接続構成としては、Site AにあるRaspberry PiがOpenVPNのサーバとなっており、
Site BにあるRaspberry Piがクライアントになっております。
Site Aのルータ(Cisco 841M)には、あらかじめ以下のように、192.168.5.0へのルーティングが入っています。
port 1194
proto udp
dev tun
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.0.0 255.255.255.0"
keepalive 10 120
cipher AES-256-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log
log /var/log/openvpn.log
log-append /var/log/openvpn.log
verb 3
explicit-exit-notify 1
client.conf
client
dev tun
proto udp
remote xxx.xxx.xxx.xxx nnnn
resolv-retry infinite
nobind
user nobody
group nogroup
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/client.crt
key /etc/openvpn/client.key
remote-cert-tls server
ns-cert-type server
cipher AES-256-CBC
comp-lzo
verb 3
1# VPNサーバ
2$ ip route
3default via 192.168.0.1 dev eth0 proto static metric 100
410.8.0.0/24 via 10.8.0.2 dev tun0
510.8.0.2 dev tun0 proto kernel scope link src 10.8.0.1
6192.168.0.0/23 dev eth0 proto kernel scope link src 192.168.0.yyy metric 100
shoute
1# VPNクライアント
2$ ip r
3default via 192.168.5.1 dev eth0 onlink
410.8.0.1 via 10.8.0.5 dev tun0
510.8.0.5 dev tun0 proto kernel scope link src 10.8.0.6
6192.168.5.0/24 dev eth0 proto kernel scope link src 192.168.5.yyy
1$ grep vpn /var/log/messages | tail -n 20 | sed -r 's/(([1-9]?[0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]).){3}([1-9]?[0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])/***.***.***.***/g' | sed -r 's/www[0-9]{5}[a-z]{2}/********/g'
2Apr 29 08:42:53 ******** openvpn: Sun Apr 29 08:42:53 2018 client/***.***.***.***:34457 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
3Apr 29 08:42:53 ******** openvpn: Sun Apr 29 08:42:53 2018 client/***.***.***.***:34457 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
4Apr 29 08:42:53 ******** openvpn: Sun Apr 29 08:42:53 2018 client/***.***.***.***:34457 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384,
54096 bit RSA
6Apr 29 09:42:53 ******** openvpn: Sun Apr 29 09:42:53 2018 client/***.***.***.***:34457 TLS: soft reset sec=0 bytes=37202/0 pkts=708/0
7Apr 29 09:42:54 ******** openvpn: Sun Apr 29 09:42:54 2018 client/***.***.***.***:34457 VERIFY OK: depth=1, CN=********.sakura.ne.jp
8Apr 29 09:42:54 ******** openvpn: Sun Apr 29 09:42:54 2018 client/***.***.***.***:34457 VERIFY OK: depth=0, CN=client
9Apr 29 09:42:54 ******** openvpn: Sun Apr 29 09:42:54 2018 client/***.***.***.***:34457 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
10Apr 29 09:42:54 ******** openvpn: Sun Apr 29 09:42:54 2018 client/***.***.***.***:34457 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
11Apr 29 09:42:54 ******** openvpn: Sun Apr 29 09:42:54 2018 client/***.***.***.***:34457 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
12Apr 29 09:42:54 ******** openvpn: Sun Apr 29 09:42:54 2018 client/***.***.***.***:34457 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
13Apr 29 09:42:54 ******** openvpn: Sun Apr 29 09:42:54 2018 client/***.***.***.***:34457 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384,
144096 bit RSA
15Apr 29 10:32:52 ******** yum[26376]: Updated: openvpn-2.4.5-1.el7.x86_64
16Apr 29 10:42:54 ******** openvpn: Sun Apr 29 10:42:54 2018 client/***.***.***.***:34457 TLS: soft reset sec=0 bytes=37097/0 pkts=706/0
17Apr 29 10:42:54 ******** openvpn: Sun Apr 29 10:42:54 2018 client/***.***.***.***:34457 VERIFY OK: depth=1, CN=********.sakura.ne.jp
18Apr 29 10:42:54 ******** openvpn: Sun Apr 29 10:42:54 2018 client/***.***.***.***:34457 VERIFY OK: depth=0, CN=client
19Apr 29 10:42:54 ******** openvpn: Sun Apr 29 10:42:54 2018 client/***.***.***.***:34457 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
20Apr 29 10:42:54 ******** openvpn: Sun Apr 29 10:42:54 2018 client/***.***.***.***:34457 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
21Apr 29 10:42:54 ******** openvpn: Sun Apr 29 10:42:54 2018 client/***.***.***.***:34457 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
22Apr 29 10:42:54 ******** openvpn: Sun Apr 29 10:42:54 2018 client/***.***.***.***:34457 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
23Apr 29 10:42:54 ******** openvpn: Sun Apr 29 10:42:54 2018 client/***.***.***.***:34457 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384,
244096 bit RSA
VPNクライアント側ログ(Ubuntu 16.04)
sh
1$ grep vpn /var/log/syslog | tail -n 20 | sed -r 's/(([1-9]?[0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]).){3}([1-9]?[0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])/***.***.***.***/g' | sed -r 's/www[0-9]{5}[a-z]{2}/********/g'
2Apr 29 09:42:54 brix ovpn-client[1150]: VERIFY OK: nsCertType=SERVER
3Apr 29 09:42:54 brix ovpn-client[1150]: VERIFY OK: depth=0, CN=server
4Apr 29 09:42:54 brix ovpn-client[1150]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
5Apr 29 09:42:54 brix ovpn-client[1150]: WARNING: this cipher's block size is less than 128 bit (64 bit). Consider using a --cipher with a larger block size.
6Apr 29 09:42:54 brix ovpn-client[1150]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
7Apr 29 09:42:54 brix ovpn-client[1150]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
8Apr 29 09:42:54 brix ovpn-client[1150]: WARNING: this cipher's block size is less than 128 bit (64 bit). Consider using a --cipher with a larger block size.
9Apr 29 09:42:54 brix ovpn-client[1150]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
10Apr 29 09:42:54 brix ovpn-client[1150]: Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
11Apr 29 10:42:53 brix ovpn-client[1150]: TLS: tls_process: killed expiring key
12Apr 29 10:42:54 brix ovpn-client[1150]: VERIFY OK: depth=1, CN=********.sakura.ne.jp
13Apr 29 10:42:54 brix ovpn-client[1150]: VERIFY OK: nsCertType=SERVER
14Apr 29 10:42:54 brix ovpn-client[1150]: VERIFY OK: depth=0, CN=server
15Apr 29 10:42:54 brix ovpn-client[1150]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
16Apr 29 10:42:54 brix ovpn-client[1150]: WARNING: this cipher's block size is less than 128 bit (64 bit). Consider using a --cipher with a larger block size.
17Apr 29 10:42:54 brix ovpn-client[1150]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
18Apr 29 10:42:54 brix ovpn-client[1150]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
19Apr 29 10:42:54 brix ovpn-client[1150]: WARNING: this cipher's block size is less than 128 bit (64 bit). Consider using a --cipher with a larger block size.
20Apr 29 10:42:54 brix ovpn-client[1150]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
21Apr 29 10:42:54 brix ovpn-client[1150]: Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
バッドをするには、ログインかつ
こちらの条件を満たす必要があります。
2018/04/25 01:55
2018/04/26 16:25
2018/04/28 15:08
2018/04/29 02:21