teratail
回答率
85.48%
質問するログイン新規登録
トップRaspbianに関する質問OpenVPNでLAN間接続がうまくいかない。

編集履歴

回答編集履歴

2

参考情報追記

2018/04/29 02:03

投稿

tkmtmkt
tkmtmkt

スコア1800

test CHANGED
@@ -65,3 +65,123 @@
65
65
 
66
66
 
67
67
  10.8.0.2、10.8.0.5 は仮想ネットワークのネットワークアドレスとして設定されているようで、OpenVPNが設定するデフォルト値のようです。
68
+
69
+
70
+
71
+
72
+
73
+ **【参考】**
74
+
75
+
76
+
77
+ VPNが正常に接続できてる状態のログです。
78
+
79
+
80
+
81
+ #### VPNサーバ側ログ（CentOS 7）
82
+
83
+
84
+
85
+ ```sh
86
+
87
+ $ grep vpn /var/log/messages | tail -n 20 | sed -r 's/(([1-9]?[0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]).){3}([1-9]?[0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])/***.***.***.***/g' | sed -r 's/www[0-9]{5}[a-z]{2}/********/g'
88
+
89
+ Apr 29 08:42:53 ******** openvpn: Sun Apr 29 08:42:53 2018 client/***.***.***.***:34457 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
90
+
91
+ Apr 29 08:42:53 ******** openvpn: Sun Apr 29 08:42:53 2018 client/***.***.***.***:34457 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
92
+
93
+ Apr 29 08:42:53 ******** openvpn: Sun Apr 29 08:42:53 2018 client/***.***.***.***:34457 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384,
94
+
95
+ 4096 bit RSA
96
+
97
+ Apr 29 09:42:53 ******** openvpn: Sun Apr 29 09:42:53 2018 client/***.***.***.***:34457 TLS: soft reset sec=0 bytes=37202/0 pkts=708/0
98
+
99
+ Apr 29 09:42:54 ******** openvpn: Sun Apr 29 09:42:54 2018 client/***.***.***.***:34457 VERIFY OK: depth=1, CN=********.sakura.ne.jp
100
+
101
+ Apr 29 09:42:54 ******** openvpn: Sun Apr 29 09:42:54 2018 client/***.***.***.***:34457 VERIFY OK: depth=0, CN=client
102
+
103
+ Apr 29 09:42:54 ******** openvpn: Sun Apr 29 09:42:54 2018 client/***.***.***.***:34457 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
104
+
105
+ Apr 29 09:42:54 ******** openvpn: Sun Apr 29 09:42:54 2018 client/***.***.***.***:34457 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
106
+
107
+ Apr 29 09:42:54 ******** openvpn: Sun Apr 29 09:42:54 2018 client/***.***.***.***:34457 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
108
+
109
+ Apr 29 09:42:54 ******** openvpn: Sun Apr 29 09:42:54 2018 client/***.***.***.***:34457 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
110
+
111
+ Apr 29 09:42:54 ******** openvpn: Sun Apr 29 09:42:54 2018 client/***.***.***.***:34457 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384,
112
+
113
+ 4096 bit RSA
114
+
115
+ Apr 29 10:32:52 ******** yum[26376]: Updated: openvpn-2.4.5-1.el7.x86_64
116
+
117
+ Apr 29 10:42:54 ******** openvpn: Sun Apr 29 10:42:54 2018 client/***.***.***.***:34457 TLS: soft reset sec=0 bytes=37097/0 pkts=706/0
118
+
119
+ Apr 29 10:42:54 ******** openvpn: Sun Apr 29 10:42:54 2018 client/***.***.***.***:34457 VERIFY OK: depth=1, CN=********.sakura.ne.jp
120
+
121
+ Apr 29 10:42:54 ******** openvpn: Sun Apr 29 10:42:54 2018 client/***.***.***.***:34457 VERIFY OK: depth=0, CN=client
122
+
123
+ Apr 29 10:42:54 ******** openvpn: Sun Apr 29 10:42:54 2018 client/***.***.***.***:34457 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
124
+
125
+ Apr 29 10:42:54 ******** openvpn: Sun Apr 29 10:42:54 2018 client/***.***.***.***:34457 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
126
+
127
+ Apr 29 10:42:54 ******** openvpn: Sun Apr 29 10:42:54 2018 client/***.***.***.***:34457 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
128
+
129
+ Apr 29 10:42:54 ******** openvpn: Sun Apr 29 10:42:54 2018 client/***.***.***.***:34457 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
130
+
131
+ Apr 29 10:42:54 ******** openvpn: Sun Apr 29 10:42:54 2018 client/***.***.***.***:34457 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384,
132
+
133
+ 4096 bit RSA
134
+
135
+ ```
136
+
137
+
138
+
139
+ #### VPNクライアント側ログ（Ubuntu 16.04）
140
+
141
+
142
+
143
+ ```sh
144
+
145
+ $ grep vpn /var/log/syslog | tail -n 20 | sed -r 's/(([1-9]?[0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]).){3}([1-9]?[0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])/***.***.***.***/g' | sed -r 's/www[0-9]{5}[a-z]{2}/********/g'
146
+
147
+ Apr 29 09:42:54 brix ovpn-client[1150]: VERIFY OK: nsCertType=SERVER
148
+
149
+ Apr 29 09:42:54 brix ovpn-client[1150]: VERIFY OK: depth=0, CN=server
150
+
151
+ Apr 29 09:42:54 brix ovpn-client[1150]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
152
+
153
+ Apr 29 09:42:54 brix ovpn-client[1150]: WARNING: this cipher's block size is less than 128 bit (64 bit). Consider using a --cipher with a larger block size.
154
+
155
+ Apr 29 09:42:54 brix ovpn-client[1150]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
156
+
157
+ Apr 29 09:42:54 brix ovpn-client[1150]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
158
+
159
+ Apr 29 09:42:54 brix ovpn-client[1150]: WARNING: this cipher's block size is less than 128 bit (64 bit). Consider using a --cipher with a larger block size.
160
+
161
+ Apr 29 09:42:54 brix ovpn-client[1150]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
162
+
163
+ Apr 29 09:42:54 brix ovpn-client[1150]: Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
164
+
165
+ Apr 29 10:42:53 brix ovpn-client[1150]: TLS: tls_process: killed expiring key
166
+
167
+ Apr 29 10:42:54 brix ovpn-client[1150]: VERIFY OK: depth=1, CN=********.sakura.ne.jp
168
+
169
+ Apr 29 10:42:54 brix ovpn-client[1150]: VERIFY OK: nsCertType=SERVER
170
+
171
+ Apr 29 10:42:54 brix ovpn-client[1150]: VERIFY OK: depth=0, CN=server
172
+
173
+ Apr 29 10:42:54 brix ovpn-client[1150]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
174
+
175
+ Apr 29 10:42:54 brix ovpn-client[1150]: WARNING: this cipher's block size is less than 128 bit (64 bit). Consider using a --cipher with a larger block size.
176
+
177
+ Apr 29 10:42:54 brix ovpn-client[1150]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
178
+
179
+ Apr 29 10:42:54 brix ovpn-client[1150]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
180
+
181
+ Apr 29 10:42:54 brix ovpn-client[1150]: WARNING: this cipher's block size is less than 128 bit (64 bit). Consider using a --cipher with a larger block size.
182
+
183
+ Apr 29 10:42:54 brix ovpn-client[1150]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
184
+
185
+ Apr 29 10:42:54 brix ovpn-client[1150]: Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
186
+
187
+ ```

