[关闭]
@zhangsiming65965 2019-04-22T06:43:16.000000Z 字数 14296 阅读 254

openvpn企业IDC机房-aws-公司三网互通实战

VPN

---Author：张思明 ZhangSiming

---Mail：m18600117869@163.com

---QQ：1030728296

一、实验架构及需求

1.1实验架构图

image_1d8qo0dru1e6fj7d3le1tvd182d9.png-112.6kB

1.2实验需求

已知，公司的openvpnclient可以成功连接aws的openvpnserver的内网服务器，这是一组openvpn client-server；
需求一： 在自建机房架构openvpnclient，使得IDC机房内网gpu服务器可以双向连通aws内网服务器；
需求二： 通过aws的openvpnserver的client to client配置使得IDC机房client可以和公司client实现数据互通。

二、awsopenvpn-server配置并启动

2.1文件清单

  1. root@ip-172-31-35-87:/openvpn-server/openvpn-master# ll 
  2. 总用量 36
  3. -rw-r--r-- 1 root root 1205 4月  16 19:21 docker-compose.yml
  4. #docker-compose.yaml启动文件
  5. -rw-r--r-- 1 root root  444 4月  16 17:32 Dockerfile
  6. #构建openvpn镜像文件
  7. -rwxr-xr-x 1 root root  172 4月  16 19:36 entrypoint.sh*
  8. #openvpn-docker启动入口
  9. -rwxr-xr-x 1 root root 1500 4月  16 17:34 openvpn_init.sh*
  10. #初始化脚本
  11. drwxrwxr-x 2 root root 4096 4月  16 19:36 openvpn_need/
  12. #生成文件目录
  14. root@ip-172-31-35-87:/openvpn-server/openvpn-master# ll openvpn_need/
  15. 总用量 24
  16. drwxrwxr-x 2 root root 4096 4月  16 19:36 ./
  17. drwxrwxr-x 4 root root 4096 4月  19 20:10 ../
  18. -rw-r--r-- 1 root root  855 4月  16 17:26 base.conf
  19. #客户端配置文件基准文件
  20. -rwxr-xr-x 1 root root 1714 4月  16 17:26 make_cert.sh*
  21. #制作证书文件
  22. -rw-r--r-- 1 root root 1533 4月  16 17:31 server.conf
  23. #服务端配置文件
  24. -rw-r--r-- 1 root root 2130 4月   4 17:07 vars
  25. #生成证书文件

