teratail
回答率
85.30%
teratail header banner
teratail header banner
質問するログイン新規登録
トップRaspbianに関する質問OpenVPNでLAN間接続がうまくいかない。

編集履歴

回答編集履歴

2

参考情報追記

2018/04/29 02:03

投稿

tkmtmkt
tkmtmkt

スコア1800

answer CHANGED
@@ -31,4 +31,64 @@
31
31
  192.168.5.0/24 dev eth0 proto kernel scope link src 192.168.5.yyy
32
32
  ```
33
33
 
34
- 10.8.0.2、10.8.0.5 は仮想ネットワークのネットワークアドレスとして設定されているようで、OpenVPNが設定するデフォルト値のようです。
34
+ 10.8.0.2、10.8.0.5 は仮想ネットワークのネットワークアドレスとして設定されているようで、OpenVPNが設定するデフォルト値のようです。
35
+
36
+
37
+ **【参考】**
38
+
39
+ VPNが正常に接続できてる状態のログです。
40
+
41
+ #### VPNサーバ側ログ（CentOS 7）
42
+
43
+ ```sh
44
+ $ grep vpn /var/log/messages | tail -n 20 | sed -r 's/(([1-9]?[0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]).){3}([1-9]?[0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])/***.***.***.***/g' | sed -r 's/www[0-9]{5}[a-z]{2}/********/g'
45
+ Apr 29 08:42:53 ******** openvpn: Sun Apr 29 08:42:53 2018 client/***.***.***.***:34457 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
46
+ Apr 29 08:42:53 ******** openvpn: Sun Apr 29 08:42:53 2018 client/***.***.***.***:34457 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
47
+ Apr 29 08:42:53 ******** openvpn: Sun Apr 29 08:42:53 2018 client/***.***.***.***:34457 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384,
48
+ 4096 bit RSA
49
+ Apr 29 09:42:53 ******** openvpn: Sun Apr 29 09:42:53 2018 client/***.***.***.***:34457 TLS: soft reset sec=0 bytes=37202/0 pkts=708/0
50
+ Apr 29 09:42:54 ******** openvpn: Sun Apr 29 09:42:54 2018 client/***.***.***.***:34457 VERIFY OK: depth=1, CN=********.sakura.ne.jp
51
+ Apr 29 09:42:54 ******** openvpn: Sun Apr 29 09:42:54 2018 client/***.***.***.***:34457 VERIFY OK: depth=0, CN=client
52
+ Apr 29 09:42:54 ******** openvpn: Sun Apr 29 09:42:54 2018 client/***.***.***.***:34457 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
53
+ Apr 29 09:42:54 ******** openvpn: Sun Apr 29 09:42:54 2018 client/***.***.***.***:34457 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
54
+ Apr 29 09:42:54 ******** openvpn: Sun Apr 29 09:42:54 2018 client/***.***.***.***:34457 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
55
+ Apr 29 09:42:54 ******** openvpn: Sun Apr 29 09:42:54 2018 client/***.***.***.***:34457 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
56
+ Apr 29 09:42:54 ******** openvpn: Sun Apr 29 09:42:54 2018 client/***.***.***.***:34457 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384,
57
+ 4096 bit RSA
58
+ Apr 29 10:32:52 ******** yum[26376]: Updated: openvpn-2.4.5-1.el7.x86_64
59
+ Apr 29 10:42:54 ******** openvpn: Sun Apr 29 10:42:54 2018 client/***.***.***.***:34457 TLS: soft reset sec=0 bytes=37097/0 pkts=706/0
60
+ Apr 29 10:42:54 ******** openvpn: Sun Apr 29 10:42:54 2018 client/***.***.***.***:34457 VERIFY OK: depth=1, CN=********.sakura.ne.jp
61
+ Apr 29 10:42:54 ******** openvpn: Sun Apr 29 10:42:54 2018 client/***.***.***.***:34457 VERIFY OK: depth=0, CN=client
62
+ Apr 29 10:42:54 ******** openvpn: Sun Apr 29 10:42:54 2018 client/***.***.***.***:34457 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
63
+ Apr 29 10:42:54 ******** openvpn: Sun Apr 29 10:42:54 2018 client/***.***.***.***:34457 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
64
+ Apr 29 10:42:54 ******** openvpn: Sun Apr 29 10:42:54 2018 client/***.***.***.***:34457 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
65
+ Apr 29 10:42:54 ******** openvpn: Sun Apr 29 10:42:54 2018 client/***.***.***.***:34457 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
66
+ Apr 29 10:42:54 ******** openvpn: Sun Apr 29 10:42:54 2018 client/***.***.***.***:34457 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384,
67
+ 4096 bit RSA
68
+ ```
69
+
70
+ #### VPNクライアント側ログ（Ubuntu 16.04）
71
+
72
+ ```sh
73
