原文由 sse-cmm 於 2008-8-25 19:27 發表
因為您之前的一段話：「剛才又再試了一次, 發現原來錯誤是... openvpn-2.1_rc9-install.exe 這個版本有問題」，
所以，我才會想說是版本的問題嗎？
才會給您舊版的連結。
但rc9是穩定版，似乎不太可能會有問題 ...

抱歉哦, 最近身體欠安, 所以現在才會覆...  
我有跟您回報過, 我的安裝及設定步驟從 2.0.9 到 2.1rc9 並無改變耶, keys 的子目錄也當然有建; 至於我所下載的網址是從  http://openvpn.net/index.php/downloads.html 的 http://openvpn.net/release/openvpn-2.1_rc9-install.exe 下載, 當中似乎好像並沒有分 gui / non-gui 版本... 好像是安裝時它會問是否有安裝 gui 選項?
不知道我所說的是否正確, 還請您指點.
另外我使用 2.0.9 版並使用了您所提供的參數 (tun 方式), 還是無法正確 ping vpn server, 不知道還有哪裡有遺漏的.
真是不好意思, 太謝謝您了.

這......
我想您真的誤會我前面的文件了，
有gui版，安裝完後，右下角會有個小圖示，
第47個圖片，

若不是安裝gui版的話，
只能使用「命令提示字元」來啟動會比較麻煩，
gui版的可以設定一開機馬上連線，
非gui版的似乎沒有這個功能？(我忘了)

所以，我通常都是安裝gui版的哩。

您說您不能ping到主機，
那麼網芳、iis、ftp那些服務能抓得到嗎？
我是都能使用這些服務，所以就不太管能不能ping了耶。
(您伺服器、用戶端有安裝非微軟內建的防火牆嗎？)

我剛剛將gui版的移除，重開機後，
再裝一次非gui版，但產生key都沒問題耶，
只是我不會非gui版的啟動，哈！

[ 本文最後由 sse-cmm 於 2008-8-28 21:07 編輯 ]

原文由 sse-cmm 於 2008-8-28 20:49 發表
這......
我想您真的誤會我前面的文件了，
有gui版，安裝完後，右下角會有個小圖示，
第47個圖片，

若不是安裝gui版的話，
只能使用「命令提示字元」來啟動會比較麻煩，
gui版的可以設定一開機馬上連線，
非 ...

您的意思是說 gui / non-gui 是兩個不同的下載路徑嗎? 我下載的 http://openvpn.net/release/openvpn-2.1_rc9-install.exe 在安裝時會問是否要安裝 gui, 選是的話, 在桌面就會產生一個 gui 的 icon; 如果是非 gui 版 (2.0.9 好像就是...) 則是要啟動 openvpn 的 service, 就可以連線了.
您說您有移除 gui 版本, 另外安裝了 non-gui 版本後, 一樣是可以正常 config 及啟動嗎? 請問也是 2.1rc9 的版本嗎? 好奇怪哦... 我是第一次安裝就不行耶...
另外我用 2.0.9 連線成功 (用的是您的參數 - tun ) 後, 網芳 (我是用 net view 去看) 也都不行.... 而 server (win2008) 及 client (winxp) 的防火牆也都確定關了.

[ 本文最後由 eddie1 於 2008-8-29 15:05 編輯 ]

gui版下載的路徑是：http://openvpn.se/files/install_ ... i-1.0.3-install.exe
非gui版則是：http://openvpn.net/release/openvpn-2.0.9-install.exe

天呀，原來...
您下載的是2.1版，那個似乎是beta版耶，
原來2.1版會直接安裝gui版...

但...如果您的系統沒有vista的話，建議您使用穩定版，
請下載2.0.9gui版那個再試看看；

我有空來研究2.1版看看是不是這個版本有問題。

===修改文章如下===
嗯，我剛移掉2.0.9版，安裝2.1版，
確實會發生您所說的，我是出現openssl啥的錯誤，
之後也是出現找不到*.old的字眼，

您若沒有vista系統，建議您先使用穩定版的再試看看囉。

[ 本文最後由 sse-cmm 於 2008-8-29 21:42 編輯 ]

原文由 sse-cmm 於 2008-8-29 21:14 發表
gui版下載的路徑是：http://openvpn.se/files/install_ ... i-1.0.3-install.exe
非gui版則是：http://openvpn.net/release/openvpn-2.0.9-install.exe
天呀，原來...
您下載的是2.1版，那 ...

