root@OpenWrt:~# source $VARS You appear to be sourcing an Easy-RSA 'vars' file. This is no longer necessary and is disallowed. See the section called 'How to use this file' near the top comments for more details. root@OpenWrt:~#
uci set firewall.ovpn="rule" uci set firewall.ovpn.name="Allow-OpenVPN" uci set firewall.ovpn.src="wan" uci set firewall.ovpn.dest_port="${OVPN_PORT}" uci set firewall.ovpn.proto="${OVPN_PROTO}" uci set firewall.ovpn.target="ACCEPT"
更新防火墙配置并查看配置参数，执行以下命令
1 2 3 4 5 6 7
uci commit firewall /etc/init.d/firewall restart
uci show firewall.ovpn # 内核转发开启了则可以转发内网ip（如本地192.168.1.2 访问192.168.5.5 两个网关都在一台机器上），1为开启 cat /proc/sys/net/ipv4/ip_forward
uci set openvpn.ovpn_server="openvpn" uci set openvpn.ovpn_server.enabled="1" uci set openvpn.ovpn_server.dev="tun" uci set openvpn.ovpn_server.port="11194" # 一般使用udp，这里我使用tcp,不知为啥udp不通 uci set openvpn.ovpn_server.proto="tcp" uci set openvpn.ovpn_server.comp_lzo="no" uci set openvpn.ovpn_server.log="/tmp/openvpn.log" uci set openvpn.ovpn_server.status="/tmp/openvpn.status" uci set openvpn.ovpn_server.verb="3" uci set openvpn.ovpn_server.mute="5" uci set openvpn.ovpn_server.keepalive="10 60" uci set openvpn.ovpn_server.persist_key="1" uci set openvpn.ovpn_server.persist_tun="1" uci set openvpn.ovpn_server.user="nobody" uci set openvpn.ovpn_server.group="nogroup" uci set openvpn.ovpn_server.ca="${EASYRSA_PKI}/ca.crt" uci set openvpn.ovpn_server.cert="${EASYRSA_PKI}/issued/server.crt" uci set openvpn.ovpn_server.dh="${EASYRSA_PKI}/dh.pem" uci set openvpn.ovpn_server.key="${EASYRSA_PKI}/private/server.key" uci set openvpn.ovpn_server.mode="server" uci set openvpn.ovpn_server.server="192.168.0.0 255.255.255.0" uci set openvpn.ovpn_server.tls_server="1" uci set openvpn.ovpn_server.topology="subnet" uci set openvpn.ovpn_server.route_gateway="dhcp" uci set openvpn.ovpn_server.client_to_client="1" uci commit openvpn
root@OpenWrt:/# root@OpenWrt:/# cat /tmp/openvpn.log 2023-08-08 01:57:40 --cipher is not set. Previous OpenVPN version defaulted to BF-CBC as fallback when cipher negotiation failed in this case. If you need this fallback please add '--data-ciphers-fallback BF-CBC' to your configuration and/or add BF-CBC to --data-ciphers. 2023-08-08 01:57:40 OpenVPN 2.5.7 aarch64-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] 2023-08-08 01:57:40 library versions: OpenSSL 1.1.1u 30 May 2023, LZO 2.10 2023-08-08 01:57:40 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 2023-08-08 01:57:40 Diffie-Hellman initialized with 2048 bit key 2023-08-08 01:57:40 TUN/TAP device tun0 opened 2023-08-08 01:57:40 /sbin/ip link set dev tun0 up mtu 1500 2023-08-08 01:57:40 /sbin/ip link set dev tun0 up 2023-08-08 01:57:40 /sbin/ip addr add dev tun0 192.168.0.1/24 2023-08-08 01:57:40 /usr/libexec/openvpn-hotplug up ovpn_server tun0 1500 1622 192.168.0.1 255.255.255.0 init 2023-08-08 01:57:40 Could not determine IPv4/IPv6 protocol. Using AF_INET 2023-08-08 01:57:40 Socket Buffers: R=[212992->212992] S=[212992->212992] 2023-08-08 01:57:40 UDPv4 link local (bound): [AF_INET][undef]:1193 2023-08-08 01:57:40 UDPv4 link remote: [AF_UNSPEC] 2023-08-08 01:57:40 GID set to nogroup 2023-08-08 01:57:40 UID set to nobody 2023-08-08 01:57:40 MULTI: multi_init called, r=256 v=256 2023-08-08 01:57:40 IFCONFIG POOL IPv4: base=192.168.0.2 size=253 2023-08-08 01:57:40 Initialization Sequence Completed root@OpenWrt:/# root@OpenWrt:/# cat /tmp/openvpn.status OpenVPN CLIENT LIST Updated,2023-08-08 02:00:42 Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since ROUTING TABLE Virtual Address,Common Name,Real Address,Last Ref GLOBAL STATS Max bcast/mcast queue length,0 END root@OpenWrt:/# root@OpenWrt:/#
