[Debian 6.0.2]双网卡电脑组 OpenVPN 出现的断网现象.

Web、Mail、Ftp、DNS、Proxy、VPN、Samba、LDAP 等基础网络服务
回复
db_lobster
帖子: 168
注册时间: 2006-10-11 19:30
联系:

[Debian 6.0.2]双网卡电脑组 OpenVPN 出现的断网现象.

#1

帖子 db_lobster » 2011-10-07 11:08

借宝地一用, 不过 Debian 和 Ubuntu 当服务器的话, 差不多吧.

先说一下问题, 两块真实网卡, 经常莫名其妙的有一块突然就跟没接网线一样, 一个月前是内网卡, 现在是外网卡.
ping 不到网关.
ifconfig down up 启动网卡也不管用.
reboot 电脑后一切正常.

请帮忙看看有没有办法解决, 或者看看我这配置有没有什么问题.

系统

代码: 全选

root@hbproxy03:~# cat /etc/debian_version
6.0.2

代码: 全选

root@hbproxy03:~# uname -a
Linux hbproxy03 2.6.32-5-686 #1 SMP Fri Sep 9 20:51:05 UTC 2011 i686 GNU/Linux
硬件配置

代码: 全选

root@hbproxy03:~# lspci
00:00.0 Host bridge: Intel Corporation 82945G/GZ/P/PL Memory Controller Hub (rev 02)
00:02.0 VGA compatible controller: Intel Corporation 82945G/GZ Integrated Graphics Controller (rev 02)
00:1d.0 USB Controller: Intel Corporation N10/ICH 7 Family USB UHCI Controller #1 (rev 01)
00:1d.1 USB Controller: Intel Corporation N10/ICH 7 Family USB UHCI Controller #2 (rev 01)
00:1d.2 USB Controller: Intel Corporation N10/ICH 7 Family USB UHCI Controller #3 (rev 01)
00:1d.3 USB Controller: Intel Corporation N10/ICH 7 Family USB UHCI Controller #4 (rev 01)
00:1d.7 USB Controller: Intel Corporation N10/ICH 7 Family USB2 EHCI Controller (rev 01)
00:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev e1)
00:1e.2 Multimedia audio controller: Intel Corporation 82801G (ICH7 Family) AC'97 Audio Controller (rev 01)
00:1f.0 ISA bridge: Intel Corporation 82801GB/GR (ICH7 Family) LPC Interface Bridge (rev 01)
00:1f.1 IDE interface: Intel Corporation 82801G (ICH7 Family) IDE Controller (rev 01)
00:1f.2 IDE interface: Intel Corporation N10/ICH7 Family SATA IDE Controller (rev 01)
00:1f.3 SMBus: Intel Corporation N10/ICH 7 Family SMBus Controller (rev 01)
01:01.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL-8139/8139C/8139C+ (rev 10)
01:05.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL-8139/8139C/8139C+ (rev 10)
网卡配置
内网卡: 10.96.24.197
外网卡: 192.168.1.12 (将 ssh 和 openvpn 的端口在 TP-Link TL-WR641G 的小型路由器上做转发)
OpenVPN 网段: 192.168.240.0 255.255.255.0

代码: 全选

root@hbproxy03:~# cat /etc/network/interfaces
# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug eth0
#allow-hotplug eth1

auto eth0
iface eth0 inet static
    address 10.96.24.197
    netmask 255.255.255.0
    #gateway 10.96.24.1
    up route add -net 10.0.0.0 netmask 255.0.0.0 gw 10.96.24.1 dev eth0
    up route add -net 172.16.0.0 netmask 255.240.0.0 gw 10.96.24.1 dev eth0

auto eth1
iface eth1 inet static
    address 192.168.1.12
    netmask 255.255.255.0
    gateway 192.168.1.1
    up route add default gw 192.168.1.1
OpenVPN 设置

代码: 全选

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
# The server will take 192.168.240.1 for itself
server 192.168.240.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.0.0.0 255.0.0.0"
push "route 172.16.0.0 255.240.0.0"
;push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 10.96.24.4"
push "dhcp-option DNS 10.96.24.13"
client-to-client
keepalive 10 120
tls-auth ta.key 0 # This file is secret
comp-lzo
persist-key
persist-tun
status /var/log/openvpn-status.log
log-append  /var/log/openvpn.log
verb 3
ipatble: 增加在了 rc.local 里了

代码: 全选

root@hbproxy03:~# cat /etc/rc.local
#!/bin/sh -e

iptables -t nat -A POSTROUTING -s 192.168.240.0/24 -j SNAT --to-source 10.96.24.197

exit 0
现在的路由信息

代码: 全选

root@hbproxy03:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.240.2   *               255.255.255.255 UH    0      0        0 tun0
192.168.240.0   192.168.240.2   255.255.255.0   UG    0      0        0 tun0
10.96.24.0      *               255.255.255.0   U     0      0        0 eth0
192.168.1.0     *               255.255.255.0   U     0      0        0 eth1
172.16.0.0      10.96.24.1      255.240.0.0     UG    0      0        0 eth0
10.0.0.0        10.96.24.1      255.0.0.0       UG    0      0        0 eth0
default         192.168.1.1     0.0.0.0         UG    0      0        0 eth1
再说一下, 由于众所周知的电信/联通问题, OpenVPN 没有固定监听外网卡 IP, 本机所在外网在联通. 内网还有一台机器 (10.96.24.6) 外网在电信, 做的 UDP 转发, 将电信客户端的呼入转给本机.
Linux x80h 3.2.0-4-686-pae #1 SMP Debian 3.2.60-1+deb7u3 i686 GNU/Linux
Linux 340568 2.6.32-042stab090.5 #1 SMP Sat Jun 21 00:15:09 MSK 2014 i686 GNU/Linux
Linux GPT-Hub 3.3.8 #1 Sat Mar 23 16:49:30 UTC 2013 mips GNU/Linux
BLOG: http://blog.163.com/db_lobster/
回复