唉呀呀... 原來 gui 版的下載路徑是不同的....  真是慚愧
我先下載 gui 版本來試試, 再跟您回報. 感謝唷.
----------------------------------------------------------------------------------------------
剛才試過了 gui 版本, 也是一樣可以順利連線, 但是.... 問題一樣 : ping 不到, net view 也看不到...
不知道如果我將 client.log / server.log 貼上的話, 是否會比較容易知道問題所在呢?

[ 本文最後由 eddie1 於 2008-8-30 10:26 編輯 ]

好的，那請您貼上LOG好了，
(不過log是有點難查，需一條條比對，
我之前連線成功就沒管log檔了，
您貼出來後，我再比對看看)

P.S.最近外祖母來住我家，
比較忙一點，嗚~~電視也被她罷佔住，
我只能跟著看娘家等......我之前不想看的電視

原文由 sse-cmm 於 2008-8-31 09:26 發表
好的，那請您貼上LOG好了，
(不過log是有點難查，需一條條比對，
我之前連線成功就沒管log檔了，
您貼出來後，我再比對看看)

P.S.最近外祖母來住我家，
比較忙一點，嗚~~電視也被她罷佔住，
我只能跟著看娘家 ...

哇勒... 檔案文字一堆...  您先看看, 如果太長... 那我想辦法讓您用下載的好了... 真是抱歉
Client log :
Sat Aug 30 10:16:05 2008 OpenVPN 2.0.9 Win32-MinGW [SSL] [LZO] built on Oct  1 2006
Sat Aug 30 10:16:05 2008 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Sat Aug 30 10:16:05 2008 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sat Aug 30 10:16:05 2008 LZO compression initialized
Sat Aug 30 10:16:05 2008 Control Channel MTU parms [ L:1560 D:140 EF:40 EB:0 ET:0 EL:0 ]
Sat Aug 30 10:16:05 2008 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:135 ET:0 EL:0 AF:3/1 ]
Sat Aug 30 10:16:05 2008 Local Options hash (VER=V4): 'bc07730e'
Sat Aug 30 10:16:05 2008 Expected Remote Options hash (VER=V4): 'b695cb4a'
Sat Aug 30 10:16:05 2008 Attempting to establish TCP connection with xxx.xxx.xxx.xxx:1194
Sat Aug 30 10:16:06 2008 TCP connection established with xxx.xxx.xxx.xxx:1194
Sat Aug 30 10:16:06 2008 TCPv4_CLIENT link local: [undef]
Sat Aug 30 10:16:06 2008 TCPv4_CLIENT link remote: xxx.xxx.xxx.xxx:1194
Sat Aug 30 10:16:06 2008 TLS: Initial packet from xxx.xxx.xxx.xxx:1194, sid=16d7efe2 c23199d1
Sat Aug 30 10:16:12 2008 VERIFY OK: depth=1, /C=TW/ST=TW/L=Taipei/O=xx/OU=xx/CN=SRV2/emailAddress=xx@xx.net.tw
Sat Aug 30 10:16:12 2008 VERIFY OK: depth=0, /C=TW/ST=TW/O=HITECH/OU=xx/CN=SRV2/emailAddress=xx@xxnet.tw
Sat Aug 30 10:16:24 2008 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1560', remote='link-mtu 1544'
Sat Aug 30 10:16:24 2008 WARNING: 'cipher' is used inconsistently, local='cipher AES-128-CBC', remote='cipher BF-CBC'
Sat Aug 30 10:16:24 2008 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sat Aug 30 10:16:24 2008 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Aug 30 10:16:24 2008 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sat Aug 30 10:16:24 2008 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Aug 30 10:16:24 2008 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sat Aug 30 10:16:24 2008 [SRV2] Peer Connection Initiated with xxx.xxx.xxx.xxx:1194
Sat Aug 30 10:16:26 2008 SENT CONTROL [SRV2]: 'PUSH_REQUEST' (status=1)
Sat Aug 30 10:16:27 2008 PUSH: Received control message: 'PUSH_REPLY,route 192.168.2.0 255.255.255.0,route 192.168.2.0 255.255.255.0,ping 10,ping-restart 120,ifconfig 192.168.2.6 192.168.2.5'
Sat Aug 30 10:16:27 2008 OPTIONS IMPORT: timers and/or timeouts modified
Sat Aug 30 10:16:27 2008 OPTIONS IMPORT: --ifconfig/up options modified
Sat Aug 30 10:16:27 2008 OPTIONS IMPORT: route options modified
Sat Aug 30 10:16:27 2008 TAP-WIN32 device [區域連線 5] opened: \\.\Global\{6B4F8242-8A6B-48DB-A8EF-EAC15D41F452}.tap
Sat Aug 30 10:16:27 2008 TAP-Win32 Driver Version 8.4
Sat Aug 30 10:16:27 2008 TAP-Win32 MTU=1500
Sat Aug 30 10:16:27 2008 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.2.6/255.255.255.252 on interface {6B4F8242-8A6B-48DB-A8EF-EAC15D41F452} [DHCP-serv: 192.168.2.5, lease-time: 31536000]
Sat Aug 30 10:16:27 2008 Successful ARP Flush on interface [131074] {6B4F8242-8A6B-48DB-A8EF-EAC15D41F452}
Sat Aug 30 10:16:27 2008 TEST ROUTES: 0/0 succeeded len=2 ret=0 a=0 u/d=down
Sat Aug 30 10:16:27 2008 Route: Waiting for TUN/TAP interface to come up...
Sat Aug 30 10:16:28 2008 TEST ROUTES: 0/0 succeeded len=2 ret=0 a=0 u/d=down
Sat Aug 30 10:16:28 2008 Route: Waiting for TUN/TAP interface to come up...
Sat Aug 30 10:16:29 2008 TEST ROUTES: 0/0 succeeded len=2 ret=0 a=0 u/d=down
Sat Aug 30 10:16:29 2008 Route: Waiting for TUN/TAP interface to come up...
Sat Aug 30 10:16:30 2008 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Sat Aug 30 10:16:30 2008 route ADD 192.168.2.0 MASK 255.255.255.0 192.168.2.5
Sat Aug 30 10:16:30 2008 Route addition via IPAPI succeeded
Sat Aug 30 10:16:30 2008 route ADD 192.168.2.0 MASK 255.255.255.0 192.168.2.5
Sat Aug 30 10:16:30 2008 Route addition via IPAPI succeeded
Sat Aug 30 10:16:30 2008 Initialization Sequence Completed
Sat Aug 30 10:16:36 2008 Authenticate/Decrypt packet error: cipher final failed
Sat Aug 30 10:16:36 2008 Fatal decryption error (process_incoming_link), restarting
Sat Aug 30 10:16:36 2008 TCP/UDP: Closing socket
Sat Aug 30 10:16:36 2008 SIGUSR1[soft,decryption-error] received, process restarting
Sat Aug 30 10:16:36 2008 Restart pause, 5 second(s)

