Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Подключение pfSense как OpenVPN клиента к другому серв

    Scheduled Pinned Locked Moved Russian
    14 Posts 5 Posters 3.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • X
      xpaco
      last edited by

      Пробовал по этой инструкции: http://chubbable.com/setup-pfsense-as-openvpn-client

      Не подключается, вот какие логи выдает:
      Aug 1 05:23:30 openvpn 59960 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
      Aug 1 05:23:30 openvpn 59960 NOTE: the current –script-security setting may allow this configuration to call user-defined scripts
      Aug 1 05:23:30 openvpn 59960 UDPv4 link local (bound): [AF_INET]192.168.4.108
      Aug 1 05:23:30 openvpn 59960 UDPv4 link remote: [AF_INET]37.143.14.62:1194
      Aug 1 05:23:44 openvpn 31112 OpenVPN 2.3.11 amd64-portbld-freebsd10.3 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on May 16 2016
      Aug 1 05:23:44 openvpn 31112 library versions: OpenSSL 1.0.1s-freebsd 1 Mar 2016, LZO 2.09
      Aug 1 05:23:44 openvpn 31272 WARNING: using –pull/--client and --ifconfig together is probably not what you want
      Aug 1 05:23:44 openvpn 31272 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
      Aug 1 05:23:44 openvpn 31272 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
      Aug 1 05:23:44 openvpn 31272 Control Channel Authentication: using '/var/etc/openvpn/client2.tls-auth' as a OpenVPN static key file
      Aug 1 05:23:44 openvpn 31272 UDPv4 link local (bound): [AF_INET]192.168.4.108
      Aug 1 05:23:44 openvpn 31272 UDPv4 link remote: [AF_INET]37.143.14.62:1194
      Aug 1 05:24:06 openvpn 31272 event_wait : Interrupted system call (code=4)
      Aug 1 05:24:06 openvpn 31272 SIGTERM[hard,] received, process exiting
      Aug 1 05:24:06 openvpn 34396 OpenVPN 2.3.11 amd64-portbld-freebsd10.3 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on May 16 2016
      Aug 1 05:24:06 openvpn 34396 library versions: OpenSSL 1.0.1s-freebsd 1 Mar 2016, LZO 2.09
      Aug 1 05:24:06 openvpn 34443 WARNING: using –pull/--client and --ifconfig together is probably not what you want
      Aug 1 05:24:06 openvpn 34443 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
      Aug 1 05:24:06 openvpn 34443 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
      Aug 1 05:24:06 openvpn 34443 Control Channel Authentication: using '/var/etc/openvpn/client2.tls-auth' as a OpenVPN static key file
      Aug 1 05:24:06 openvpn 34443 UDPv4 link local (bound): [AF_INET]192.168.4.108
      Aug 1 05:24:06 openvpn 34443 UDPv4 link remote: [AF_INET]37.143.14.62:1194

      1 Reply Last reply Reply Quote 0
      • X
        xpaco
        last edited by

        Попробовал сделать по видео-инструкции: https://www.youtube.com/watch?v=o9-J7amTBbo

        Но тоже нет успешного подключения :-[
        [/b]
        Aug 1 05:40:27 check_reload_status Reloading filter
        Aug 1 10:40:28 xinetd 18567 Starting reconfiguration
        Aug 1 10:40:28 xinetd 18567 Swapping defaults
        Aug 1 10:40:28 xinetd 18567 readjusting service 6969-udp
        Aug 1 10:40:28 xinetd 18567 Reconfigured: new=0 old=1 dropped=0 (services)
        Aug 1 05:40:36 check_reload_status Reloading filter
        Aug 1 10:40:37 xinetd 18567 Starting reconfiguration
        Aug 1 10:40:37 xinetd 18567 Swapping defaults
        Aug 1 10:40:37 xinetd 18567 readjusting service 6969-udp
        Aug 1 10:40:37 xinetd 18567 Reconfigured: new=0 old=1 dropped=0 (services)
        Aug 1 05:41:41 check_reload_status Syncing firewall
        Aug 1 10:41:41 kernel ovpnc1: changing name to 'tun1'
        Aug 1 05:41:50 check_reload_status Reloading filter
        Aug 1 10:41:51 xinetd 18567 Starting reconfiguration
        Aug 1 10:41:51 xinetd 18567 Swapping defaults
        Aug 1 10:41:51 xinetd 18567 readjusting service 6969-udp
        Aug 1 10:41:51 xinetd 18567 Reconfigured: new=0 old=1 dropped=0 (services)