1

追記

2018/04/29 02:03

投稿

tkmtmkt
tkmtmkt

スコア1800

test CHANGED
@@ -8,18 +8,60 @@
8
8
 
9
9
  ```
10
10
 
11
- +----------------+ +----------------+
11
+ +----------------+ +-----------------+
12
12
 
13
- | 192.168.0.yyy |----| 192.168.5.yyy |
13
+ | 192.168.0.yyy |----| 192.168.5.yyy |
14
14
 
15
- | | | |
15
+ | | | |
16
16
 
17
- | +----------+ | | +---------+ |
17
+ | +----------+ | | +----------+ |
18
18
 
19
- | | 10.8.0.2 |----------| 10.8.0.5| |
19
+ | | 10.8.0.1 |----------| 10.8.0.6 | |
20
20
 
21
- | +----------+ | | +---------+ |
21
+ | +----------+ | | +----------+ |
22
22
 
23
- +----------------+ +----------------+
23
+ +----------------+ +-----------------+
24
24
 
25
25
  ```
26
+
27
+
28
+
29
+ ルーティング情報はそれぞれ以下の通り。（`proto kernel`はカーネルが自動生成するルート）
30
+
31
+
32
+
33
+ ```sh
34
+
35
+ # VPNサーバ
36
+
37
+ $ ip route
38
+
39
+ default via 192.168.0.1 dev eth0 proto static metric 100
40
+
41
+ 10.8.0.0/24 via 10.8.0.2 dev tun0
42
+
43
+ 10.8.0.2 dev tun0 proto kernel scope link src 10.8.0.1
44
+
45
+ 192.168.0.0/23 dev eth0 proto kernel scope link src 192.168.0.yyy metric 100
46
+
47
+ ```
48
+
49
+ ```shoute
50
+
51
+ # VPNクライアント
52
+
53
+ $ ip r
54
+
55
+ default via 192.168.5.1 dev eth0 onlink
56
+
57
+ 10.8.0.1 via 10.8.0.5 dev tun0
58
+
59
+ 10.8.0.5 dev tun0 proto kernel scope link src 10.8.0.6
60
+
61
+ 192.168.5.0/24 dev eth0 proto kernel scope link src 192.168.5.yyy
62
+
63
+ ```
64
+
65
+
66
+
67
+ 10.8.0.2、10.8.0.5 は仮想ネットワークのネットワークアドレスとして設定されているようで、OpenVPNが設定するデフォルト値のようです。