Sat Aug 30 10:23:41 2008 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Sat Aug 30 10:23:41 2008 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sat Aug 30 10:23:41 2008 Re-using SSL/TLS context
Sat Aug 30 10:23:41 2008 LZO compression initialized
Sat Aug 30 10:23:41 2008 Control Channel MTU parms [ L:1560 D:140 EF:40 EB:0 ET:0 EL:0 ]
Sat Aug 30 10:23:41 2008 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:135 ET:0 EL:0 AF:3/1 ]
Sat Aug 30 10:23:41 2008 Local Options hash (VER=V4): 'bc07730e'
Sat Aug 30 10:23:41 2008 Expected Remote Options hash (VER=V4): 'b695cb4a'
Sat Aug 30 10:23:41 2008 Attempting to establish TCP connection with xxx.xxx.xxx.xxx:1194
Sat Aug 30 10:23:41 2008 TCP connection established with xxx.xxx.xxx.xxx:1194
Sat Aug 30 10:23:41 2008 TCPv4_CLIENT link local: [undef]
Sat Aug 30 10:23:41 2008 TCPv4_CLIENT link remote: xxx.xxx.xxx.xxx:1194
Sat Aug 30 10:23:41 2008 TLS: Initial packet from xxx.xxx.xxx.xxx:1194, sid=50b92c31 cde1b94b
Sat Aug 30 10:23:47 2008 VERIFY OK: depth=1, /C=TW/ST=TW/L=Taipei/O=xx/OU=HITECH/CN=SRV2/emailAddress=xx@xx.net.tw
Sat Aug 30 10:23:47 2008 VERIFY OK: depth=0, /C=TW/ST=TW/O=xx/OU=xx/CN=SRV2/emailAddress=xx@xx.net.tw
Sat Aug 30 10:23:57 2008 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1560', remote='link-mtu 1544'
Sat Aug 30 10:23:57 2008 WARNING: 'cipher' is used inconsistently, local='cipher AES-128-CBC', remote='cipher BF-CBC'
Sat Aug 30 10:23:57 2008 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sat Aug 30 10:23:57 2008 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Aug 30 10:23:57 2008 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sat Aug 30 10:23:57 2008 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Aug 30 10:23:57 2008 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sat Aug 30 10:23:57 2008 [SRV2] Peer Connection Initiated with xxx.xxx.xxx.xxx:1194
Sat Aug 30 10:23:58 2008 SENT CONTROL [SRV2]: 'PUSH_REQUEST' (status=1)
Sat Aug 30 10:23:58 2008 TCP/UDP: Closing socket
Sat Aug 30 10:23:58 2008 route DELETE 192.168.2.0 MASK 255.255.255.0 192.168.2.5
Sat Aug 30 10:23:58 2008 Route deletion via IPAPI succeeded
Sat Aug 30 10:23:58 2008 route DELETE 192.168.2.0 MASK 255.255.255.0 192.168.2.5
Sat Aug 30 10:23:58 2008 ROUTE: route deletion failed using DeleteIpForwardEntry: 參數錯誤。  
Sat Aug 30 10:23:58 2008 Route deletion via IPAPI failed
Sat Aug 30 10:23:58 2008 Closing TUN/TAP interface
Sat Aug 30 10:23:58 2008 SIGTERM[hard,] received, process exiting

