无法通过OpenVPN隧道连接MariaDB服务器的排查求助

大家好，我最近碰到一个棘手的问题——没法通过OpenVPN隧道连接到我的MariaDB服务器，折腾了好一阵都没解决，想请各位帮忙看看。先说说我的环境：

• Ubuntu 20.04
• MariaDB 10.3.39（版本信息：mariadb Ver 15.1 Distrib 10.3.39-MariaDB）
• OpenVPN 2.4.7
• 启用了UFW防火墙

下面是我已经做过的排查和尝试：

• 把MariaDB绑定到公网IP时，能直接正常连接，但通过OpenVPN隧道就不行
• 尝试过在UFW里配置端口转发（当MariaDB监听主网卡时），隧道连接还是失败
• 试过将bind-address设为0.0.0.0，依然无法通过隧道连接
• 完全关闭UFW防火墙后，问题依旧存在
• 移除bind-address配置，还是没解决
• 为了测试网络连通性，我用nc -l 5000在服务器上起了个测试监听端口，用OpenVPN客户端telnet这个端口能成功连接
• 确认skip-networking是禁用状态
• 另外Samba服务可以通过OpenVPN正常连接，所以应该不是防火墙的问题

服务器网卡配置 #

root@machine:/home/myuser# ip a

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever

2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether fa:16:3e:ce:de:9a brd ff:ff:ff:ff:ff:ff
inet *PUBLIC IP* brd *PUBLIC IP BROADCAST* scope global dynamic ens3
valid_lft 64288sec preferred_lft 64288sec
inet6 *PUBLIC IPV6* scope link
valid_lft forever preferred_lft forever

102: tun1: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100
link/none
inet 10.8.1.1/24 brd 10.8.1.255 scope global tun1
valid_lft forever preferred_lft forever
inet6 fe80::c446:2ce1:c480:a740/64 scope link stable-privacy
valid_lft forever preferred_lft forever

TCP Dump抓包结果（客户端IP：10.8.1.2） #

tcpdump -i tun1 -n port 3306

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun1, link-type RAW (Raw IP), capture size 262144 bytes

09:26:53.954949 IP 10.8.1.2.59977 > 10.8.1.1.3306: Flags [S], seq 771542358, win 64240, options [mss 1286,nop,wscale 8,nop,nop,sackOK], length 0
09:26:54.969398 IP 10.8.1.2.59977 > 10.8.1.1.3306: Flags [S], seq 771542358, win 64240, options [mss 1286,nop,wscale 8,nop,nop,sackOK], length 0
09:26:56.979356 IP 10.8.1.2.59977 > 10.8.1.1.3306: Flags [S], seq 771542358, win 64240, options [mss 1286,nop,wscale 8,nop,nop,sackOK], length 0
09:27:00.989474 IP 10.8.1.2.59977 > 10.8.1.1.3306: Flags [S], seq 771542358, win 64240, options [mss 1286,nop,wscale 8,nop,nop,sackOK], length 0

Netstat监听状态 #

netstat -naplut | grep 3306

tcp        0      0 0.0.0.0:3306            0.0.0.0:*               LISTEN      158452/mysqld

MariaDB 50-server配置文件 #

[server]
# this is only for the mysqld standalone daemon

[mysqld]
#
# * Basic Settings
#
user                    = mysql
pid-file                = /run/mysqld/mysqld.pid
socket                  = /run/mysqld/mysqld.sock
#port                   = 3306
basedir                 = /usr
datadir                 = /var/lib/mysql
tmpdir                  = /tmp
lc-messages-dir         = /usr/share/mysql
#skip-external-locking
bind-address             = 0.0.0.0

UFW防火墙状态 #

ufw status

Status: active

To                         Action      From
--                         ------      ----
80/tcp                     ALLOW       Anywhere
443/tcp                    ALLOW       Anywhere
20/tcp                     ALLOW       Anywhere
21/tcp                     ALLOW       Anywhere
1194/udp                   ALLOW       Anywhere
Samba                      ALLOW       10.8.1.0/24
16/tcp                     ALLOW       Anywhere
Apache Full                ALLOW       Anywhere
1195                       ALLOW       Anywhere
1195/udp                   ALLOW       Anywhere
3306/tcp                   ALLOW       10.8.1.0/24

80/tcp (v6)                ALLOW       Anywhere (v6)
443/tcp (v6)               ALLOW       Anywhere (v6)
20/tcp (v6)                ALLOW       Anywhere (v6)
21/tcp (v6)                ALLOW       Anywhere (v6)
1194/udp (v6)              ALLOW       Anywhere (v6)
16/tcp (v6)                ALLOW       Anywhere (v6)
Apache Full (v6)           ALLOW       Anywhere (v6)
1195 (v6)                  ALLOW       Anywhere (v6)
1195/udp (v6)              ALLOW       Anywhere (v6)

备注：内容来源于stack exchange，提问作者marhyno