        1 Reply Last reply Reply Quote 0
        • X
          xpaco
          last edited by

          :-[ По этой пытался сделать, тоже безуспешно(
          https://support.hidemyass.com/hc/en-us/articles/202720876-pfSense-configuration-for-routing-all-traffic-via-VPN

          [b]Логи:

          Aug 1 05:40:27 openvpn 46653 Exiting due to fatal error
          Aug 1 05:40:36 openvpn 49440 OpenVPN 2.3.11 amd64-portbld-freebsd10.3 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on May 16 2016
          Aug 1 05:40:36 openvpn 49440 library versions: OpenSSL 1.0.1s-freebsd 1 Mar 2016, LZO 2.09
          Aug 1 05:40:36 openvpn 49736 WARNING: using –pull/--client and --ifconfig together is probably not what you want
          Aug 1 05:40:36 openvpn 49736 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
          Aug 1 05:40:36 openvpn 49736 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
          Aug 1 05:40:36 openvpn 49736 OpenSSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch
          Aug 1 05:40:36 openvpn 49736 Cannot load private key file /var/etc/openvpn/client2.key
          Aug 1 05:40:36 openvpn 49736 Error: private key password verification failed
          Aug 1 05:40:36 openvpn 49736 Exiting due to fatal error
          Aug 1 05:41:05 openvpn 59960 [UNDEF] Inactivity timeout (–ping-restart), restarting
          Aug 1 05:41:05 openvpn 59960 SIGUSR1[soft,ping-restart] received, process restarting
          Aug 1 05:41:07 openvpn 59960 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
          Aug 1 05:41:07 openvpn 59960 NOTE: the current –script-security setting may allow this configuration to call user-defined scripts
          Aug 1 05:41:07 openvpn 59960 UDPv4 link local (bound): [AF_INET]192.168.4.108
          Aug 1 05:41:07 openvpn 59960 UDPv4 link remote: [AF_INET]37.143.14.62:1194
          Aug 1 05:41:41 openvpn 59960 event_wait : Interrupted system call (code=4)
          Aug 1 05:41:41 openvpn 59960 SIGTERM[hard,] received, process exiting
          Aug 1 05:41:50 openvpn 74724 OpenVPN 2.3.11 amd64-portbld-freebsd10.3 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on May 16 2016
          Aug 1 05:41:50 openvpn 74724 library versions: OpenSSL 1.0.1s-freebsd 1 Mar 2016, LZO 2.09
          Aug 1 05:41:50 openvpn 74771 WARNING: using –pull/--client and --ifconfig together is probably not what you want
          Aug 1 05:41:50 openvpn 74771 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
          Aug 1 05:41:50 openvpn 74771 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
          Aug 1 05:41:50 openvpn 74771 OpenSSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch
          Aug 1 05:41:50 openvpn 74771 Cannot load private key file /var/etc/openvpn/client2.key
          Aug 1 05:41:50 openvpn 74771 Error: private key password verification failed
          Aug 1 05:41:50 openvpn 74771 Exiting due to fatal error
          Aug 1 05:46:09 openvpn 86768 OpenVPN 2.3.11 amd64-portbld-freebsd10.3 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on May 16 2016
          Aug 1 05:46:09 openvpn 86768 library versions: OpenSSL 1.0.1s-freebsd 1 Mar 2016, LZO 2.09
          Aug 1 05:46:09 openvpn 86789 WARNING: using –pull/--client and --ifconfig together is probably not what you want
          Aug 1 05:46:09 openvpn 86789 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
          Aug 1 05:46:09 openvpn 86789 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
          Aug 1 05:46:09 openvpn 86789 OpenSSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch
          Aug 1 05:46:09 openvpn 86789 Cannot load private key file /var/etc/openvpn/client2.key
          Aug 1 05:46:09 openvpn 86789 Error: private key password verification failed
          Aug 1 05:46:09 openvpn 86789 Exiting due to fatal error
          Aug 1 05:58:16 openvpn 59695 OpenVPN 2.3.11 amd64-portbld-freebsd10.3 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on May 16 2016
          Aug 1 05:58:16 openvpn 59695 library versions: OpenSSL 1.0.1s-freebsd 1 Mar 2016, LZO 2.09
          Aug 1 05:58:16 openvpn 59968 WARNING: using –pull/--client and --ifconfig together is probably not what you want
          Aug 1 05:58:16 openvpn 59968 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
          Aug 1 05:58:16 openvpn 59968 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
          Aug 1 05:58:16 openvpn 59968 Error: private key password verification failed
          Aug 1 05:58:16 openvpn 59968 Exiting due to fatal error
          Aug 1 05:58:23 openvpn 69184 OpenVPN 2.3.11 amd64-portbld-freebsd10.3 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on May 16 2016
          Aug 1 05:58:23 openvpn 69184 library versions: OpenSSL 1.0.1s-freebsd 1 Mar 2016, LZO 2.09
          Aug 1 05:58:23 openvpn 69261 WARNING: using –pull/--client and --ifconfig together is probably not what you want
          Aug 1 05:58:23 openvpn 69261 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
          Aug 1 05:58:23 openvpn 69261 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
          Aug 1 05:58:23 openvpn 69261 Error: private key password verification failed
          Aug 1 05:58:23 openvpn 69261 Exiting due to fatal error