Server log :
Sat Aug 30 10:14:05 2008 OpenVPN 2.0.9 Win32-MinGW [SSL] [LZO] built on Oct  1 2006
Sat Aug 30 10:14:06 2008 Diffie-Hellman initialized with 2048 bit key
Sat Aug 30 10:14:06 2008 TLS-Auth MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Sat Aug 30 10:14:06 2008 TAP-WIN32 device [區域連線 3] opened:

\\.\Global\{B58252BD-9FF4-410E-8A29-846878BBDB51}.tap
Sat Aug 30 10:14:06 2008 TAP-Win32 Driver Version 8.4
Sat Aug 30 10:14:06 2008 TAP-Win32 MTU=1500
Sat Aug 30 10:14:06 2008 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.2.1/255.255.255.252 on interface {B58252BD-9FF4-410E-

8A29-846878BBDB51} [DHCP-serv: 192.168.2.2, lease-time: 31536000]
Sat Aug 30 10:14:06 2008 Sleeping for 10 seconds...
Sat Aug 30 10:14:16 2008 Successful ARP Flush on interface [16] {B58252BD-9FF4-410E-8A29-846878BBDB51}
Sat Aug 30 10:14:16 2008 route ADD 192.168.2.128 MASK 255.255.255.0 192.168.2.2
Sat Aug 30 10:14:16 2008 Warning: address 192.168.2.128 is not a network address in relation to netmask 255.255.255.0
Sat Aug 30 10:14:16 2008 ROUTE: route addition failed using CreateIpForwardEntry: 有一些引數不正確。   [if_index=16]
Sat Aug 30 10:14:16 2008 Route addition via IPAPI failed
Sat Aug 30 10:14:16 2008 route ADD 192.168.2.0 MASK 255.255.255.0 192.168.2.2
Sat Aug 30 10:14:16 2008 ROUTE: route addition failed using CreateIpForwardEntry: 有一些引數不正確。   [if_index=16]
Sat Aug 30 10:14:16 2008 Route addition via IPAPI failed
Sat Aug 30 10:14:16 2008 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Sat Aug 30 10:14:16 2008 Listening for incoming TCP connection on xxx.xxx.xxx.xxx:1194
Sat Aug 30 10:14:16 2008 TCPv4_SERVER link local (bound): xxx.xxx.xxx.xxx:1194
Sat Aug 30 10:14:16 2008 TCPv4_SERVER link remote: [undef]
Sat Aug 30 10:14:16 2008 MULTI: multi_init called, r=256 v=256
Sat Aug 30 10:14:16 2008 IFCONFIG POOL: base=192.168.2.4 size=62
Sat Aug 30 10:14:16 2008 IFCONFIG POOL LIST
Sat Aug 30 10:14:16 2008 MULTI: TCP INIT maxclients=60 maxevents=64
Sat Aug 30 10:14:16 2008 Initialization Sequence Completed
Sat Aug 30 10:14:56 2008 MULTI: multi_create_instance called
Sat Aug 30 10:14:56 2008 Re-using SSL/TLS context
Sat Aug 30 10:14:56 2008 LZO compression initialized
Sat Aug 30 10:14:56 2008 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Sat Aug 30 10:14:56 2008 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Sat Aug 30 10:14:56 2008 Local Options hash (VER=V4): 'c0103fa8'
Sat Aug 30 10:14:56 2008 Expected Remote Options hash (VER=V4): '69109d17'
Sat Aug 30 10:14:56 2008 TCP connection established with yyy.yyy.yyy.yyy:10646
Sat Aug 30 10:14:56 2008 TCPv4_SERVER link local: [undef]
Sat Aug 30 10:14:56 2008 TCPv4_SERVER link remote: yyy.yyy.yyy.yyy:10646
Sat Aug 30 10:14:56 2008 yyy.yyy.yyy.yyy:10646 TLS: Initial packet from yyy.yyy.yyy.yyy:10646, sid=b4fd7023 e8f06fd3
Sat Aug 30 10:23:38 2008 TCP/UDP: Closing socket

