 us=479762 OpenVPN 2.3.7 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Jun 29 2015
Tue Jun 30 17:09:42 2015 us=479762 library versions: OpenSSL 1.0.1o 12 Jun 2015, LZO 2.08
Enter Management Password:
Tue Jun 30 17:09:42 2015 us=479762 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Jun 30 17:09:42 2015 us=479762 Need hold release from management interface, waiting...
Tue Jun 30 17:09:42 2015 us=978972 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Jun 30 17:09:43 2015 us=88174 MANAGEMENT: CMD 'state on'
Tue Jun 30 17:09:43 2015 us=88174 MANAGEMENT: CMD 'log all on'
Tue Jun 30 17:09:43 2015 us=88174 MANAGEMENT: CMD 'hold off'
Tue Jun 30 17:09:43 2015 us=103774 MANAGEMENT: CMD 'hold release'
Tue Jun 30 17:09:46 2015 us=208234 MANAGEMENT: CMD 'password [...]'
Tue Jun 30 17:09:46 2015 us=208234 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Jun 30 17:09:46 2015 us=208234 Control Channel Authentication: tls-auth using INLINE static key file
Tue Jun 30 17:09:46 2015 us=223834 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jun 30 17:09:46 2015 us=223834 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jun 30 17:09:46 2015 us=223834 Control Channel MTU parms [ L:1559 D:168 EF:68 EB:0 ET:0 EL:3 ]
Tue Jun 30 17:09:46 2015 us=223834 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Jun 30 17:09:46 2015 us=223834 MANAGEMENT: >STATE:1435676986,RESOLVE,,,
Tue Jun 30 17:09:47 2015 us=206653 Data Channel MTU parms [ L:1559 D:1450 EF:59 EB:12 ET:0 EL:3 ]
Tue Jun 30 17:09:47 2015 us=206653 Local Options String: 'V4,dev-type tun,link-mtu 1559,tun-mtu 1500,proto TCPv4_CLIENT,keydir 1,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Tue Jun 30 17:09:47 2015 us=206653 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1559,tun-mtu 1500,proto TCPv4_SERVER,keydir 0,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Tue Jun 30 17:09:47 2015 us=206653 Local Options hash (VER=V4): 'b117f32c'
Tue Jun 30 17:09:47 2015 us=206653 Expected Remote Options hash (VER=V4): 'e64f5aeb'
Tue Jun 30 17:09:47 2015 us=206653 Attempting to establish TCP connection with [AF_INET]XXX.XXX.XXX.XX:443 [nonblock]
Tue Jun 30 17:09:47 2015 us=206653 MANAGEMENT: >STATE:1435676987,TCP_CONNECT,,,
Tue Jun 30 17:09:48 2015 us=220672 TCP connection established with [AF_INET]XX.XXX.XXX.XX:443
Tue Jun 30 17:09:48 2015 us=220672 TCPv4_CLIENT link local: [undef]
Tue Jun 30 17:09:48 2015 us=220672 TCPv4_CLIENT link remote: [AF_INET]XX.XXX.XXX.XX:443
Tue Jun 30 17:09:48 2015 us=220672 MANAGEMENT: >STATE:1435676988,WAIT,,,
Tue Jun 30 17:09:48 2015 us=439077 Connection reset, restarting [-1]
Tue Jun 30 17:09:48 2015 us=439077 TCP/UDP: Closing socket
Tue Jun 30 17:09:48 2015 us=439077 SIGUSR1[soft,connection-reset] received, process restarting
Tue Jun 30 17:09:48 2015 us=439077 MANAGEMENT: >STATE:1435676988,RECONNECTING,connection-reset,,
Tue Jun 30 17:09:48 2015 us=439077 Restart pause, 5 second(s) |
Il y a une connexion qui a l'air de se faire pendant 0.5 secondes puis elle est perdue.
Mon fichier server.conf sur le serveur est le suivant :
Spoiler :
# SWAP THIS NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
local 192.168.1.11
dev tun
proto tcp # Some people prefer to use tcp. Don't change it if you don't know.
port 443
ca /etc/openvpn/easy-rsa/keys/ca.crt
# SWAP WITH YOUR YOUR SERVER NAME I.E. VPiN.crt
cert /etc/openvpn/easy-rsa/keys/NOM.crt
# SWAP WITH YOUR YOUR SERVER NAME I.E. VPiN.key
key /etc/openvpn/easy-rsa/keys/NOM.key
# You left the encryption level at 1024 change that here
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
push "route 10.8.0.1 255.255.255.255"
push "route 10.8.0.0 255.255.255.0"
# SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS,
# AND MAKE SURE THE SUBNET IS CORRECT
push "route 192.168.1.11 255.255.255.0"
# This should match your router address and not need to be changed.
# If your router does not do DNS, you can use Google DNS 8.8.8.8
push "dhcp-option DNS 192.168.1.1"
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 5 |
et mon fichier de configuration client est le suivant :
Spoiler :
client
dev tun
proto tcp
remote my server.ddns.net 443
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ns-cert-type server
key-direction 1
cipher AES-128-CBC
comp-lzo
verb 1
mute 20 |
Mon fichier log openvpn ne semble relever aucune tentative de connexion depuis mon boulot. Il ne fait état que de mes autres connexions (réussies) depuis d'autres réseaux.
Merci pour votre aide.
|
FORUM HardWare.fr
