Есть микротик, 99% подключений от клиентов в нему идет по pptp, но к сожалению некоторые провайдеры блокируют pptp соединение если у абонента отсутствует внешний IP.
Решил поднять на нем ovpn - нашел самый свежий из тех что есть мануал -
https://www.youtube.com/channel/UCHBLOecDJKY2ICvjP...
сделал все как у него, т.е. сгенерил корневой сертификат, сертификат сервера, пользователя - залил и установил в микротик.
настроил ovpn профиль на клиенте.
и вот вроде и подключил, и работает. Но нет - через полторы минуты (иногда больше) происходит обрыв соединения , в логах микротик пишет:
ovpn,debug,error,l2tp,45288,46360,45288,19116,46020,poe-out,l2tp,info,76,debug duplicate packet, dropping
думал проблема с новой версии openvpn - скачал стабильную версию 2.3.18
проблема не исчезла. даже пересоздал ключил и заново залил на сервер/клиент
лог ovpn клиентаThu Apr 26 09:35:19 2018 OpenVPN 2.3.18 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Oct 26 2017
Thu Apr 26 09:35:19 2018 Windows version 6.1 (Windows 7) 64bit
Thu Apr 26 09:35:19 2018 library versions: OpenSSL 1.0.2l 25 May 2017, LZO 2.10
Enter Management Password:
Thu Apr 26 09:35:20 2018 WARNING: --ping should normally be used with --ping-restart or --ping-exit
Thu Apr 26 09:35:20 2018 WARNING: --ns-cert-type is DEPRECATED. Use --remote-cert-tls instead.
Thu Apr 26 09:35:20 2018 Attempting to establish TCP connection with [AF_INET]xxx.xxx.xxx.xxx:1194 [nonblock]
Thu Apr 26 09:35:21 2018 TCP connection established with [AF_INET]xxx.xxx.xxx.xxx:1194
Thu Apr 26 09:35:21 2018 TCPv4_CLIENT link local: [undef]
Thu Apr 26 09:35:21 2018 TCPv4_CLIENT link remote: [AF_INET]xxx.xxx.xxx.xxx:1194
Thu Apr 26 09:35:21 2018 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Apr 26 09:35:21 2018 VERIFY OK: depth=1, C=RU, ST=RD, L=mkala, O=mycompany, OU=OvpnVHall, CN=ca, name=ca, emailAddress=my@mymail.com
Thu Apr 26 09:35:21 2018 VERIFY OK: nsCertType=SERVER
Thu Apr 26 09:35:21 2018 VERIFY OK: depth=0, C=RU, ST=RD, L=mkala, O=mycompany, OU=OvpnVHall, CN=server, name=server, emailAddress=my@mymail.com
Thu Apr 26 09:35:22 2018 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Apr 26 09:35:22 2018 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Apr 26 09:35:22 2018 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Apr 26 09:35:22 2018 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Apr 26 09:35:22 2018 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Thu Apr 26 09:35:22 2018 [server] Peer Connection Initiated with [AF_INET]xxx.xxx.xxx.xxx:1194
Thu Apr 26 09:35:35 2018 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Apr 26 09:35:35 2018 open_tun, tt->ipv6=0
Thu Apr 26 09:35:35 2018 TAP-WIN32 device [Подключение по локальной сети] opened: \\.\Global\{F21F8EC5-8E15-466B-81D9-AB2552870E0F}.tap
Thu Apr 26 09:35:35 2018 Notified TAP-Windows driver to set a DHCP IP/netmask of 172.30.0.2/255.255.255.0 on interface {F21F8EC5-8E15-466B-81D9-AB2552870E0F} [DHCP-serv: 172.30.0.0, lease-time: 31536000]
Thu Apr 26 09:35:35 2018 Successful ARP Flush on interface [19] {F21F8EC5-8E15-466B-81D9-AB2552870E0F}
Thu Apr 26 09:35:37 2018 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
Thu Apr 26 09:35:37 2018 Initialization Sequence Completed
Thu Apr 26 09:36:53 2018 Connection reset, restarting [-1]
Thu Apr 26 09:36:53 2018 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
Thu Apr 26 09:36:53 2018 Closing TUN/TAP interface
Thu Apr 26 09:36:53 2018 SIGUSR1[soft,connection-reset] received, process restarting
Thu Apr 26 09:36:58 2018 WARNING: --ns-cert-type is DEPRECATED. Use --remote-cert-tls instead.
