之前我在TL-WR1043N上設定openvpn server,NB裝openvpn client on windows 7,在外面都可以順利連線。
(server設定為bridge mode:
server-bridge 192.168.1.1 255.255.255.0 192.168.1.202 192.168.1.205)

但是換成windows 10後(openvpn 2.3.11),卻發現連不上,會出現如下訊息:
Wed Jun 22 00:05:28 2016 PUSH: Received control message: 'PUSH_REPLY,route-gateway 192.168.1.1,ping 10,ping-restart 120,ifconfig 192.168.1.202 255.255.255.0'
Wed Jun 22 00:05:28 2016 OPTIONS IMPORT: timers and/or timeouts modified
Wed Jun 22 00:05:28 2016 OPTIONS IMPORT: --ifconfig/up options modified
Wed Jun 22 00:05:28 2016 OPTIONS IMPORT: route-related options modified
Wed Jun 22 00:05:28 2016 WARNING: Since you are using --dev tun with a point-to-point topology, the second argument to --ifconfig must be an IP address. You are using something (255.255.255.0) that looks more like a netmask. (silence this warning with --ifconfig-nowarn)
Wed Jun 22 00:05:28 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Jun 22 00:05:28 2016 MANAGEMENT: >STATE:1466525128,ASSIGN_IP,,192.168.1.202,
Wed Jun 22 00:05:28 2016 MANAGEMENT: Client disconnected
Wed Jun 22 00:05:28 2016 There is a problem in your selection of --ifconfig endpoints [local=192.168.1.202, remote=255.255.255.0]. The local and remote VPN endpoints must exist within the same 255.255.255.252 subnet. This is a limitation of --dev tun when used with the TAP-WIN32 driver. Try 'openvpn --show-valid-subnets' option for more info.
Wed Jun 22 00:05:28 2016 Exiting due to fatal error

看起來好像client讀不懂server push下來的server-bridge訊息,我應該去改哪邊的設定?
文章關鍵字
自問自答

今天早晨起床突然靈光一閃,把dev tun改成dev tap,就OK了...

所以在tun mode下不支援server-bridge?
4002呼叫,聽到請回答。
4002 wrote:
自問自答今天早晨起...(恕刪)

TUN跟TAP應該都支援Bridge功能 只是他們走的協定層不太一樣
TUN是L3 TAP則是L2 也因此TUN比較偏點對點傳輸

我猜這應該是OpenVPN規範上的問題
應該從2.3.11以後開始TUN只能限定一個網段只能使用一個IP連線
看後面的subnet規定要255.255.255.252就知道了
剛剛又去google了一下

tun (network TUNnel) 虛擬的是 點對點 設備
-simulates a network layer device
-layer 3 packets, such as IP packet
-used with routing

tap (network TAP) 虛擬的是 乙太網路 設備
-simulates an Ethernet device
-layer 2 packets, such as Ethernet frames
-used to create a network bridge

資料來源:http://linux-learning-note.blogspot.tw/2010/06/tuntap.html

所以如果VPN要使用bridge mode(因為我習慣用網路芳鄰,與內網同網段比較方便),似乎是以tap方式驅動比較穩當!!!
4002呼叫,聽到請回答。
文章分享
評分
評分
複製連結

今日熱門文章 網友點擊推薦!