其中 xxx.xxx.xxx.xxx 是我 vpn server 的 wan ip, 至於 yyy.yyy.yyy.yyy 是我 client 端的 ip.
不是可以看線上電視嗎... 只能再用個喇叭.... 儘量對自己好點了
願主與您同在....  

===sse-cmm修改===
修改您留的e-mail address
我已經有copy您完整的記錄，
用戶端跟伺服端應都是重覆的資料，
已將資料刪除。

[ 本文最後由 sse-cmm 於 2008-8-31 21:56 編輯 ]

用戶端會一直重覆，等等再幫您編輯重整一下。

目前看到有問題的地方在於，
1.server端跟client端的TLS-Auth MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]值不一樣。

2.server端怎麼會出現route ADD 192.168.2.128 MASK 255.255.255.0 192.168.2.2？一般言server的ip應該為192.168.0.1才對，這行我的是route ADD 192.168.2.0 MASK 255.255.255.0 192.168.2.2
除了這個外，還出現：
Warning: address 192.168.2.128 is not a network address in relation to netmask 255.255.255.0
ROUTE: route addition failed using CreateIpForwardEntry: 有一些引數不正確。   [if_index=16]
Route addition via IPAPI failed

不知道您的伺服器設定有多了啥？怎麼會有192.168.2.128這個ip出現？
看了看，似乎是您伺服器本身就沒設定好，
所以用戶端也無法連接呢，
您的設定檔就如上面一樣嗎？

嗯？經過比對......
我覺得不太對，我家裡、辦公室電腦最近都曾重灌過，
版本應該也是使用了beta版的2.1版，不過是rc7的版本，
不是rc9，所以我之前貼的圖就可以証明了 ，
很抱歉，因為我似乎有老年癡呆，哈......

我的client端log檔：
Sun Aug 31 20:44:14 2008 OpenVPN 2.1_rc7 Win32-MinGW [SSL] [LZO2] [PKCS11] built on Jan 29 2008
Sun Aug 31 20:44:14 2008 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sun Aug 31 20:44:14 2008 LZO compression initialized
Sun Aug 31 20:44:14 2008 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun Aug 31 20:44:14 2008 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Aug 31 20:44:14 2008 Local Options hash (VER=V4): '66096c33'
Sun Aug 31 20:44:14 2008 Expected Remote Options hash (VER=V4): '691e95c7'
Sun Aug 31 20:44:14 2008 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sun Aug 31 20:44:14 2008 UDPv4 link local: [undef]
Sun Aug 31 20:44:14 2008 UDPv4 link remote: sse-cmm.dyndns.org:1194
Sun Aug 31 20:44:15 2008 TLS: Initial packet from sse-cmm.dyndns.org:1194, sid=a49e9458 51e570cb
Sun Aug 31 20:44:16 2008 VERIFY OK: depth=1, /C=TW/ST=TW/L=PingTung/O=home/OU=home/CN=xxxx/emailAddress=sse-cmm@kerobbs.net
Sun Aug 31 20:44:16 2008 VERIFY OK: depth=0, /C=TW/ST=TW/O=home/OU=home/CN=xxxx/emailAddress=sse-cmm@kerobbs.net
Sun Aug 31 20:44:18 2008 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Aug 31 20:44:18 2008 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Aug 31 20:44:18 2008 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sun Aug 31 20:44:18 2008 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Aug 31 20:44:18 2008 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sun Aug 31 20:44:18 2008 [xxxx] Peer Connection Initiated with sse-cmm.dyndns.org:1194
Sun Aug 31 20:44:19 2008 SENT CONTROL [xxxx]: 'PUSH_REQUEST' (status=1)
Sun Aug 31 20:44:19 2008 PUSH: Received control message: 'PUSH_REPLY,route 192.168.2.0 255.255.255.0,route 192.168.2.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.2.101 192.168.2.102'
Sun Aug 31 20:44:19 2008 OPTIONS IMPORT: timers and/or timeouts modified
Sun Aug 31 20:44:19 2008 OPTIONS IMPORT: --ifconfig/up options modified
Sun Aug 31 20:44:19 2008 OPTIONS IMPORT: route options modified
Sun Aug 31 20:44:19 2008 TAP-WIN32 device [區域連線 3] opened: \\.\Global\{252191B6-24FC-4B79-A80A-7E38579D3763}.tap
Sun Aug 31 20:44:19 2008 TAP-Win32 Driver Version 9.4
Sun Aug 31 20:44:19 2008 TAP-Win32 MTU=1500
Sun Aug 31 20:44:19 2008 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.2.101/255.255.255.252 on interface {252191B6-24FC-4B79-A80A-7E38579D3763} [DHCP-serv: 192.168.2.102, lease-time: 31536000]
Sun Aug 31 20:44:19 2008 Successful ARP Flush on interface [2] {252191B6-24FC-4B79-A80A-7E38579D3763}
Sun Aug 31 20:44:24 2008 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Sun Aug 31 20:44:24 2008 route ADD 192.168.2.0 MASK 255.255.255.0 192.168.2.102
Sun Aug 31 20:44:24 2008 Route addition via IPAPI succeeded [adaptive]
Sun Aug 31 20:44:24 2008 route ADD 192.168.2.0 MASK 255.255.255.0 192.168.2.102
Sun Aug 31 20:44:24 2008 Route addition via IPAPI succeeded [adaptive]
Sun Aug 31 20:44:24 2008 Initialization Sequence Completed