2.2文件详解

  1. root@ip-172-31-35-87:/openvpn-server/openvpn-master# cat openvpn_need/base.conf 
  2. client
  3. dev tun
  4. proto tcp
  5. #客户端和服务端的传输协议需要一致
  6. remote 119.18.195.149 8888
  7. #openvpn-server的远程地址和端口
  8. resolv-retry infinite
  9. nobind
  10. persist-key
  11. persist-tun
  12. ca /etc/openvpn/ca.crt
  13. cert /etc/openvpn/client.crt
  14. key /etc/openvpn/client.key
  15. #连接用的证书和key
  16. ns-cert-type server
  17. comp-lzo
  18. verb 3
  1. root@ip-172-31-35-87:/openvpn-server/openvpn-master# cat openvpn_need/make_cert.sh 
  2. #!/bin/bash
  3. echo -e "-------make_cert.sh start--------\n\n"
  5. source vars
  6. ./clean-all
  7. #先生效vars文件，再生成密钥
  9. #生成ca证书
  10. echo -e "\n\n----------build-ca-----------"
  11. /usr/bin/expect << EOF
  12. spawn ./build-ca
  13. expect "Country Name" {send "\r"}
  14. expect "State or Province Name" {send "\r"}
  15. expect "Locality Name" {send "\r"}
  16. expect "Organization Name" {send "\r"}
  17. expect "Organizational Unit Name" {send "\r"}
  18. expect "Common Name" {send "\r"}
  19. expect "Name" {send "\r"}
  20. expect "Email Address" {send "\r"}
  21. expect eof
  22. EOF
  24. #基于ca生成server证书
  25. echo -e "\n\n-------build-key-server-------"
  27. /usr/bin/expect << EOF
  28. spawn ./build-key-server server
  29. expect "Country Name" {send "\r"}
  30. expect "State or Province Name" {send "\r"}
  31. expect "Locality Name" {send "\r"}
  32. expect "Organization Name" {send "\r"}
  33. expect "Organizational Unit Name" {send "\r"}
  34. expect "Common Name" {send "\r"}
  35. expect "Name" {send "\r"}
  36. expect "Email Address" {send "\r"}
  37. expect "A challenge password" {send "\r"}
  38. expect "An optional company name" {send "\r"}
  39. expect "Sign the certificate?" {send "y\r"}
  40. expect "commit?" {send "y\r"}
  41. expect eof
  42. EOF
  44. #基于ca生成client证书
  45. echo -e "\n\n-------build-key-client-------"
  47. /usr/bin/expect << EOF
  48. spawn ./build-key client
  49. #后面传入的client(可以任意指定)，为证书的COMMON NAME
  50. expect "Country Name" {send "\r"}
  51. expect "State or Province Name" {send "\r"}
  52. expect "Locality Name" {send "\r"}
  53. expect "Organization Name" {send "\r"}
  54. expect "Organizational Unit Name" {send "\r"}
  55. expect "Common Name" {send "\r"}
  56. expect "Name" {send "\r"}
  57. expect "Email Address" {send "\r"}
  58. expect "A challenge password" {send "\r"}
  59. expect "An optional company name" {send "\r"}
  60. expect "Sign the certificate?" {send "y\r"}
  61. expect "commit?" {send "y\r"}
  62. expect eof
  63. EOF
  64. echo -e "\n\n--------build-dh-----------"
  66. #生成证书交换文件
  67. ./build-dh
  69. echo -e "\n\n-------make_cert.sh done--------"
  1. root@ip-172-31-35-87:/openvpn-server/openvpn-master# cat openvpn_need/server.conf 
  2. port 52115
  3. #openvpn-server监听端口
  4. proto tcp
  5. dev tun
  6. server {{ OPENVPN_SERVER }}
  7. #给openvpn服务tun0网卡分配的地址，需要唯一，不要和双方任意的私网或者公网一样，在docker-compose用ENV导入
