Comments (9)
shushenghong
commented on August 25, 2024
观察trafficstatus发现curl调用时inBytes outBytes确实在涨，但很慢
ipsec-vpn-server:/opt/src# ipsec trafficstatus
#2: "ikev2-cp"[1] 192.168.65.1, type=ESP, add_time=1719141577, inBytes=1400, outBytes=1668, maxBytes=2^63B, id='CN=shu, O=IKEv2 VPN', lease=192.168.43.10/32
ipsec-vpn-server:/opt/src# ipsec trafficstatus
#2: "ikev2-cp"[1] 192.168.65.1, type=ESP, add_time=1719141577, inBytes=1400, outBytes=1668, maxBytes=2^63B, id='CN=shu, O=IKEv2 VPN', lease=192.168.43.10/32
ipsec-vpn-server:/opt/src# ipsec trafficstatus
#2: "ikev2-cp"[1] 192.168.65.1, type=ESP, add_time=1719141577, inBytes=1464, outBytes=1720, maxBytes=2^63B, id='CN=shu, O=IKEv2 VPN', lease=192.168.43.10/32
ipsec-vpn-server:/opt/src# ipsec trafficstatus
#2: "ikev2-cp"[1] 192.168.65.1, type=ESP, add_time=1719141577, inBytes=1464, outBytes=1720, maxBytes=2^63B, id='CN=shu, O=IKEv2 VPN', lease=192.168.43.10/32
ipsec-vpn-server:/opt/src# ipsec trafficstatus
#2: "ikev2-cp"[1] 192.168.65.1, type=ESP, add_time=1719141577, inBytes=1528, outBytes=1832, maxBytes=2^63B, id='CN=shu, O=IKEv2 VPN', lease=192.168.43.10/32
ipsec-vpn-server:/opt/src# ipsec trafficstatus
#2: "ikev2-cp"[1] 192.168.65.1, type=ESP, add_time=1719141577, inBytes=1528, outBytes=1832, maxBytes=2^63B, id='CN=shu, O=IKEv2 VPN', lease=192.168.43.10/32
ipsec-vpn-server:/opt/src# ipsec trafficstatus
#2: "ikev2-cp"[1] 192.168.65.1, type=ESP, add_time=1719141577, inBytes=1528, outBytes=1832, maxBytes=2^63B, id='CN=shu, O=IKEv2 VPN', lease=192.168.43.10/32
ipsec-vpn-server:/opt/src# ipsec trafficstatus
#2: "ikev2-cp"[1] 192.168.65.1, type=ESP, add_time=1719141577, inBytes=1592, outBytes=1884, maxBytes=2^63B, id='CN=shu, O=IKEv2 VPN', lease=192.168.43.10/32
ipsec-vpn-server:/opt/src# ipsec trafficstatus
from docker-ipsec-vpn-server.
hwdsl2
commented on August 25, 2024
@shushenghong 你好！对于你的用例，你提供的日志显示 VPN 已成功连接。请检查以下项目：
- 首先确保你的 HTTP 服务器的防火墙允许来自你运行 Docker 的 macOS 计算机的 IP 的流量，并且允许来自 VPN 客户端子网
192.168.43.0/24的流量。检查 HTTP 服务器的监听 IP 和端口是否正确。 - 尝试从你运行 Docker 的 macOS 计算机访问 HTTP 服务器，使用以上 curl 命令。确保从该计算机可以正常访问它。
- 另外你可以尝试暂时移除 Docker 容器中的 IPTables FORWARD chain 的 DROP 规则来测试。首先 在容器中运行 Bash shell。然后参见： hwdsl2/setup-ipsec-vpn#1540 (comment)
from docker-ipsec-vpn-server.
shushenghong
commented on August 25, 2024
iptables -D FORWARD -j DROP后确实可以访问了
这是啥原因呢，加上这个后会有其他问题吗？
from docker-ipsec-vpn-server.
hwdsl2
commented on August 25, 2024
@shushenghong 在容器内运行 iptables -D FORWARD -j DROP 会允许所有转发的流量。这样可以达到你的用例的需求，但是会有安全风险，比如因特网上的主机可能可以访问你的 VPN 客户端的端口。
对于你的用例，在运行 iptables -D FORWARD -j DROP 后可以访问，这说明你需要在 IPTables FORWARD Chain 添加合适的防火墙规则。
如果要找到更好的解决方案的话，你可以添加一个 LOG 规则来记录被禁止的流量。
iptables -A FORWARD -j LOG
重新测试到 HTTP 服务器的连接后，使用 dmesg 命令查看 IPTables 防火墙记录。然后根据结果添加合适的 IPTables 规则。
在完成后，恢复删除的规则以提高安全性：
iptables -A FORWARD -j DROP
from docker-ipsec-vpn-server.
shushenghong
commented on August 25, 2024
感谢，dmesg里看不到任何iptables的日志，是需要哪里配置么
from docker-ipsec-vpn-server.
shushenghong
commented on August 25, 2024
我在vpn server的docker里，抓了个包
其中192.168.43.10是客户端ip，172.18.0.2是docker容器eth0虚拟网卡的ip
from docker-ipsec-vpn-server.
shushenghong
commented on August 25, 2024
这个192.168.65.1是个什么含义，我没太明白
from docker-ipsec-vpn-server.
shushenghong
commented on August 25, 2024
现在又再也不通了，关iptables都不行了，还是只能ping通，江湖救急
from docker-ipsec-vpn-server.
shushenghong
commented on August 25, 2024
临时换了台linux服务器，一切正常了，估计还是和mac作为host有关系
from docker-ipsec-vpn-server.
Related Issues (20)
- 您好，极空间的nas赋予ipsec vpn net_admin权限，会导致docker中使用桥接容器内的网络不通，只有改为host模式才可以访问 HOT 1
- IKEv2模式会自动启用密码保护 HOT 1
- 没公网ipv4,只有公网ipv6要如何设置 HOT 1
- add functionality to script HOT 1
- Cannot connect using IKEv2 HOT 2
- VPN_CONFIG_PROTECT password invalid HOT 2
- 是不能直接在局域网内部署吗，必需得连接公网？ HOT 1
- Conceal sensitive data in container logs HOT 1
- authentication failed: peer attempted PSK authentication but we want rsasig HOT 1
- IKEv 客户端每次创建都有默认密码，使用VPN_PROTECT_CONFIG=no 配置不生效 HOT 3
- Windows10 连接失败 HOT 1
- docker 运行一段时间后,就连接不上了,需要重启 HOT 1
- 初次配置连接不上 HOT 3
- 我把容器500、4500端口分别映射到宿主机4501，4500端口，防火墙开了对应的两个udp端口 HOT 1
- client not accessing remote network HOT 1
- [Question] combination with pi-hole DNS Server HOT 1
- docker部署的ipsec 客户端支持h3c路由器吗 HOT 3
- 能够连接上VPN但是无法访问内网地址或者外网地址 HOT 1
- failed to start vpn HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from docker-ipsec-vpn-server.