這樣就連上server端了。

server端log：
Fri Aug 29 21:26:39 2008 TAP-Win32 MTU=1500
Fri Aug 29 21:26:39 2008 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.2.1/255.255.255.252 on interface {C85F6D26-AA34-4EA0-9482-33A7F17A0CD7} [DHCP-serv: 192.168.2.2, lease-time: 31536000]
Fri Aug 29 21:26:39 2008 Sleeping for 5 seconds...
Fri Aug 29 21:26:44 2008 Successful ARP Flush on interface [3] {C85F6D26-AA34-4EA0-9482-33A7F17A0CD7}
Fri Aug 29 21:26:44 2008 route ADD 192.168.2.0 MASK 255.255.255.0 192.168.2.2
Fri Aug 29 21:26:44 2008 Route addition via IPAPI succeeded [adaptive]
Fri Aug 29 21:26:44 2008 route ADD 192.168.2.0 MASK 255.255.255.0 192.168.2.2
Fri Aug 29 21:26:44 2008 Route addition via IPAPI succeeded [adaptive]
Fri Aug 29 21:26:44 2008 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Fri Aug 29 21:26:44 2008 Socket Buffers: R=[8192->8192] S=[8192->8192]
Fri Aug 29 21:26:44 2008 UDPv4 link local (bound): 192.168.1.101:1194
Fri Aug 29 21:26:44 2008 UDPv4 link remote: [undef]
Fri Aug 29 21:26:44 2008 MULTI: multi_init called, r=256 v=256
Fri Aug 29 21:26:44 2008 IFCONFIG POOL: base=192.168.2.4 size=62
Fri Aug 29 21:26:44 2008 IFCONFIG POOL LIST　這邊是連線成功後留下的資料，若有設定ccd則可以清空一個記錄ip檔案
Fri Aug 29 21:26:44 2008 sepm,192.168.2.100
Fri Aug 29 21:26:44 2008 john,192.168.2.120
Fri Aug 29 21:26:44 2008 jack,192.168.2.160
Fri Aug 29 21:26:44 2008 Initialization Sequence Completed　啟動成功
Fri Aug 29 21:28:30 2008 MULTI: multi_create_instance called　第一個用戶端呼叫要求連結
Fri Aug 29 21:28:30 2008 1.1.1.1:42165 Re-using SSL/TLS context
Fri Aug 29 21:28:30 2008 1.1.1.1:42165 LZO compression initialized
Fri Aug 29 21:28:30 2008 1.1.1.1:42165 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]
Fri Aug 29 21:28:30 2008 1.1.1.1:42165 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Fri Aug 29 21:28:30 2008 1.1.1.1:42165 Local Options hash (VER=V4): '691e95c7'
Fri Aug 29 21:28:30 2008 1.1.1.1:42165 Expected Remote Options hash (VER=V4): '66096c33'
Fri Aug 29 21:28:30 2008 1.1.1.1:42165 TLS: Initial packet from 1.1.1.1:42165, sid=f0a8216c 17475cba
Fri Aug 29 21:28:32 2008 1.1.1.1:42165 VERIFY OK: depth=1, /C=TW/ST=TW/L=PingTung/O=home/OU=home/CN=xxxx/emailAddress=sse-cmm@kerobbs.net
Fri Aug 29 21:28:32 2008 1.1.1.1:42165 VERIFY OK: depth=0, /C=TW/ST=TW/O=home/OU=home/CN=sepm/emailAddress=sse-cmm@kerobbs.net
Fri Aug 29 21:28:32 2008 1.1.1.1:42165 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Fri Aug 29 21:28:32 2008 1.1.1.1:42165 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Aug 29 21:28:32 2008 1.1.1.1:42165 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Fri Aug 29 21:28:32 2008 1.1.1.1:42165 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Aug 29 21:28:32 2008 1.1.1.1:42165 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Fri Aug 29 21:28:32 2008 1.1.1.1:42165 [sepm] Peer Connection Initiated with 1.1.1.1:42165
