Debian OpenVPN+；iptables：不转发流量

我正在尝试通过vps上带有openvpn的vpn转发流量。我过去已经在OpenVZ虚拟化服务器上成功地实现了这一点，但我无法在不同vps上的新安装上复制工作行为。我改变了提供者，因为对这个问题的范围不重要的原因

我可以使用windows客户端正确连接到vpn，但我通过计算机的公共IP而不是vps公共IP访问页面

vps运行Debian732位。服务器openvpn配置：

port 1194
proto udp
dev tun

ca      /etc/openvpn/easy-rsa/keys/ca.crt    # generated keys
cert    /etc/openvpn/easy-rsa/keys/server.crt
key     /etc/openvpn/easy-rsa/keys/server.key  # keep secret
dh      /etc/openvpn/easy-rsa/keys/dh1024.pem

server 10.9.8.0 255.255.255.0  # internal tun0 connection IP
ifconfig-pool-persist ipp.txt

keepalive 10 120

comp-lzo         # Compression - must be turned on at both end
persist-key
persist-tun

push "redirect-gateway"

status log/openvpn-status.log

verb 3  # verbose mode
client-to-client

client

dev tun

proto udp

remote my-server-ip 1194

remote-random

resolv-retry infinite

nobind

persist-key
persist-tun

mute-replay-warnings

ca   "C:\\Program Files (x86)\\OpenVPN\\config\\frankfurt\\ca.crt"
cert "C:\\Program Files (x86)\\OpenVPN\\config\\frankfurt\\nick.crt"
key  "C:\\Program Files (x86)\\OpenVPN\\config\\frankfurt\\nick.key"

comp-lzo

verb 3

keepalive 10 120

route-method exe
route-delay 2

客户端（Windows 7）openvpn配置：

port 1194
proto udp
dev tun

ca      /etc/openvpn/easy-rsa/keys/ca.crt    # generated keys
cert    /etc/openvpn/easy-rsa/keys/server.crt
key     /etc/openvpn/easy-rsa/keys/server.key  # keep secret
dh      /etc/openvpn/easy-rsa/keys/dh1024.pem

server 10.9.8.0 255.255.255.0  # internal tun0 connection IP
ifconfig-pool-persist ipp.txt

keepalive 10 120

comp-lzo         # Compression - must be turned on at both end
persist-key
persist-tun

push "redirect-gateway"

status log/openvpn-status.log

verb 3  # verbose mode
client-to-client

client

dev tun

proto udp

remote my-server-ip 1194

remote-random

resolv-retry infinite

nobind

persist-key
persist-tun

mute-replay-warnings

ca   "C:\\Program Files (x86)\\OpenVPN\\config\\frankfurt\\ca.crt"
cert "C:\\Program Files (x86)\\OpenVPN\\config\\frankfurt\\nick.crt"
key  "C:\\Program Files (x86)\\OpenVPN\\config\\frankfurt\\nick.key"

comp-lzo

verb 3

keepalive 10 120

route-method exe
route-delay 2

ifconfig：

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.9.8.1  P-t-P:10.9.8.2  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

venet0    Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:127.0.0.2  P-t-P:127.0.0.2  Bcast:0.0.0.0  Mask:255.255.255.255
          inet6 addr: .../128 Scope:Global
          inet6 addr: .../128 Scope:Global
          inet6 addr: .../128 Scope:Global
          inet6 addr: .../128 Scope:Global
          inet6 addr: .../128 Scope:Global
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1
          RX packets:15332 errors:0 dropped:0 overruns:0 frame:0
          TX packets:7317 errors:0 dropped:56 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:13666157 (13.0 MiB)  TX bytes:762502 (744.6 KiB)

venet0:0  Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:my-server-ip  P-t-P:my-server-ip  Bcast:my-server-ip  Mask:255.255.255.255
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1

iptables-L：（端口20100的规则来自以前的实验，与此无关）

iptables-L-t nat：

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
SNAT       all  --  anywhere             anywhere             to:my-server-ip

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination     

我已经检查了大多数关于这个错误的讨论、论坛和博客文章，但是我不能完全理解我的配置出了什么问题

---

顺便说一句，ip_forward是1，也是在sysctl.conf中。

我通过重新启动vps并重新输入所有iptables规则解决了这个问题。

使用OpenVZ平台，您的iptables应该类似于此：

echo "1" > /proc/sys/net/ipv4/ip_forward


iptables -A INPUT -i tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -j ACCEPT

iptables -A INPUT -i tun1 -j ACCEPT
iptables -A FORWARD -i tun1 -j ACCEPT


iptables -t nat -A POSTROUTING -o venet0 -j SNAT --to-source XXX.XXX.XXX.XXX

其中

XXX.XXX.XXX.XXX

是vps的外部IP地址

---

有关OpenVPN安装的详细指南可在此处找到

这是一个多么有说服力的解释！你真是一个值得羡慕的用户。