[问题求助][CentOS] [求助]OPENVPN客户端正常拨入　但不能使用ＶＰＮ服务地址 [复制链接]

问题现象：OPENVPN客户端正常拨入并分配到服务端分配.到的IP地址。但是客户.端还是通过本地路由器上网.
拨入后的日志
Mon May 04 10:40:22 200.9 Dat.a Channel Decrypt: Cipher. 'BF-CBC' initialized with 128 bit key[成人用品]
Mon May 04 10:40:22 2009 Data Channel Dec.rypt: Using 160 bit messa.ge hash 'SHA1' for HMAC aut.hentication           建材
Mon May .04 10:40:22 2009 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SH.A, 1024 bi.t RSA(广告)
Mon May 04 10:40:22 2009 [bing] Peer Connection Initiated with .120.32.7..1.56:1194           建材
Mon May 04 10:40:23 2009 SENT CONTROL [bing]: 'PUSH_REQUES.T' (.status=1)[成人用品]
Mon May 04 10:40:23 2009 PUSH: R.eceived control message: 'PUSH_REPLY,ro.ute 10.8..0.1,ping 10,pin.g-restart 120,ifconfig 10.8.0.10 10.8.0.9'服务器
Mon May 04 10:40:23 .2009 OPTIONS .IMPORT: timers and/or timeouts modified    外汇
Mon. May 04 10:40:23 2009 OPTIONS IMPORT: .--ifconfig/up options modified(广告)
Mon May 04 .10:40.:23 2009 OPTIONS IMPORT: route options modified    健康
Mon Ma.y 04 10:40:23 2009 TAP-WIN32 device [本地连接1] opened: \\.\Global\{96FCB602-D3E.C-46.54-8373-6FF5CF3BA3E9}.tap外贸
Mon May 04 10:4..0:23 2009 TAP-Win32 Driver Version 8.4 电脑
Mon May 04 10:40:23 200.9 T.AP-Win32 MTU=1500(        游戏          )
Mon May 04 10:40:23 2009 Notified TAP-Win3.2 .driver to set a DHCP IP/netmask of 10.8.0.10/255.255.255.252 on interface {96FCB602-D3EC-4654-8373-.6FF5CF3BA3E9} [.DHCP-se.rv: 10.8.0.9, lease-time: 31536000][成人用品]
Mon May 04 10:.40:23 2009 Successful ARP Fl.ush on interface [3] {96FCB602-D3EC-465.4-8373-6FF5CF3BA3E9}--- 印刷
Mon May 04 10:40:23 .2009 TEST RO.UTES: 0/0 succeeded .len=1 ret=0 a=0 u/d=down.
Mon May 04 10:40:2.3 2009 Route: Waiting for TUN/TAP i.nterface to come up....
Mon May 04 10:40:..24 2.009 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down    外汇
Mon May 04 10:40:24 200.9 Route: Wa.iting for TUN/TAP interface to come up...           鲜花
Mon. .May 04 10:40:25 2009. TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down--------------彩票
Mon May 04 10:40:25 2009 Route: W.aiting f.or TUN/TAP interface to come up....
Mon May 04 10:4.0:27 2009 TES.T ROUTES: 0/0 succeeded len=1 ret=0 a=0. u/d=down.
Mon May 04 10:40:27 2009 Route: Waiting for TUN./TAP interface to come. up...--------------彩票
Mon May 04 10:40:28 2009 TEST RO.UTES: 0/0. succeeded len=1 ret=0 a=0 u/d=.down          婚庆
Mon May 04 10:40:28 2009 Ro.ute: Waiting for TU.N/TAP interface to come up...             电子
Mon. May 04 10:40:29 2009 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=u.p             电子
Mon May 04 10:40:29 2009 route ADD 10.8.0.1 MASK 2.5.5.255.255.255 10.8.0.9              乙肝
Mon May 04 10:40:29 2009 Ro.ute addition via I.PAPI succeeded
Mo.n May 04 10:40:29 2009 I.nitialization Sequence Completed            杀毒
M.on May 04 11.:40:21 2009 TLS: soft reset sec=0 bytes=37274/0 pkts=710/0学习
Mon May 04 11:40:21 2009 VERIFY OK: depth=1, /C=CN/ST=FuJian/L=FuZhou/O=langbo./OU=.softwarePARK/CN=bi.ng/emailAddress=7.7441075@qq.com             汽车
Mon May 04 11:40:21 2009 VERIFY OK: dept.h=0, ./C=CN/ST=FuJian/O=langbo/OU=softwarePARK/CN=bing/emailAddress=.77441075@qq.com.
Mon May 04 11:40:21 2009 Data Channel Encrypt: Cipher. 'BF.-CBC' initialized with 128 bit k.ey虚拟主机
Mon May 04 11:40:21 200.9 Data Channel Encrypt: Using 160 bi.t message h.ash 'SHA1' for HMAC authentication投资
Mon May 04 11:40:21 2009 Data Channel Decrypt: Cipher 'BF-CBC' initialized. w.ith 1.28 bit key外贸
Mon May 04 11:40:21 20.09 Data Chann.el Decrypt: Using 160 bit message hash 'SHA1.' for HMAC authentication.
Mon May 04 11:40.:21 2009 Control. Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA.-AES256-SHA, 1024 bit RSA健康