  8. push "route 1.10.0.0 255.255.0.0"
  9. #给客户端添加到server本地私网的路由，在docker-compose的ENV声明，在openvpn_init.sh中对应更改
  10. route 11.11.0.0 255.255.0.0
  11. #给本地添加一条到openvpn-client的回程路由
  12. client-config-dir /etc/openvpn/ccd
  13. #ccd目录必须写绝对路径，且要存在与docker中；openvpn-server动态读取之中的配置，直接修改ccd中的内容之后无需重启openvpn-server服务，客户端直接连接即可生效；ccd中的文件名需要和客户端证书的COMMON NAME一致
  14. ifconfig-pool-persist /etc/openvpn/logs/ipp.txt
  15. status /etc/openvpn/logs/status.log
  16. log /etc/openvpn/logs/openvpn.log
  17. ca /etc/openvpn/server/ca.crt
  18. cert /etc/openvpn/server/server.crt
  19. key /etc/openvpn/server/server.key 
  20. dh /etc/openvpn/server/dh2048.pem
  21. client-to-client
  22. #client-to-client允许连接到同一个openvpn-server的不同客户端之间通信
  23. keepalive 10 120
  24. duplicate-cn
  25. #duplicate-cn允许不同用户使用同一证书连接openvpn-server
  26. comp-lzo
  27. persist-key
  28. persist-tun
  29. verb 3
  1. root@ip-172-31-35-87:/openvpn-server/openvpn-master# tail -17 openvpn_need/vars | head -13
  2. export KEY_COUNTRY="$KEY_COUNTRY"
  3. export KEY_PROVINCE="$KEY_PROVINCE"
  4. export KEY_CITY="$KEY_CITY"
  5. export KEY_ORG="$KEY_ORG"
  6. export KEY_EMAIL="$KEY_EMAIL"
  7. export KEY_OU="$KEY_OU"
  8. export KEY_CN="$KEY_CN"
  9. # X509 Subject Field
  10. export KEY_NAME="$KEY_NAME"
  11. export KEY_ALTNAMES="something"
  12. # PKCS11 Smart Card
  13. # export PKCS11_MODULE_PATH="/usr/lib/changeme.so"
  14. # export PKCS11_PIN=1234
  15. #里面声明了证书的信息，城市邮箱等...
  1. root@ip-172-31-35-87:/openvpn-server/openvpn-master# cat openvpn_init.sh
  2. #!/bin/bash
  4. OPENVPN_DIR=/etc/openvpn
  5. OPENVPN_NEED=/usr/local/bin/
  7. if [ ! -f ${OPENVPN_DIR}/server/server.crt ]
  8. then
  9.     echo 'openvpn initializing ...'
  10.     # make server ca and server crt
  11.     cd ${OPENVPN_DIR}
  12.     mkdir -p server client logs
  13.     cd /root/
  14.     mkdir -p openvpn-ca
  15.     cp /usr/share/easy-rsa/\* openvpn-ca
  16.     cp ${OPENVPN_NEED}/make_cert.sh ${OPENVPN_NEED}/vars openvpn-ca
  17.     cp openvpn-ca/openssl-1.0.0.cnf openvpn-ca/openssl.cnf
  18.     cd openvpn-ca
  19.     ./make_cert.sh
  20.     cd ./keys
  21. #创建证书并把server和client的证书放到对应位置
  22.     cp ca.crt server.crt server.key dh* ${OPENVPN_DIR}/server/
  23.     cp ca.crt client.crt client.key ${OPENVPN_DIR}/client/
  25.     if [ ! -f ${OPENVPN_DIR}/server/server.conf ]
  26.     then
  27.         cp ${OPENVPN_NEED}/server.conf ${OPENVPN_DIR}/server/server.conf
  28.     fi
  30.     # fill environment variable in
  31. #修改.dh文件
  32.     sed -i "s|^dh.*|dh ${OPENVPN_DIR}/server/dh${KEY_SIZE}.pem|" ${OPENVPN_DIR}/server/server.conf
  33. #修改server.conf的tun网卡网段，即openvpn提供隧道服务的网段
  34.     sed -i "s|{{ OPENVPN_SERVER }}|${OPENVPN_SERVER}|g" ${OPENVPN_DIR}/server/server.conf
  35. #修改给客户端添加的路由(指向openvpn-server的私网网卡)
  36.     sed -i "s|^push \"route.*|push \"route ${PUSH}\"|" ${OPENVPN_DIR}/server/server.conf
  38.     # make client conf