+ $ grep vpn /var/log/syslog | tail -n 20 | sed -r 's/(([1-9]?[0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]).){3}([1-9]?[0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])/***.***.***.***/g' | sed -r 's/www[0-9]{5}[a-z]{2}/********/g'
74
+ Apr 29 09:42:54 brix ovpn-client[1150]: VERIFY OK: nsCertType=SERVER
75
+ Apr 29 09:42:54 brix ovpn-client[1150]: VERIFY OK: depth=0, CN=server
76
+ Apr 29 09:42:54 brix ovpn-client[1150]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
77
+ Apr 29 09:42:54 brix ovpn-client[1150]: WARNING: this cipher's block size is less than 128 bit (64 bit). Consider using a --cipher with a larger block size.
78
+ Apr 29 09:42:54 brix ovpn-client[1150]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
79
+ Apr 29 09:42:54 brix ovpn-client[1150]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
80
+ Apr 29 09:42:54 brix ovpn-client[1150]: WARNING: this cipher's block size is less than 128 bit (64 bit). Consider using a --cipher with a larger block size.
81
+ Apr 29 09:42:54 brix ovpn-client[1150]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
82
+ Apr 29 09:42:54 brix ovpn-client[1150]: Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
83
+ Apr 29 10:42:53 brix ovpn-client[1150]: TLS: tls_process: killed expiring key
84
+ Apr 29 10:42:54 brix ovpn-client[1150]: VERIFY OK: depth=1, CN=********.sakura.ne.jp
85
+ Apr 29 10:42:54 brix ovpn-client[1150]: VERIFY OK: nsCertType=SERVER
86
+ Apr 29 10:42:54 brix ovpn-client[1150]: VERIFY OK: depth=0, CN=server
87
+ Apr 29 10:42:54 brix ovpn-client[1150]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
88
+ Apr 29 10:42:54 brix ovpn-client[1150]: WARNING: this cipher's block size is less than 128 bit (64 bit). Consider using a --cipher with a larger block size.
89
+ Apr 29 10:42:54 brix ovpn-client[1150]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
90
+ Apr 29 10:42:54 brix ovpn-client[1150]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
91
+ Apr 29 10:42:54 brix ovpn-client[1150]: WARNING: this cipher's block size is less than 128 bit (64 bit). Consider using a --cipher with a larger block size.
92
+ Apr 29 10:42:54 brix ovpn-client[1150]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
93
+ Apr 29 10:42:54 brix ovpn-client[1150]: Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
94
+ ```

1

追記

2018/04/29 02:03

投稿

tkmtmkt
tkmtmkt

スコア1800

answer CHANGED
@@ -3,11 +3,32 @@
3
3
  192.168.5.yyyから192.168.0.yyyへのネットワーク接続が出来る状態の場合、10.8.0.0/24のプライベートネットワークが構築されます。
4
4
 
5
5
  ```
6
- +----------------+ +----------------+
6
+ +----------------+ +-----------------+
7
- | 192.168.0.yyy |----| 192.168.5.yyy |
7
+ | 192.168.0.yyy |----| 192.168.5.yyy |
8
- | | | |
8
+ | | | |
9
- | +----------+ | | +---------+ |
9
+ | +----------+ | | +----------+ |
10
- | | 10.8.0.2 |----------| 10.8.0.5| |
10
+ | | 10.8.0.1 |----------| 10.8.0.6 | |
11
- | +----------+ | | +---------+ |
11
+ | +----------+ | | +----------+ |
12
- +----------------+ +----------------+
12
+ +----------------+ +-----------------+
13
- ```
13
+ ```
14
+
15
+ ルーティング情報はそれぞれ以下の通り。（`proto kernel`はカーネルが自動生成するルート）
16
+
17
+ ```sh
18
+ # VPNサーバ
19
+ $ ip route
20
+ default via 192.168.0.1 dev eth0 proto static metric 100
21
+ 10.8.0.0/24 via 10.8.0.2 dev tun0
22
+ 10.8.0.2 dev tun0 proto kernel scope link src 10.8.0.1
23
+ 192.168.0.0/23 dev eth0 proto kernel scope link src 192.168.0.yyy metric 100
24
+ ```
25
+ ```shoute
26
+ # VPNクライアント
27
+ $ ip r
28
+ default via 192.168.5.1 dev eth0 onlink
29
+ 10.8.0.1 via 10.8.0.5 dev tun0
30
+ 10.8.0.5 dev tun0 proto kernel scope link src 10.8.0.6
31
+ 192.168.5.0/24 dev eth0 proto kernel scope link src 192.168.5.yyy
32
+ ```
33
+
34
+ 10.8.0.2、10.8.0.5 は仮想ネットワークのネットワークアドレスとして設定されているようで、OpenVPNが設定するデフォルト値のようです。