Thu Apr 26 09:36:58 2018 Attempting to establish TCP connection with [AF_INET]xxx.xxx.xxx.xxx:1194 [nonblock]
Thu Apr 26 09:36:59 2018 TCP connection established with [AF_INET]xxx.xxx.xxx.xxx:1194
Thu Apr 26 09:36:59 2018 TCPv4_CLIENT link local: [undef]
Thu Apr 26 09:36:59 2018 TCPv4_CLIENT link remote: [AF_INET]xxx.xxx.xxx.xxx:1194
Thu Apr 26 09:37:00 2018 VERIFY OK: depth=1, C=RU, ST=RD, L=mkala, O=mycompany, OU=OvpnVHall, CN=ca, name=ca, emailAddress=my@mymail.com
Thu Apr 26 09:37:00 2018 VERIFY OK: nsCertType=SERVER
Thu Apr 26 09:37:00 2018 VERIFY OK: depth=0, C=RU, ST=RD, L=mkala, O=mycompany, OU=OvpnVHall, CN=server, name=server, emailAddress=my@mymail.com
Thu Apr 26 09:37:00 2018 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Apr 26 09:37:00 2018 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Apr 26 09:37:00 2018 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Apr 26 09:37:00 2018 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Apr 26 09:37:00 2018 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Thu Apr 26 09:37:00 2018 [server] Peer Connection Initiated with [AF_INET]xxx.xxx.xxx.xxx:1194
Thu Apr 26 09:37:13 2018 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Apr 26 09:37:13 2018 open_tun, tt->ipv6=0
Thu Apr 26 09:37:13 2018 TAP-WIN32 device [Подключение по локальной сети] opened: \\.\Global\{F21F8EC5-8E15-466B-81D9-AB2552870E0F}.tap
Thu Apr 26 09:37:13 2018 Notified TAP-Windows driver to set a DHCP IP/netmask of 172.30.0.10/255.255.255.0 on interface {F21F8EC5-8E15-466B-81D9-AB2552870E0F} [DHCP-serv: 172.30.0.0, lease-time: 31536000]
Thu Apr 26 09:37:13 2018 Successful ARP Flush on interface [19] {F21F8EC5-8E15-466B-81D9-AB2552870E0F}
Thu Apr 26 09:37:15 2018 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
Thu Apr 26 09:37:15 2018 Initialization Sequence Completed
Thu Apr 26 09:37:27 2018 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
Thu Apr 26 09:37:27 2018 Closing TUN/TAP interface
Thu Apr 26 09:37:27 2018 SIGTERM[hard,] received, process exiting
client.ovpn
proto tcp-client
remote xxx.xxx.xxx.xxx
dev tap
nobind
persist-key
tls-client
ca ca.crt
cert client1.crt
key client1.key
ping 10
verb 2
ns-cert-type server
cipher AES-256-CBC
auth SHA1
pull
auth-user-pass auth.cfg
route-method exe
route-delay 2
route 192.168.0.0 255.255.255.0 172.30.0.1
профиль openvpn name="openvpn" local-address=172.30.0.1
remote-address=ovpn-pool use-mpls=default
use-compression=no use-encryption=required
only-one=default change-tcp-mss=no use-upnp=no
address-list="" on-up="" on-down=""
interface ovpn-server server print /interface ovpn-server server print
enabled: yes
port: 1194
mode: ethernet
netmask: 24
mac-address: FE:D7:03:B1:B8:8E
max-mtu: 1500
keepalive-timeout: 60
default-profile: openvpn
certificate: server.crt_0
require-client-certificate: yes
auth: sha1,md5
cipher: blowfish128,aes128,aes192,
aes256
Простой
Средний