  39.     cp ${OPENVPN_NEED}/base.conf ${OPENVPN_DIR}/client/client.conf
  40. #修改client.conf指向远程openvpn-server的IP+端口
  41.     sed -i "s|^remote.*|remote ${CLIENTREMOTE} 52115|" ${OPENVPN_DIR}/client/client.conf
  43.     rm -rf /usr/local/bin/*
  44.     rm -rf /root/openvpn-ca
  45. else
  46.     echo 'openvpn has been initialized, skip.'
  47. fi
  49. #添加tun网卡，隧道网卡提供vpn服务
  50. # add tun
  51. if [ ! -c /dev/net/tun ]
  52. then
  53.     echo "creating /dev/net/tun"
  54.     mkdir /dev/net
  55.     mknod /dev/net/tun c 10 200
  56. fi
  1. root@ip-172-31-35-87:/openvpn-server/openvpn-master# cat entrypoint.sh
  2. #!/bin/bash
  4. case "$1" in
  5.   openvpn)
  6. #先执行初始化进行配置
  7.     /root/openvpn_init.sh
  8. #之后指向server.conf启动openpvn-server服务
  9.     exec openvpn --dev tun --config /etc/openvpn/server/server.conf ${@:2}
  10.   ;;
  11.   *)
  12.     exec "$@"
  13.   ;;
  14. esac
  1. root@ip-172-31-35-87:/openvpn-server/openvpn-master# cat Dockerfile 
  2. FROM registry.cn-beijing.aliyuncs.com/shannonai/openvpn:v1.1.1
  3. #安装证书生成工具，openvpn和expect等无交互辅助工具
  4. # runtime dependencies
  5. RUN set -ex \
  6.     && apt-get -yqq update && apt-get install -yqq --no-install-recommends \
  7.         openvpn \
  8.         expect \
  9.         easy-rsa \
  10.     && rm -rf /var/lib/apt/lists/* 
  12. VOLUME /etc/openvpn
  13. EXPOSE 52115
  15. COPY openvpn_init.sh /root/
  16. COPY entrypoint.sh /root/
  17. COPY openvpn_need/ /usr/local/bin/
  18. #把文件放到指定路径，方便openvpn_init.sh的时候用
  19. ENTRYPOINT ["/root/entrypoint.sh"]
  20. CMD ["openvpn"]
  1. root@ip-172-31-35-87:/openvpn-server/openvpn-master# cat docker-compose.yml 
  2. version: '3.2'
  3. services:
  4.     openvpn:
  5.         image: openvpn
  6.         container_name: openvpn-server
  7.         network_mode: host
  8. #使用宿主机网络
  9.         restart: always
  10.         volumes:
  11.             - ./data:/etc/openvpn
  12. #挂载当前目录的data目录到docker中的/etc/openvpn
  13.         ports:
  14.             - "52115"
  15. #暴露端口
  16.         cap_add:
  17.             - NET_ADMIN
  18. #cap_add不加会报错
  19.         environment:
  20.             OPENVPN_SERVER: 10.66.0.0 255.255.0.0  
  21. #tun网卡网段，openvpn网卡服务网段
  22.             PUSH: 172.31.0.0 255.255.0.0 
  23. #给客户端添加到openvpn-server内网的路由
  24.             CLIENTREMOTE: 52.82.24.178
  25. #给client.conf添加的远程openvpn-server公网地址
  26.             KEY_COUNTRY: CN  # The state abbreviations(for example: CN)
  27.             KEY_PROVINCE: BJ  # Province shorthand(for example: BJ)
  28.             KEY_CITY: Beijing # City(for example: BeiJing)
  29.             KEY_ORG: shannonai  # organisation(for example: shannon.ai)
  30.             KEY_OU: shannonai  # affiliated unit(for example: shannon.ai)
  31.             KEY_CN: shannonai
  32.             KEY_EMAIL: siming_zhang@shannonai.com  # Email(for example: contact@shannonai.com)
  33.             KEY_SIZE: 2048  # The private key size(for example: 2048)

