search

wangyu- / UDPspeeder

A Tunnel which Improves your Network Quality on a High-latency Lossy Link by using Forward Error Correction, possible for All Traffics(TCP/UDP/ICMP)
MIT License
4.74k stars 833 forks source link

server:openvpn+udpspeeder with centos7, client:openvpn+udpspeeder with windows10+virtual box+lede 可以成功建立连接但连上之后无法正常上网。 #60

Closed daoye closed 7 years ago

daoye commented 7 years ago

现象为：openvpn客户端与服务端直接互联能够成功，客户端所有流量能正常的被服务端全部转发；当over udpspeeder之后，openvpn客户端与服务端能够连接成功，但是所有流量都没有被转发出去，就是打不开网页也上不了网了，只有VPN是正常连接的。

我折腾了几天，但不太懂iptables，也不太清楚这个数据究竟是有哪些转发过程，所以不知道故障出现在哪个地方。请懂得朋友能帮我诊断一下。

谢谢。

VPS相关信息

openvpn 配置如下：

local 0.0.0.0 port 1194 proto udp dev tun tun-mtu 1200

ca keys/ca.crt cert keys/server.crt key keys/server.key dh keys/dh2048.pem

server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt

client-config-dir ccd

push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 8.8.4.4"

duplicate-cn keepalive 10 120

user nobody group nobody

persist-key persist-tun

;status openvpn-status.log ;log-append openvpn.log

verb 3 mute 20

comp-lzo no cipher none auth none

fragment 1200 mssfix 1200

sndbuf 2000000 rcvbuf 2000000 txqueuelen 4000

iptables 输出如下：

iptables-save # Generated by iptables-save v1.4.21 on Sat Nov 4 12:52:19 2017 filter :INPUT ACCEPT [12984:1886251] :FORWARD ACCEPT [4201:2616447] :OUTPUT ACCEPT [16158:4474828] COMMIT # Completed on Sat Nov 4 12:52:19 2017 # Generated by iptables-save v1.4.21 on Sat Nov 4 12:52:19 2017 nat :PREROUTING ACCEPT [64918:9045166] :INPUT ACCEPT [42084:4327175] :OUTPUT ACCEPT [40872:3311370] :POSTROUTING ACCEPT [40872:3311370] -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE COMMIT # Completed on Sat Nov 4 12:52:19 2017

Udpspeeder 参数如下：

./speederv2_amd64 -s -l0.0.0.0:4096 -r0.0.0.0:1194 -f20:10 -k "passwd" --mtu 1200

客户端相关信息

openvpn over udpspeederv2 配置如下：

client dev tun proto udp tun-mtu 1200 remote 192.168.3.18 3333 resolv-retry infinite nobind persist-key persist-tun mute-replay-warnings ca ca.crt cert client.crt key client.key verb 3 mute 20