          1 Reply Last reply Reply Quote 0
          • P
            pigbrother
            last edited by

            OpenSSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch

            Приватный ключ задан неверно.

            1 Reply Last reply Reply Quote 0
            • X
              xpaco
              last edited by

              @pigbrother:

              OpenSSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch

              Приватный ключ задан неверно.

              Скажите, по какой инструкции лучше сделать?

              1 Reply Last reply Reply Quote 0
              • werterW
                werter
                last edited by

                2 xpaco

                Доброе
                Прочтите ЛС

                1 Reply Last reply Reply Quote 0
                • L
                  lamerrrr
                  last edited by

                  Здравствуйте.
                  Имею подобную проблему, только не особо знаю что за OpenVPN в качестве сервера c другой стороны (вроде как из комплекта UBUNTU)
                  есть набор сертификатов и ключей, и ovpn файл.
                  виндовый клиент подключается.
                  на pfsense 2.3.2
                  –-
                  Aug 4 09:10:51 openvpn 37648 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
                  Aug 4 09:10:51 openvpn 37648 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
                  Aug 4 09:10:51 openvpn 37648 Re-using SSL/TLS context
                  Aug 4 09:10:51 openvpn 37648 Control Channel MTU parms [ L:1541 D:1184 EF:66 EB:0 ET:0 EL:3 ]
                  Aug 4 09:10:51 openvpn 37648 Socket Buffers: R=[42080->42080] S=[57344->57344]
                  Aug 4 09:10:51 openvpn 37648 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:12 ET:0 EL:3 ]
                  Aug 4 09:10:51 openvpn 37648 Local Options String: 'V4,dev-type tun,link-mtu 1541,tun-mtu 1500,proto UDPv4,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
                  Aug 4 09:10:51 openvpn 37648 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1541,tun-mtu 1500,proto UDPv4,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
                  Aug 4 09:10:51 openvpn 37648 Local Options hash (VER=V4): '70f5b3af'
                  Aug 4 09:10:51 openvpn 37648 Expected Remote Options hash (VER=V4): 'a2e2498c'
                  Aug 4 09:10:51 openvpn 37648 UDPv4 link local (bound): [AF_INET]Z.Z.Z.Z
                  Aug 4 09:10:51 openvpn 37648 UDPv4 link remote: [AF_INET]X.X.X.X:1194
                  Aug 4 09:10:51 openvpn 37648 TLS: Initial packet from [AF_INET]X.X.X.X:1194, sid=f36eb0c6 7c04e91c
                  Aug 4 09:10:51 openvpn 37648 TLS Error: cannot locate HMAC in incoming packet from [AF_INET]X.X.X.X:1194
                  Aug 4 09:10:53 openvpn 37648 TLS: Initial packet from [AF_INET]X.X.X.X:1194, sid=f36eb0c6 7c04e91c
                  Aug 4 09:10:53 openvpn 37648 TLS Error: cannot locate HMAC in incoming packet from [AF_INET]X.X.X.X:1194
                  Aug 4 09:10:56 openvpn 37648 TLS: Initial packet from [AF_INET]X.X.X.X:1194, sid=f36eb0c6 7c04e91c
                  Aug 4 09:10:56 openvpn 37648 TLS Error: cannot locate HMAC in incoming packet from [AF_INET]X.X.X.X:1194
                  Aug 4 09:11:04 openvpn 37648 TLS: Initial packet from [AF_INET]X.X.X.X:1194, sid=f36eb0c6 7c04e91c
                  Aug 4 09:11:04 openvpn 37648 TLS Error: cannot locate HMAC in incoming packet from [AF_INET]X.X.X.X:1194
                  Aug 4 09:11:21 openvpn 37648 TLS: Initial packet from [AF_INET]X.X.X.X:1194, sid=f36eb0c6 7c04e91c
                  Aug 4 09:11:21 openvpn 37648 TLS Error: cannot locate HMAC in incoming packet from [AF_INET]X.X.X.X:1194
                  Aug 4 09:11:51 openvpn 37648 [UNDEF] Inactivity timeout (–ping-restart), restarting
                  Aug 4 09:11:51 openvpn 37648 TCP/UDP: Closing socket
                  Aug 4 09:11:51 openvpn 37648 SIGUSR1[soft,ping-restart] received, process restarting
                  Aug 4 09:11:51 openvpn 37648 Restart pause, 2 second(s)
                  –-