2.3启动openvpn-server

  1. root@ip-172-31-35-87:/openvpn-server/openvpn-master# ls
  2. docker-compose.yml  Dockerfile  entrypoint.sh  openvpn_init.sh  openvpn_need
  3. root@ip-172-31-35-87:/openvpn-server/openvpn-master# docker build -t openvpn .
  4. root@ip-172-31-35-87:/openvpn-server/openvpn-master# docker-compose up -d
  5. root@ip-172-31-35-87:/openvpn-server/openvpn-master# docker-compose ps
  6.      Name                  Command             State   Ports
  7. ------------------------------------------------------------
  8. openvpn-server   /root/entrypoint.sh openvpn   Up           
  9. #成功启动
  10. root@ip-172-31-35-87:/openvpn-server/openvpn-master# ls data/
  11. ccd  client  logs  server
  12. root@ip-172-31-35-87:/openvpn-server/openvpn-master# cat data/ccd/client 
  13. iroute 11.11.0.0 255.255.0.0
  14. #ccd目录手动创建，添加iroute，地址写openpvn-client的内网网段，我理解的是回城tun point-to-point的指向客户端路由
  15. root@ip-172-31-35-87:/openvpn-server/openvpn-master# ls data/client/
  16. ca.crt  client.conf  client.crt  client.key  make.sh
  17. #将客户端的证书、密钥和配置文件都拷贝得到openvpn-client服务器的指定目录连接备用
  18. root@ip-172-31-35-87:/openvpn-server/openvpn-master# ls data/server/
  19. ca.crt  client.conf  dh2048.pem  server.conf  server.crt  server.key
  20. #查看监听端口
  21. root@ip-172-31-35-87:/openvpn-server/openvpn-master# netstat -antup | grep 52115
  22. tcp        0      0 0.0.0.0:52115           0.0.0.0:*               LISTEN      1289/openvpn

三、IDC机房openvpn-client配置并启动

3.1文件清单

  1. root@jumpserver:~/openvpn-client# ll
  2. total 32
  3. drwxr-xr-x  2 root root 4096 Apr 18 00:03 client/
  4. #client目录中放我们刚刚server生成的ca证书、client证书密钥和client.conf
  5. -rw-r--r--  1 root root  282 Apr 15 08:07 docker-compose.yml
  6. -rw-r--r--  1 root root  417 Apr  8 09:39 Dockerfile
  7. -rwxr-xr-x  1 root root  169 Apr 15 08:06 entrypoint.sh*
  8. -rwxr-xr-x  1 root root  139 Apr  8 08:14 openvpn_init.sh*

3.2文件详解

  1. root@jumpserver:~/openvpn-client# cat client/client.conf 
  2. client
  3. dev tun
  4. proto tcp
  5. remote 52.82.24.178 52115
  6. #连接openvpn-server的地址和端口
  7. resolv-retry infinite
  8. nobind
  9. persist-key
  10. persist-tun
  11. ca /etc/openvpn/ca.crt
  12. cert /etc/openvpn/client.crt
  13. key /etc/openvpn/client.key
  14. ns-cert-type server
  15. comp-lzo
  16. verb 3
  1. root@jumpserver:~/openvpn-client# cat entrypoint.sh 
  2. #!/bin/bash
  3. case "$1" in
  4.   openvpn)
  5.     sh /root/openvpn_init.sh 
  6.     exec openvpn --dev tun --config /etc/openvpn/client.conf ${@:2}
  7.   ;;
  8.   *)
  9.     exec "$@"
  10.   ;;
  11. esac
  12. #先初始化之后指向client.conf启动openvpn-client
  1. root@jumpserver:~/openvpn-client# cat Dockerfile 
  2. FROM registry.cn-beijing.aliyuncs.com/shannonai/openvpn:v1.1.1
  3. USER root
  4. # runtime dependencies
  5. RUN set -ex \
  6.     && apt-get -yqq update && apt-get install -yqq --no-install-recommends \
  7.         openvpn \
  8.         expect \
  9.         easy-rsa \
  10.     && rm -rf /var/lib/apt/lists/* 
  12. VOLUME /etc/openvpn
  13. EXPOSE 52115
  15. COPY openvpn_init.sh /root/
  16. COPY entrypoint.sh /root/
  17. #与openvpn-server的Dockerfile几乎一样，注意细节
  18. ENTRYPOINT ["/root/entrypoint.sh"]
  19. CMD ["openvpn"]
  1. root@jumpserver:~/openvpn-client# cat docker-compose.yml 
  2. version: '3.2'
  3. services:
  4.     openvpn:
  5.         image: openvpn
  6.         container_name: openvpn-client
  7.         network_mode: host
  8.         restart: always
  9.         volumes:
  10.             - ./client:/etc/openvpn
  11. #挂载当前目录的client目录到/etc/openvpn中
  12.         ports:
  13.             - "52115"
  14.         cap_add:
  15.             - NET_ADMIN

