FreshTomato下OpenVPN客户端无法访问局域网问题排查求助

我现在在用FreshTomato 2023.5版本搭建OpenVPN服务器，目前已经成功生成客户端配置，iPhone用OpenVPN客户端也能顺利连接上，而且能ping通FreshTomato路由器（地址是192.168.10.1），但就是没法ping或者访问局域网里的其他设备。

我的局域网网段是192.168.10.0/24，VPN子网是10.6.0.0/24，这个路由器也是局域网的默认网关。按照教程设置的时候，我勾选了“Push LAN0 (br0) to clients”选项，本来以为这样客户端就能访问局域网设备了，可现在就是不行，实在找不到哪里配置错了，是不是漏掉了什么规则？

我还试过勾选“Direct Clients to Redirect Internet Traffic”选项，但也没解决问题——我理解这个选项是让客户端把所有互联网流量都走VPN，其实我更想要的是分流模式（Split Tunnelling），只让访问局域网的流量走VPN。

环境信息 #

• FreshTomato版本：2023.5
• 路由器局域网地址：192.168.10.1
• 局域网网段：192.168.10.0/24
• VPN子网：10.6.0.0/24
• 客户端设备：iPhone（OpenVPN core 3.8.3connect1）

已配置项说明 #

• 基础配置：[原内容未提供具体信息]
• 高级配置：[原内容未提供具体信息]

客户端连接日志（已隐藏公网IP和域名） #

[Feb 07, 2024, 19:53:13] START CONNECTION

[Feb 07, 2024, 19:53:13] ----- OpenVPN Start -----

OpenVPN core 3.8.3connect1 ios arm64 64-bit

[Feb 07, 2024, 19:53:13] OpenVPN core 3.8.3connect1 ios arm64 64-bit

[Feb 07, 2024, 19:53:13] Frame=512/2112/512 mssfix-ctrl=1250

[Feb 07, 2024, 19:53:13] NOTE: This configuration contains options that were not used:

[Feb 07, 2024, 19:53:13] Unsupported option (ignored)

[Feb 07, 2024, 19:53:13] 3 [ncp-ciphers] [CHACHA20-POLY1305:AES-128-GCM:AES-256-GCM:AES-128-CBC:AES-256-CB...]

[Feb 07, 2024, 19:53:13] 11 [resolv-retry] [infinite]

[Feb 07, 2024, 19:53:13] UNKNOWN/UNSUPPORTED OPTIONS

[Feb 07, 2024, 19:53:13] 15 [status] [status]

[Feb 07, 2024, 19:53:13] EVENT: RESOLVE

[Feb 07, 2024, 19:53:13] Contacting xxx.xxx.xxx.xxx:1194 via UDP

[Feb 07, 2024, 19:53:13] EVENT: WAIT

[Feb 07, 2024, 19:53:13] Connecting to [x.x.co.uk]:1194 (86.31.66.136) via UDP

[Feb 07, 2024, 19:53:13] EVENT: CONNECTING

[Feb 07, 2024, 19:53:13] Tunnel Options:V4,dev-type tun,link-mtu 1541,tun-mtu 1500,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client

[Feb 07, 2024, 19:53:13] Creds: Username/Password

[Feb 07, 2024, 19:53:13] Sending Peer Info:

IV_VER=3.8.3connect1

IV_PLAT=ios

IV_NCP=2

IV_TCPNL=1

IV_PROTO=990

IV_MTU=1600

IV_CIPHERS=AES-128-CBC:AES-192-CBC:AES-256-CBC:AES-128-GCM:AES-192-GCM:AES-256-GCM:CHACHA20-POLY1305

IV_AUTO_SESS=1

IV_GUI_VER=net.openvpn.connect.ios_3.4.1-5463

IV_SSO=webauth,openurl,crtext

IV_BS64DL=1

[Feb 07, 2024, 19:53:13] VERIFY OK: depth=1, /C=GB/ST=Yorks/L=York/O=FreshTomato/OU=IT/CN=server, signature: RSA-SHA256

[Feb 07, 2024, 19:53:13] VERIFY OK: depth=0, /C=GB/ST=Yorks/L=York/O=FreshTomato/OU=IT/CN=server, signature: RSA-SHA256

[Feb 07, 2024, 19:53:13] SSL Handshake: peer certificate: CN=server, 2048 bit RSA, cipher: TLS_CHACHA20_POLY1305_SHA256   TLSv1.3 Kx=any      Au=any   Enc=CHACHA20/POLY1305(256) Mac=AEAD

[Feb 07, 2024, 19:53:13] Session is ACTIVE

[Feb 07, 2024, 19:53:13] EVENT: GET_CONFIG

[Feb 07, 2024, 19:53:13] Sending PUSH_REQUEST to server...

[Feb 07, 2024, 19:53:13] OPTIONS:

0 [route] [192.168.10.0] [255.255.255.0]

1 [dhcp-option] [DNS] [192.168.10.1]

2 [route-gateway] [10.6.0.1]

3 [topology] [subnet]

4 [ping] [15]

5 [ping-restart] [60]

6 [ifconfig] [10.6.0.2] [255.255.255.0]

7 [peer-id] [0]

8 [cipher] [CHACHA20-POLY1305]

[Feb 07, 2024, 19:53:13] PROTOCOL OPTIONS:

cipher: CHACHA20-POLY1305

digest: NONE

key-derivation: OpenVPN PRF

compress: NONE

peer ID: 0

[Feb 07, 2024, 19:53:13] EVENT: ASSIGN_IP

[Feb 07, 2024, 19:53:13] NIP: preparing TUN network settings

[Feb 07, 2024, 19:53:13] NIP: init TUN network settings with endpoint: xxx.xxx.xxx.xxx

[Feb 07, 2024, 19:53:13] NIP: adding IPv4 address to network settings 10.6.0.2/255.255.255.0

[Feb 07, 2024, 19:53:13] NIP: adding (included) IPv4 route 10.6.0.0/24

[Feb 07, 2024, 19:53:13] NIP: adding (included) IPv4 route 192.168.10.0/24

[Feb 07, 2024, 19:53:13] NIP: adding DNS 192.168.10.1

[Feb 07, 2024, 19:53:13] NIP: allowFamily(AF_INET, 1)

[Feb 07, 2024, 19:53:13] NIP: allowFamily(AF_INET6, 1)

[Feb 07, 2024, 19:53:13] NIP: adding match domain ALL

[Feb 07, 2024, 19:53:13] NIP: adding DNS specific routes:

[Feb 07, 2024, 19:53:13] NIP: adding (included) IPv4 route 192.168.10.1/32

[Feb 07, 2024, 19:53:13] Connected via NetworkExtensionTUN

[Feb 07, 2024, 19:53:13] EVENT: CONNECTED iphone@x.x.co.uk:1194 (xxx.xxx.xxx.xxx) via /UDP on NetworkExtensionTUN/10.6.0.2/ gw=[/] mtu=(default)

自动生成的客户端配置（FreshTomato 2023.5生成） #

remote x.x.x.x 1194

proto udp

dev tun

ncp-ciphers CHACHA20-POLY1305:AES-128-GCM:AES-256-GCM:AES-128-CBC:AES-256-CBC

client

remote-cert-tls server

; ca ca.pem

<ca>
... certs go here

备注：内容来源于stack exchange，提问作者RNDThoughts