Fri Aug 29 21:28:32 2008 sepm/1.1.1.1:42165 MULTI: Learn: 192.168.2.102 -> sepm/1.1.1.1:42165　給定用戶端dhcp之ip
Fri Aug 29 21:28:32 2008 sepm/1.1.1.1:42165 MULTI: primary virtual IP for sepm/1.1.1.1:42165: 192.168.2.102
Fri Aug 29 21:28:34 2008 sepm/1.1.1.1:42165 PUSH: Received control message: 'PUSH_REQUEST'
Fri Aug 29 21:28:34 2008 sepm/1.1.1.1:42165 SENT CONTROL [sepm]: 'PUSH_REPLY,route 192.168.2.0 255.255.255.0,route 192.168.2.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.2.102 192.168.2.101' (status=1)
Fri Aug 29 21:28:35 2008 MULTI: multi_create_instance called　第二個用戶端呼叫要求連結
Fri Aug 29 21:28:35 2008 2.2.2.2:2270 Re-using SSL/TLS context
Fri Aug 29 21:28:35 2008 2.2.2.2:2270 LZO compression initialized
Fri Aug 29 21:28:35 2008 2.2.2.2:2270 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]
Fri Aug 29 21:28:35 2008 2.2.2.2:2270 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Fri Aug 29 21:28:35 2008 2.2.2.2:2270 Local Options hash (VER=V4): '691e95c7'
Fri Aug 29 21:28:35 2008 2.2.2.2:2270 Expected Remote Options hash (VER=V4): '66096c33'
Fri Aug 29 21:28:35 2008 2.2.2.2:2270 TLS: Initial packet from 2.2.2.2:2270, sid=903f0003 4811b88c
Fri Aug 29 21:28:37 2008 2.2.2.2:2270 VERIFY OK: depth=1, /C=TW/ST=TW/L=PingTung/O=home/OU=home/CN=xxxx/emailAddress=sse-cmm@kerobbs.net
Fri Aug 29 21:28:37 2008 2.2.2.2:2270 VERIFY OK: depth=0, /C=TW/ST=TW/O=home/OU=home/CN=john/emailAddress=sse-cmm@kerobbs.net
Fri Aug 29 21:28:37 2008 2.2.2.2:2270 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Fri Aug 29 21:28:37 2008 2.2.2.2:2270 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Aug 29 21:28:37 2008 2.2.2.2:2270 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Fri Aug 29 21:28:37 2008 2.2.2.2:2270 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Aug 29 21:28:37 2008 2.2.2.2:2270 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Fri Aug 29 21:28:37 2008 2.2.2.2:2270 [john] Peer Connection Initiated with 2.2.2.2:2270
Fri Aug 29 21:28:37 2008 john/2.2.2.2:2270 MULTI: Learn: 192.168.2.122 -> john/2.2.2.2:2270
Fri Aug 29 21:28:37 2008 john/2.2.2.2:2270 MULTI: primary virtual IP for john/2.2.2.2:2270: 192.168.2.122
Fri Aug 29 21:28:38 2008 john/2.2.2.2:2270 PUSH: Received control message: 'PUSH_REQUEST'
Fri Aug 29 21:28:38 2008 john/2.2.2.2:2270 SENT CONTROL [john]: 'PUSH_REPLY,route 192.168.2.0 255.255.255.0,route 192.168.2.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.2.122 192.168.2.121' (status=1)