cipher AES-256-CBC

comp-lzo no cipher none auth none

fragment 1200 mssfix 1200

sndbuf 2000000 rcvbuf 2000000

LEDE iptables 如下：

# Generated by iptables-save v1.4.21 on Sat Nov 4 05:01:51 2017 nat :PREROUTING ACCEPT [16:1972] :INPUT ACCEPT [16:1972] :OUTPUT ACCEPT [127:9534] :POSTROUTING ACCEPT [127:9534] :postrouting_lan_rule - [0:0] :postrouting_rule - [0:0] :postrouting_wan_rule - [0:0] :prerouting_lan_rule - [0:0] :prerouting_rule - [0:0] :prerouting_wan_rule - [0:0] :zone_lan_postrouting - [0:0] :zone_lan_prerouting - [0:0] :zone_wan_postrouting - [0:0] :zone_wan_prerouting - [0:0] -A PREROUTING -m comment --comment "!fw3: user chain for prerouting" -j prerouting_rule -A PREROUTING -i eth0 -m comment --comment "!fw3" -j zone_lan_prerouting -A POSTROUTING -m comment --comment "!fw3: user chain for postrouting" -j postrouting_rule -A POSTROUTING -o eth0 -m comment --comment "!fw3" -j zone_lan_postrouting -A zone_lan_postrouting -m comment --comment "!fw3: user chain for postrouting" -j postrouting_lan_rule -A zone_lan_prerouting -m comment --comment "!fw3: user chain for prerouting" -j prerouting_lan_rule -A zone_wan_postrouting -m comment --comment "!fw3: user chain for postrouting" -j postrouting_wan_rule -A zone_wan_postrouting -m comment --comment "!fw3" -j MASQUERADE -A zone_wan_prerouting -m comment --comment "!fw3: user chain for prerouting" -j prerouting_wan_rule COMMIT # Completed on Sat Nov 4 05:01:51 2017 # Generated by iptables-save v1.4.21 on Sat Nov 4 05:01:51 2017 mangle :PREROUTING ACCEPT [1887:286049] :INPUT ACCEPT [1887:286049] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [1495:279495] :POSTROUTING ACCEPT [1495:279495] COMMIT # Completed on Sat Nov 4 05:01:51 2017 # Generated by iptables-save v1.4.21 on Sat Nov 4 05:01:51 2017 *filter :INPUT ACCEPT [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :forwarding_lan_rule - [0:0] :forwarding_rule - [0:0] :forwarding_wan_rule - [0:0] :input_lan_rule - [0:0] :input_rule - [0:0] :input_wan_rule - [0:0] :output_lan_rule - [0:0] :output_rule - [0:0] :output_wan_rule - [0:0] :reject - [0:0] :syn_flood - [0:0] :zone_lan_dest_ACCEPT - [0:0] :zone_lan_forward - [0:0] :zone_lan_input - [0:0] :zone_lan_output - [0:0] :zone_lan_src_ACCEPT - [0:0] :zone_wan_dest_ACCEPT - [0:0] :zone_wan_dest_REJECT - [0:0] :zone_wan_forward - [0:0] :zone_wan_input - [0:0] :zone_wan_output - [0:0] :zone_wan_src_REJECT - [0:0] -A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT -A INPUT -m comment --comment "!fw3: user chain for input" -j input_rule -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m comment --comment "!fw3" -j syn_flood -A INPUT -i eth0 -m comment --comment "!fw3" -j zone_lan_input -A FORWARD -m comment --comment "!fw3: user chain for forwarding" -j forwarding_rule -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A FORWARD -i eth0 -m comment --comment "!fw3" -j zone_lan_forward -A FORWARD -m comment --comment "!fw3" -j reject -A OUTPUT -o lo -m comment --comment "!fw3" -j ACCEPT -A OUTPUT -m comment --comment "!fw3: user chain for output" -j output_rule -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT -A OUTPUT -o eth0 -m comment --comment "!fw3" -j zone_lan_output -A reject -p tcp -m comment --comment "!fw3" -j REJECT --reject-with tcp-reset -A reject -m comment --comment "!fw3" -j REJECT --reject-with icmp-port-unreachable -A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -m comment --comment "!fw3" -j RETURN -A syn_flood -m comment --comment "!fw3" -j DROP -A zone_lan_dest_ACCEPT -o eth0 -m comment --comment "!fw3" -j ACCEPT -A zone_lan_forward -m comment --comment "!fw3: user chain for forwarding" -j forwarding_lan_rule -A zone_lan_forward -m comment --comment "!fw3: forwarding lan -> wan" -j zone_wan_dest_ACCEPT -A zone_lan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT -A zone_lan_forward -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT -A zone_lan_input -m comment --comment "!fw3: user chain for input" -j input_lan_rule -A zone_lan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT -A zone_lan_input -m comment --comment "!fw3" -j zone_lan_src_ACCEPT -A zone_lan_output -m comment --comment "!fw3: user chain for output" -j output_lan_rule -A zone_lan_output -m comment --comment "!fw3" -j zone_lan_dest_ACCEPT -A zone_lan_src_ACCEPT -i eth0 -m conntrack --ctstate NEW,UNTRACKED -m comment --comment "!fw3" -j ACCEPT -A zone_wan_forward -m comment --comment "!fw3: user chain for forwarding" -j forwarding_wan_rule -A zone_wan_forward -p esp -m comment --comment "!fw3: Allow-IPSec-ESP" -j zone_lan_dest_ACCEPT -A zone_wan_forward -p udp -m udp --dport 500 -m comment --comment "!fw3: Allow-ISAKMP" -j zone_lan_dest_ACCEPT -A zone_wan_forward -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port forwards" -j ACCEPT -A zone_wan_forward -m comment --comment "!fw3" -j zone_wan_dest_REJECT -A zone_wan_input -m comment --comment "!fw3: user chain for input" -j input_wan_rule -A zone_wan_input -p udp -m udp --dport 68 -m comment --comment "!fw3: Allow-DHCP-Renew" -j ACCEPT -A zone_wan_input -p icmp -m icmp --icmp-type 8 -m comment --comment "!fw3: Allow-Ping" -j ACCEPT -A zone_wan_input -p igmp -m comment --comment "!fw3: Allow-IGMP" -j ACCEPT -A zone_wan_input -m conntrack --ctstate DNAT -m comment --comment "!fw3: Accept port redirections" -j ACCEPT -A zone_wan_input -m comment --comment "!fw3" -j zone_wan_src_REJECT -A zone_wan_output -m comment --comment "!fw3: user chain for output" -j output_wan_rule -A zone_wan_output -m comment --comment "!fw3" -j zone_wan_dest_ACCEPT COMMIT # Completed on Sat Nov 4 05:01:51 2017

