OpenVPN无法将流量路由至客户端子网的问题排查

网络信息 #

• OpenVPN服务器（Ubuntu 系统，版本 OpenVPN 2.4.12 x86_64-pc-linux-gnu）：物理IP 192.168.2.12，tun0接口IP 10.8.0.1
• OpenVPN客户端（OpenWRT路由器）：物理IP 192.168.8.1，tun0接口IP 10.8.0.4

问题现象 #

• 服务器可ping通客户端的VPN隧道IP 10.8.0.4，但无法ping通客户端私有网络的网关 192.168.8.1
• 执行tcpdump -i tun0发现ping 192.168.8.1时tun0无流量，traceroute显示流量被发往服务器所在网络的路由器 192.168.2.1，说明192.168.8.0/24的流量未被路由到VPN隧道

当前配置情况 #

服务器配置文件 /etc/openvpn/server/server.conf #

local 192.168.2.12
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.255.0
route 192.168.8.0 255.255.255.0
push "route 192.168.2.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 192.168.2.1"
push "dhcp-option DOMAIN lan"
push "dhcp-option DOMAIN-SEARCH lan"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
verb 3
crl-verify crl.pem
explicit-exit-notify
client-config-dir /etc/openvpn/client

客户端配置文件 /etc/openvpn/client/gl-inet.conf #

iroute 192.168.8.0 255.255.255.0

配置后服务器日志（tail -f /var/log/syslog | grep -i vpn）无该文件读取或路由生效记录，推测文件名或配置逻辑存在问题

服务器日志片段 #

Jan 21 10:38:23 nuc2 openvpn[5147]: 192.168.2.1:44409 TLS: Initial packet from [AF_INET]192.168.2.1:44409, sid=577f0ed8 416e3b2c
Jan 21 10:38:23 nuc2 openvpn[5147]: 192.168.2.1:44409 VERIFY OK: depth=1, CN=ChangeMe
Jan 21 10:38:23 nuc2 openvpn[5147]: 192.168.2.1:44409 VERIFY OK: depth=0, CN=gl-inet
Jan 21 10:38:23 nuc2 openvpn[5147]: 192.168.2.1:44409 peer info: IV_VER=2.5.2
Jan 21 10:38:23 nuc2 openvpn[5147]: 192.168.2.1:44409 peer info: IV_PLAT=linux
Jan 21 10:38:23 nuc2 openvpn[5147]: 192.168.2.1:44409 peer info: IV_PROTO=6
Jan 21 10:38:23 nuc2 openvpn[5147]: 192.168.2.1:44409 peer info: IV_NCP=2
Jan 21 10:38:23 nuc2 openvpn[5147]: 192.168.2.1:44409 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM:AES-256-CBC
Jan 21 10:38:23 nuc2 openvpn[5147]: 192.168.2.1:44409 peer info: IV_LZ4=1
Jan 21 10:38:23 nuc2 openvpn[5147]: 192.168.2.1:44409 peer info: IV_LZ4v2=1
Jan 21 10:38:23 nuc2 openvpn[5147]: 192.168.2.1:44409 peer info: IV_LZO_STUB=1
Jan 21 10:38:23 nuc2 openvpn[5147]: 192.168.2.1:44409 peer info: IV_COMP_STUB=1
Jan 21 10:38:23 nuc2 openvpn[5147]: 192.168.2.1:44409 peer info: IV_COMP_STUBv2=1
Jan 21 10:38:23 nuc2 openvpn[5147]: 192.168.2.1:44409 peer info: IV_TCPNL=1
Jan 21 10:38:23 nuc2 openvpn[5147]: 192.168.2.1:44409 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
Jan 21 10:38:23 nuc2 openvpn[5147]: 192.168.2.1:44409 [gl-inet] Peer Connection Initiated with [AF_INET]192.168.2.1:44409
Jan 21 10:38:23 nuc2 openvpn[5147]: MULTI: new connection by client 'gl-inet' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Jan 21 10:38:23 nuc2 openvpn[5147]: MULTI_sva: pool returned IPv4=10.8.0.4, IPv6=(Not enabled)
Jan 21 10:38:23 nuc2 openvpn[5147]: MULTI: Learn: 10.8.0.4 -> gl-inet/192.168.2.1:44409
Jan 21 10:38:23 nuc2 openvpn[5147]: MULTI: primary virtual IP for gl-inet/192.168.2.1:44409: 10.8.0.4
Jan 21 10:38:25 nuc2 openvpn[5147]: gl-inet/192.168.2.1:44409 PUSH: Received control message: 'PUSH_REQUEST'
Jan 21 10:38:25 nuc2 openvpn[5147]: gl-inet/192.168.2.1:44409 SENT CONTROL [gl-inet]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 192.168.2.1,dhcp-option DOMAIN lan,dhcp-option DOMAIN-SEARCH lan,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.4 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
Jan 21 10:38:25 nuc2 openvpn[5147]: gl-inet/192.168.2.1:44409 Data Channel: using negotiated cipher 'AES-256-GCM'
Jan 21 10:38:25 nuc2 openvpn[5147]: gl-inet/192.168.2.1:44409 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Jan 21 10:38:25 nuc2 openvpn[5147]: gl-inet/192.168.2.1:44409 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key

解决方案 #

1. 修正客户端配置文件权限 #

OpenVPN的client-config-dir目录下的配置文件需要确保权限正确，让OpenVPN进程可以读取：

chown nobody:nogroup /etc/openvpn/client/gl-inet.conf
chmod 644 /etc/openvpn/client/gl-inet.conf

重启OpenVPN服务：

systemctl restart openvpn-server@server.service

2. 确认服务器路由表 #

检查服务器是否存在指向192.168.8.0/24的路由：

ip route show

如果没有看到192.168.8.0/24 via 10.8.0.1 dev tun0相关条目，手动添加路由：

ip route add 192.168.8.0/24 dev tun0

也可以确认server.conf中的route 192.168.8.0 255.255.255.0配置正确，重启服务后会自动添加该路由。

3. 配置OpenWRT客户端的IP转发与防火墙规则 #

在OpenWRT路由器上开启IP转发：

echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p

添加防火墙规则，允许VPN隧道与私有网络的流量转发：

uci add firewall rule
uci set firewall.@rule[-1].src='vpn'
uci set firewall.@rule[-1].dest='lan'
uci set firewall.@rule[-1].target='ACCEPT'
uci add firewall rule
uci set firewall.@rule[-1].src='lan'
uci set firewall.@rule[-1].dest='vpn'
uci set firewall.@rule[-1].target='ACCEPT'
uci commit firewall
/etc/init.d/firewall restart

注：vpn为OpenWRT中OpenVPN客户端对应的网络区域名称，若实际名称不同需替换。

4. 验证路由生效 #

客户端重新连接VPN后，在服务器上执行tcpdump -i tun0 icmp，同时ping 192.168.8.1，检查tun0接口是否有ICMP流量。若流量正常，说明路由已生效。

内容的提问来源于stack exchange，提问作者JanVdA