3.3启动openvpn-server服务

  1. root@jumpserver:~/openvpn-client# ls
  2. client              Dockerfile     openvpn_init.sh
  3. docker-compose.yml  entrypoint.sh  README.md
  4. root@jumpserver:~/openvpn-client# docker build -t openvpn .
  5. root@jumpserver:~/openvpn-client# docker-compose up -d
  6. root@jumpserver:~/openvpn-client# docker-compose ps
  7.      Name                  Command             State   Ports
  8. ------------------------------------------------------------
  9. openvpn-client   /root/entrypoint.sh openvpn   Up     
  10. root@jumpserver:~/openvpn-client# netstat -antup | grep 52115
  11. tcp        0      0 11.11.22.100:53996      52.82.24.178:52115      ESTABLISHED 30650/openvpn   
  12. #成功启动

四、添加路由及防火墙导通规则并进行测试

4.1查看openvpn-client和openvpn-server的网络

  1. #openvpn-client
  2. root@jumpserver:~/openvpn-client# route -n | grep tun0
  3. 10.66.0.0       10.66.0.5       255.255.0.0     UG    0      0        0 tun0
  4. 10.66.0.5       0.0.0.0         255.255.255.255 UH    0      0        0 tun1
  5. 172.31.0.0      10.66.0.5       255.255.0.0     UG    0      0        0 tun0
  6. root@jumpserver:~/openvpn-client# ifconfig | grep -A 1 tun0
  7. tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
  8.           inet addr:10.66.0.6  P-t-P:10.66.0.5  Mask:255.255.255.255
  10. #openvpn-server
  11. root@ip-172-31-35-87:/openvpn-server/openvpn-master# route -n | grep tun
  12. 10.66.0.0       10.66.0.2       255.255.0.0     UG    0      0        0 tun0
  13. 10.66.0.2       0.0.0.0         255.255.255.255 UH    0      0        0 tun0
  14. 11.11.0.0       10.66.0.2       255.255.0.0     UG    0      0        0 tun0
  15. root@ip-172-31-35-87:/openvpn-server/openvpn-master# ifconfig | grep -A 1 tun
  16. tun0      Link encap:未指定  硬件地址 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
  17.           inet 地址:10.66.0.1  点对点:10.66.0.2  掩码:255.255.255.255

4.2测试openvpn-client和openvpn-server的互通

  1. #openvpn-client ping openvpn-server
  2. root@jumpserver:~/openvpn-client# ping 172.31.35.87
  3. PING 172.31.35.87 (172.31.35.87) 56(84) bytes of data.
  4. 64 bytes from 172.31.35.87: icmp_seq=1 ttl=64 time=30.0 ms
  5. 64 bytes from 172.31.35.87: icmp_seq=2 ttl=64 time=29.9 ms
  6. 64 bytes from 172.31.35.87: icmp_seq=3 ttl=64 time=29.8 ms
  7. ^C
  8. --- 172.31.35.87 ping statistics ---
  9. 3 packets transmitted, 3 received, 0% packet loss, time 2000ms
  10. rtt min/avg/max/mdev = 29.892/29.936/30.002/0.149 ms
  12. #openvpn-server ping openvpn-client
  13. root@ip-172-31-35-87:/openvpn-server/openvpn-master# ping 11.11.22.100
  14. PING 11.11.22.100 (11.11.22.100) 56(84) bytes of data.
  15. 64 bytes from 11.11.22.100: icmp_seq=1 ttl=64 time=30.0 ms
  16. 64 bytes from 11.11.22.100: icmp_seq=2 ttl=64 time=29.9 ms
  17. 64 bytes from 11.11.22.100: icmp_seq=3 ttl=64 time=29.9 ms
  18. ^C
  19. --- 11.11.22.100 ping statistics ---
  20. 3 packets transmitted, 3 received, 0% packet loss, time 2000ms
  21. rtt min/avg/max/mdev = 29.936/29.967/30.028/0.204 ms
  22. #成功互通