Udpspeeder 参数如下：

./speederv2_x86 -c -l0.0.0.0:3333 -rx.x.x.x:4096 -f20:10 -k "passwd"

lede虚拟机网卡配置如下

1

wangyu- commented 7 years ago

https://github.com/wangyu-/UDPspeeder/issues/55

你参考一下这个issue，我贴出了完整配置，除了VPS是debian系统，环境跟你完全一样。

wangyu- commented 7 years ago

或者直接看这个：

https://github.com/wangyu-/UDPspeeder/wiki/win10系统UDPspeeder-OpenVPN的完整设置

daoye commented 7 years ago

我跟这位仁兄的情况非常相似，甚至可以说一毛一样。 vps也是centos。 但这位仁兄的问题也没有解决到。 同样，我也发现了这个个有趣的现象。 当我连上openvpn之后，可以正常ping通我的lede虚拟机，但当我over speeder，并连上openvpn之后，就无法再ping通lede虚拟机了，但我的网关仍然可以ping通。 所以我猜是不是windows的路由表设置的有问题，或者是客户端的其他连接出现了问题。

哦，对，我记起了，我这种方式配置好了之后，在macOS上是能够正常访问网站的！！！就是windows上不行！！

wangyu- commented 7 years ago

@Hadsital @daoye

检查一下防火墙，能关掉的全关掉。暂时把UAC也关掉。用管理员身份运行OpenVPN

daoye commented 7 years ago

贴上windows 的路由表，不知道有没有什么问题。

接口列表 13...80 fa 5b 32 1a 2a ......Realtek PCIe GBE Family Controller 6...ac 2b 6e 05 94 ee ......Microsoft Wi-Fi Direct Virtual Adapter 7...00 ff 59 ea 78 80 ......TAP-Windows Adapter V9 3...ac 2b 6e 05 94 ed ......Intel(R) Dual Band Wireless-AC 3165 15...ac 2b 6e 05 94 f1 ......Bluetooth Device (Personal Area Network) 1...........................Software Loopback Interface 1 26...00 00 00 00 00 00 00 e0 Microsoft Teredo Tunneling Adapter

IPv4 路由表

活动路由: 网络目标 网络掩码 网关 接口 跃点数 0.0.0.0 0.0.0.0 192.168.3.1 192.168.3.3 35 127.0.0.0 255.0.0.0 在链路上 127.0.0.1 331 127.0.0.1 255.255.255.255 在链路上 127.0.0.1 331 127.255.255.255 255.255.255.255 在链路上 127.0.0.1 331 192.168.3.0 255.255.255.0 在链路上 192.168.3.3 291 192.168.3.3 255.255.255.255 在链路上 192.168.3.3 291 192.168.3.255 255.255.255.255 在链路上 192.168.3.3 291 224.0.0.0 240.0.0.0 在链路上 127.0.0.1 331 224.0.0.0 240.0.0.0 在链路上 192.168.3.3 291 255.255.255.255 255.255.255.255 在链路上 127.0.0.1 331 255.255.255.255 255.255.255.255 在链路上 192.168.3.3 291