                  ovpn файл

                  dev tun
                  proto udp
                  port 1194
                  remote X.X.X.X
                  tls-client
                  remote-cert-tls server
                  route-method exe
                  route-delay 10
                  route Y.Y.Y.Y 255.255.255.0
                  pull
                  ca "ca.crt"
                  cert "vpn233.crt"
                  key "vpn233.key"
                  dh "dh1024.pem"
                  cipher BF-CBC
                  comp-lzo
                  verb 1
                  keepalive 5 60

                  подскажите куда копать?
                  спасибо.

                  1 Reply Last reply Reply Quote 0
                  • P
                    pigbrother
                    last edited by

                    dev tun
                    persist-tun
                    persist-key
                    dev tun
                    persist-tun
                    persist-key

                    cipher AES-128-CBC
                    auth SHA1 TLS Error: cannot locate HMAC in incoming packet from [AF_INET]X.X.X.X:1194

                    Неправильно настроен\отсутствует ключ для  TLS Authentication
                    В настройках клиента

                    Enable authentication of TLS packets
                    и вставить туда ключ, которого у вас похоже нет

                    В настройках конфига клиента эта директива выглядит так:

                    tls-auth tls.key 1

                    А на сервере так:
                    tls-auth /../.tls-key 0

                    1 Reply Last reply Reply Quote 0
                    • P
                      pigbrother
                      last edited by

                      Форум опять не дает редактировать сообщение, игнорируйте предыдущий пост.

                      TLS Error: cannot locate HMAC in incoming packet from [AF_INET]X.X.X.X:1194

                      Неправильно настроен\отсутствует ключ для  TLS Authentication
                      В настройках клиента pfSense нужно включить

                      Enable authentication of TLS packets
                      и вставить туда ключ как текст, которого у вас похоже нет

                      В настройках конфига клиента эта директива выглядит так:

                      tls-auth tls.key 1

                      А на сервере так:
                      tls-auth /путь/tls.key 0

                      Запросите у владельца сервера tls.key, заставить его отключить у себя tls-auth врядли выйдет.

                      1 Reply Last reply Reply Quote 0
                      • L
                        lamerrrr
                        last edited by

                        Простите, но чего то не понимаю? если недостаточно исходных данных для подключения, то как виндовый клиент подключается и работает???

                        1 Reply Last reply Reply Quote 0
                        • L
                          lamerrrr
                          last edited by

                          Гм… я чего то совсем запутался.
                          Убрал галку
                          Enable authentication of TLS packets

                          и соединение установилось. адрес в туннеле получен.
                          но все равно что-то не работает, наверное беда с правилами мсэ pfsense.

                          1 Reply Last reply Reply Quote 0
                          • K
                            kainpain
                            last edited by

                            @lamerrrr:

                            Гм… я чего то совсем запутался.
                            Убрал галку
                            Enable authentication of TLS packets

                            и соединение установилось. адрес в туннеле получен.
                            но все равно что-то не работает, наверное беда с правилами мсэ pfsense.

                            Теперь нужно настроить Routes (Gateways) и правила в FireWall;
                            · В интерфейсах добавляете vpn (Interfaces —› Assign, зелёную кнопочку "add" и далее понятно);
                            · Заходите в "System —› Routing", должно появится два VPN Gateways (ipv4 и ipv6[, почему-то я отключаю ipv6, вы как хотите], не забудьте установить им "Monitor IP"); Переходите во вкладку "Gateway Groups", создаете FailOver группу, где vpn gateway-ю устанавливаете 'Tier 1', а обычному 'Tier 2'
                            · Переходите в "Firewall" —› "Rules", создаете правило о том, что весь трафик отправлять по созданному "Gateway group" (если затруднения с созданием правила, напишите, поможем)

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.