4.3添加路由实现openvpn-server内网服务器和openvpn-client内网服务器的互通

正常情况下开启了openvpn-server和openvpn-client就可以实现openvpn-server和openvpn-client私网间的互通。但是如果openvpn-server想要找到openvpn-client通以局域网下的其他主机，还需要在openvpn-client子网服务器添加一条路由规则。因为即使发送的数据包可以到达openvpn-client通一局域网内的其他服务器，这些服务器并不知道怎么发回来。

  1. #tcpdump抓一下包
  2. root@gpuserver004:/home/zhangsiming# tcpdump -v icmp
  3. tcpdump: listening on enp14s0, link-type EN10MB (Ethernet), capture size 262144 bytes
  4. 10:59:45.181306 IP (tos 0x0, ttl 62, id 42159, offset 0, flags [DF], proto ICMP (1), length 84)
  5.     172.31.40.247 > 11.11.22.4: ICMP echo request, id 7117, seq 48, length 64
  6. 10:59:45.181343 IP (tos 0x0, ttl 64, id 13077, offset 0, flags [none], proto ICMP (1), length 84)
  7.     11.11.22.4 > 172.31.40.247: ICMP echo reply, id 7117, seq 48, length 64
  8. #可见，需要把回程的目标地址172.31.40.247发送给openvpn-client处理才行
  9. root@gpuserver004:/home/zhangsiming# route add -net 172.31.0.0/16 gw 11.11.22.100
  10. #添加上面这条路由即可。

同理，在aws上面，也需要设置回程路由。

image_1d8qr5emk1ddk1lso1atq9ta1dia13.png-208.3kB

image_1d8qr64cmnid1euv51hhlunpi1g.png-69.7kB

image_1d8qr6qo59fq1i021jdr1ee2ou1t.png-83.8kB

image_1d91g4pq611t8eq8ji21f5a1q809.png-190.1kB

image_1d8qr82vs1jju1ebj18561p661otj2a.png-46.7kB

4.4测试

  1. #IDC内网服务器pingaws内网服务器
  2. zhangsiming@gpuserver004:~$ ping 172.31.40.247
  3. PING 172.31.40.247 (172.31.40.247) 56(84) bytes of data.
  4. 64 bytes from 172.31.40.247: icmp_seq=1 ttl=62 time=59.9 ms
  5. 64 bytes from 172.31.40.247: icmp_seq=2 ttl=62 time=30.2 ms
  6. 64 bytes from 172.31.40.247: icmp_seq=3 ttl=62 time=30.2 ms
  7. ^C
  8. --- 172.31.40.247 ping statistics ---
  9. 3 packets transmitted, 3 received, 0% packet loss, time 2002ms
  10. rtt min/avg/max/mdev = 30.254/40.160/59.955/13.997 ms
  12. #aws内网服务器pingIDC内网服务器
  13. root@172:/# ping 11.11.22.4
  14. PING 11.11.22.4 (11.11.22.4) 56(84) bytes of data.
  15. 64 bytes from 11.11.22.4: icmp_seq=1 ttl=62 time=30.2 ms
  16. 64 bytes from 11.11.22.4: icmp_seq=2 ttl=62 time=30.2 ms
  17. 64 bytes from 11.11.22.4: icmp_seq=3 ttl=62 time=30.2 ms
  18. ^C
  19. --- 11.11.22.4 ping statistics ---
  20. 3 packets transmitted, 3 received, 0% packet loss, time 2002ms
  21. rtt min/avg/max/mdev = 30.201/30.241/30.279/0.031 ms

成功实现互通，实验完成。

github地址 ：https://github.com/zhangsimingshannonai/idc-aws-openvpn-in-docker.git

添加新批注
在作者公开此批注前，只有你和作者可见。
回复批注