拓扑结构：
服务端：外网+路由（19..2.168.1.1）+CentOS 5.2(19.168.1.179) 教育
　　　.　路由器动作一：映射1194到192.16.8.1.179.
　　　　　　　　　二：绑定花生壳(snifferqq...xicp.net)　.
客户端：外网+路由（172.16.88.1）+win.dows XP. SP3 (172.16.88.123)--- 印刷


服务端系统：
[root@localhost. ~]# una.me -a--------------彩票
Linux localhost.local.domain 2.6.18-128.1.6.el.5 #1 SMP Wed Apr 1 09:19:18 .EDT 2009 i686 i686 [成人用品]

i386 GNU/Linux
openvp..n版本openvpn-2.0.9.tar.gz[成人用品]

客户端
windos XP sp 3
openVPN版本openvp.n-2.0.9-gui-1.0.3-install.exe..

[ 本帖最后由 sniffer.qq 于 2009-5-4 1.7:15 编辑 ]             汽车

服务器配置方法
参考http://www.linuxha.cn/openvpn_learn_all.htm#LinkTarget_2397
服务器配置文件server.conf如下
[root@localhost etc]# grep -v \# server.conf|grep -v \;
＝＝＝＝＝＝＝＝＝＝＝＝配置文件开始＝＝＝＝＝＝＝＝
port 1194
proto udp
dev tun
ca /data0/software/openvpn-2.0.9/easy-rsa/keys/ca.crt
cert /data0/software/openvpn-2.0.9/easy-rsa/keys/server.crt
dh /data0/software/openvpn-2.0.9/easy-rsa/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /usr/local/etc/ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 4
＝＝＝＝＝＝＝＝＝＝＝配置文件结束＝＝＝＝＝＝＝＝＝＝
windows XP sp3 客户端配置文件client.ovpn
＝＝＝＝＝＝＝＝＝＝＝配置文件开始＝＝＝＝＝＝＝＝＝＝＝
client
dev tun
proto udp
remote snifferqq.xicp.net 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert snifferqq.crt
key snifferqq.key
comp-lzo
verb 3
＝＝＝＝＝＝＝＝＝＝＝＝配置文件结束＝＝＝＝＝＝＝＝＝＝＝＝

服务器上openvpn上防火墙设置如下
[root@localhost keys]# vi /etc/sysconfig/iptables
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 8080 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 1194 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

windows xp sp3 获取IP后的情况
C:\Documents and Settings\Administrator>ipconfig /all

Windows IP Configuration

        Host Name . . . . . . . . . . . . : 0FF77185ECB7403
        Primary Dns Suffix  . . . . . . . :
        Node Type . . . . . . . . . . . . : Unknown
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter 本地连接:

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : VIA Rhine II Fast Ethernet Adapter
        Physical Address. . . . . . . . . : 00-14-2A-00-01-3D
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 172.16.88.123
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 172.16.88.1
        DHCP Server . . . . . . . . . . . : 172.16.88.1
        DNS Servers . . . . . . . . . . . : 202.101.98.55
                                            218.85.157.99
        Lease Obtained. . . . . . . . . . : 2009年5月4日 星期一 9:40:35
        Lease Expires . . . . . . . . . . : 2009年5月11日 星期一 9:40:35

Ethernet adapter 本地连接1:

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : TAP-Win32 Adapter V8
        Physical Address. . . . . . . . . : 00-FF-96-FC-B6-02
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 10.8.0.10
        Subnet Mask . . . . . . . . . . . : 255.255.255.252
        Default Gateway . . . . . . . . . :
        DHCP Server . . . . . . . . . . . : 10.8.0.9
        Lease Obtained. . . . . . . . . . : 2009年5月4日 星期一 10:40:29
        Lease Expires . . . . . . . . . . : 2010年5月4日 星期二 10:40:29

给自己回复。。补充。。

没人关注呀。。

你客户端的默认路由是从路由器出去的.
要从服务器那边上,就改路由喽