我認為您的伺服器設定有問題，佔較大原因，
我已再次修改我的伺服器跟用戶端設定，
請再次看看有哪邊跟我不同的，

有需要即時通或msn嗎？(需要的話pm給我吧)
不過，我目前只有晚上才有空，
開學後更慘，要上10:00~22:00的班。

另外，外婆房間的電視獨獨看民視非常不清，
她又不開窗戶很悶，所以都跑出來小客廳跟我搶電視看，
我沒有書房，我的電腦跟小客廳是在一起的，
所以，每次都有人問，你的電腦怎麼這麼多條線？

我也不願意呀，我有二台電腦，
一台上網用，一台錄電視節目用，

所以，電腦是可以看，但聲音會跟外婆強碰到，
(老人重聽，聲音放很大 )
乾脆就不用電腦看了。
(反正也得照顧她)

[ 本文最後由 sse-cmm 於 2008-8-31 23:01 編輯 ]

請問為什麼我Client都連不上Server，以下是VIEW LOG

Mon Sep 01 10:58:26 2008 OpenVPN 2.0.9 Win32-MinGW [SSL] [LZO] built on Oct  1 2006
Mon Sep 01 10:58:26 2008 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Mon Sep 01 10:58:26 2008 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Mon Sep 01 10:58:26 2008 LZO compression initialized
Mon Sep 01 10:58:26 2008 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Mon Sep 01 10:58:26 2008 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Sep 01 10:58:26 2008 Local Options hash (VER=V4): '69109d17'
Mon Sep 01 10:58:26 2008 Expected Remote Options hash (VER=V4): 'c0103fa8'
Mon Sep 01 10:58:26 2008 Attempting to establish TCP connection with (server ip)
Mon Sep 01 10:58:26 2008 TCP connection established with (server ip)
Mon Sep 01 10:58:26 2008 TCPv4_CLIENT link local: [undef]
Mon Sep 01 10:58:26 2008 TCPv4_CLIENT link remote: (server ip)
Mon Sep 01 10:58:27 2008 WARNING: Bad encapsulated packet length from peer (23543), which must be > 0 and <= 1544 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attemping restart...]

給樓上的a152222，
麻煩也重新編輯一下，給個server端的log吧，
說不定server端的就有問題了呢。

WARNING: Bad encapsulated packet length from peer (23543), which must be > 0 and <= 1544 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link

由這行看來，您的封包長度太大了，23543，
必須大於0，小於等於1544值。

請確定在server端以及client端要使用tun-mtu或link-mtu相同的值，
這種情怳也可能是TCP連結的活動攻擊？

不要考我英文，我英文很爛的......

還有，可以的話，請給server端及client端的設定，
這樣我也好抓問題點。
不方便貼出來的話，就用短消息pm給我吧。
(當然該改的，如ip也是改一下囉)

可以的話，二位麻煩儘量在月中提問題，
否則一旦開學我就比較沒空囉。

另，明天我放假，後天下午也放假，
如果沒意外的話(沒臨時叫我去上班的話)，
可以在線上等候看看你們的問題。
(不過，如果休假的話，通常我會午睡，
也會睡到四點半，因為我家實在是太熱了 )

===

我剛在我的NB裝了openvpn，
結果發現：

1.我nb連我舊電腦，會讓舊電腦的server的OpenVpn一直當掉。
2.改用新電腦Server，連線成功沒問題，但是一樣對Server不能使用網芳，
　但，卻可以跟其它用戶端連結(對公司)？

不知道是不是因為我在家都是使用虛擬網段的關係？
有空我再確認看看。

===

這真的太奇怪了，
我nb使用adsl撥接，
再用openvpn，還是一樣只能連公司電腦的vpn，
server的網芳找不到資料，唉，我再找找是啥問題...
(好怪？可是公司的電腦明明二台都能跟家裡的server連呀？)

===修改文章如下===
這真的太詭異了，我移掉beta2.1.rc7版後，裝2.09gui版，
舊電腦重新製作認証檔，結果不會當了，
但若真的用tun模式，真的server端的網芳服務連不上，
會一直出現一個錯誤。
得使用tap模式耶！

那當初我到底是怎麼安裝的呀？
我是先安裝2.09非gui後，再裝2.1rc7gui版，
在裝gui版時不裝網卡？

天呀......我已經忘掉了><"

===

如果不需要跳版，就不要設定tun模式，需設定tap模式，
也不需設定bridging模式，這樣用戶端應該就能跟server連了。
我目前測試的結果是這樣；

跳版的部份可能就需要使用bridging模式了，
這個部份得再測一下了，有結果的話會再修改文章。

[ 本文最後由 sse-cmm 於 2008-9-8 18:21 編輯 ]