daoye commented 7 years ago

连上vpn之后的路由表 IPv4 路由表

活动路由: 网络目标 网络掩码 网关 接口 跃点数 0.0.0.0 0.0.0.0 192.168.3.1 192.168.3.3 35 0.0.0.0 128.0.0.0 10.8.0.9 10.8.0.10 35 10.8.0.1 255.255.255.255 10.8.0.9 10.8.0.10 35 10.8.0.8 255.255.255.252 在链路上 10.8.0.10 291 10.8.0.10 255.255.255.255 在链路上 10.8.0.10 291 10.8.0.11 255.255.255.255 在链路上 10.8.0.10 291 103.27.185.53 255.255.255.255 192.168.3.1 192.168.3.3 35 127.0.0.0 255.0.0.0 在链路上 127.0.0.1 331 127.0.0.1 255.255.255.255 在链路上 127.0.0.1 331 127.255.255.255 255.255.255.255 在链路上 127.0.0.1 331 128.0.0.0 128.0.0.0 10.8.0.9 10.8.0.10 35 192.168.3.0 255.255.255.0 在链路上 192.168.3.3 291 192.168.3.3 255.255.255.255 在链路上 192.168.3.3 291 192.168.3.255 255.255.255.255 在链路上 192.168.3.3 291 224.0.0.0 240.0.0.0 在链路上 127.0.0.1 331 224.0.0.0 240.0.0.0 在链路上 192.168.3.3 291 224.0.0.0 240.0.0.0 在链路上 10.8.0.10 291 255.255.255.255 255.255.255.255 在链路上 127.0.0.1 331 255.255.255.255 255.255.255.255 在链路上 192.168.3.3 291 255.255.255.255 255.255.255.255 在链路上 10.8.0.10 291

wangyu- commented 7 years ago

我建议你把openVPN的两端配置改成和我的完全一样；把VPS的iptables清空，只添加我推荐给你的那条命令：iptables -t nat -A POSTROUTING -s 10.222.0.0/16 -j SNAT --to-source 44.55.66.77，暂时用SNAT，不用MASQUERADE。

另外： 检查一下防火墙，能关掉的全关掉。暂时把UAC也关掉。用管理员身份运行OpenVPN

wangyu- commented 7 years ago

我看了'连上vpn之后的路由表'，这个路由表不应该会ping虚拟机的ip ping不通。

怀疑是防火墙问题，要么就是有流氓软件劫持了流量之类。我的win10上没装过任何国产软件，国产的都是装在一台win7虚拟机里的。

可以试试winsock修复。

netsh interface ipv4 reset
netsh interface ipv6 reset
netsh winsock reset
Skyblockrh commented 7 years ago

确实 我真的暂时找不出咱俩的问题有什么不同 @daoye 如果你最后解决了问题 请务必告诉我解决办法 /苦笑

Skyblockrh commented 7 years ago

顺便贴一下我挂上之后的 win 路由吧 tim 20171104162449

Skyblockrh commented 7 years ago

说下我的情况吧 UAC已经关掉了 本地虚拟机的iptables也关了 服务器的iptables动了之后我又还原了 如果不用MASQUERADE的话 不仅裸连不能上网 且over speeder无法连接

Skyblockrh commented 7 years ago

现在的想法是用screen运行udpspeeder 然后连接VPN 并traceroute看 一下路由 但是貌似-R的时候会提示bad file descriptor

leepoi commented 7 years ago

https://github.com/Nyr/openvpn-install 试试这个，有各种判定

leepoi commented 7 years ago

哦，不对，你好像单独使用openvpn的话，是能用的。。。

leepoi commented 7 years ago

我自己弄了半天openvpn都只能连接不能上网，也ping不通，用了一下这个脚本，openvpn立马正常了，我已经对生活失去了信心。。。。。。。。。

Skyblockrh commented 7 years ago

还好吧 准备换debian试试了 不过估计效果不会太好

daoye commented 7 years ago

这绝对是有什么地方配置不对，不过我不打算继续再这上面浪费时间了。 我准备淘个树莓派或者OpenWrt路由。 谢谢大家关注！

leepoi commented 6 years ago

我一开始也这样，最后把win10的默认网关设置为udpspeeder所在的本地树莓派的ip，瞬间就打开网页了

wangyu- commented 6 years ago

这个问题貌似是`push "redirect-gateway def1 bypass-dhcp"的bug。

去掉push "redirect-gateway def1 bypass-dhcp"，手动在win10上添加路由表可以解决。

https://github.com/wangyu-/UDPspeeder/issues/108