主页 / server / 问题 / 1028514
Accepted
Freeman di
Asked: 2020-08-01 23:32:25 +0800 CST

我正在尝试绑定两个 Internet 上行链路以提高 VPN 速度，但没有运气

  • 772

我正在尝试在本指南下绑定两个 Internet 上行链路以提高 VPN 速度： 如何绑定两个（多个）Internet 连接以提高速度和故障转移

但是我有一些问题：

我已经为此工作了好几天，但它从来没有工作过。

首先，我的网络拓扑：https ://i.imgur.com/yEj6JGM.png

在我的场景中，请查看我的配置：

客户端：

vim /etc/网络/接口

auto ens160
iface ens160 inet static
  address 192.168.50.254
  netmask 255.255.255.0
  gateway 192.168.50.1
  post-up /usr/local/bin/vpn-start
  pre-down /usr/local/bin/vpn-stop

我的路由是否在 vpn-start 中正确设置？

# vim /usr/local/bin/vpn-start
#!/bin/bash
openvpn --config /etc/openvpn/tap0.conf
openvpn --config /etc/openvpn/tap1.conf
ip link add bond0 type bond
ip addr add 10.80.0.2/30 dev bond0

ip link set tap0 master bond0
ip link set tap1 master bond0
ip link set bond0 up mtu 1440
ip route add 192.168.50.0/24 via 10.80.0.1  <--Is this right?

防火墙配置怎么样？

version 6

lan="ens160"
vpn="bond+"

interface "${lan}" lan
  policy accept

interface "${vpn}" vpn
  policy accept

router vpn2lan inface "${vpn}" outface "${lan}"
  policy accept

服务器端：

tap0.conf：

# disable encryption, traffic continues unencrypted anyways
auth none
cipher none
dev tap0
mode p2p
port 1194
local 192.168.0.250   <-- Local ip or public ip?
proto udp
log /var/log/tap0.log
verb 3
ping 2
ping-restart 10
persist-tun
compress lz4-v2
daemon

防火墙配置：

version 6
server_vpn_ports="udp/1194-1195"
client_vpn_ports="default"
snat4 to 192.168.0.250 outface ens33 dst not 192.168.0.250  <-- What does this mean? local ip or public ip?
interface ens33 web
  protection strong
  server ssh accept
  server vpn accept
  # more servers here as per your needs
  client all accept
interface bond0 vpn
  policy accept
router4 web2vpn inface ens33 outface bond0 dst 192.168.50.0/24,10.80.0.2  <--Is this right?
  client all accept

完成所有设置后，链接似乎已建立：

客户端：

root@ubcloud:~# cat /proc/net/bonding/bond0
Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)

Bonding Mode: load balancing (round-robin)
MII Status: down
MII Polling Interval (ms): 0
Up Delay (ms): 0
Down Delay (ms): 0

客户端 tap1.log：

Sat Aug  1 06:44:39 2020 ******* WARNING *******: All encryption and authentication features disabled -- All data will be tunnelled as clear text and will not be protected against man-in-the-middle changes. PLEASE DO RECONSIDER THIS CONFIGURATION!
Sat Aug  1 06:44:39 2020 Preserving previous TUN/TAP instance: tap1
Sat Aug  1 06:44:39 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]118.152.247.193:1195
Sat Aug  1 06:44:39 2020 Socket Buffers: R=[212992->212992] S=[212992->212992]
Sat Aug  1 06:44:39 2020 UDP link local (bound): [AF_INET]192.168.50.254:1195
Sat Aug  1 06:44:39 2020 UDP link remote: [AF_INET]118.152.247.193:1195
Sat Aug  1 06:44:39 2020 Peer Connection Initiated with [AF_INET]118.152.247.193:1195
Sat Aug  1 06:44:41 2020 Initialization Sequence Completed

从客户端 ping 隧道 ip：

root@ubcloud:~# ping 10.80.0.2
PING 10.80.0.2 (10.80.0.2) 56(84) bytes of data.
64 bytes from 10.80.0.2: icmp_seq=1 ttl=64 time=0.019 ms
64 bytes from 10.80.0.2: icmp_seq=2 ttl=64 time=0.025 ms
64 bytes from 10.80.0.2: icmp_seq=3 ttl=64 time=0.026 ms
^C
--- 10.80.0.2 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2050ms
rtt min/avg/max/mdev = 0.019/0.023/0.026/0.005 ms
root@ubcloud:~# ping 10.80.0.1
PING 10.80.0.1 (10.80.0.1) 56(84) bytes of data.
From 10.80.0.2 icmp_seq=1 Destination Host Unreachable
From 10.80.0.2 icmp_seq=2 Destination Host Unreachable
From 10.80.0.2 icmp_seq=3 Destination Host Unreachable

服务器端：

root@ubcloud:~# cat /proc/net/bonding/bond0
Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)

Bonding Mode: load balancing (round-robin)
MII Status: up
MII Polling Interval (ms): 0
Up Delay (ms): 0
Down Delay (ms): 0

Slave Interface: tap0
MII Status: up
Speed: 10 Mbps
Duplex: full
Link Failure Count: 0
Permanent HW addr: a6:fa:e9:55:79:2c
Slave queue ID: 0

Slave Interface: tap1
MII Status: up
Speed: 10 Mbps
Duplex: full
Link Failure Count: 0
Permanent HW addr: ae:b9:4a:50:b0:dc
Slave queue ID: 0

服务器 tap0.log：

root@ubcloud:~# cat /var/log/tap0.log
Sat Aug  1 06:43:27 2020 disabling NCP mode (--ncp-disable) because not in P2MP client or server mode
Sat Aug  1 06:43:27 2020 OpenVPN 2.4.9 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Oct 30 2019
Sat Aug  1 06:43:27 2020 library versions: OpenSSL 1.1.1  11 Sep 2018, LZO 2.08
Sat Aug  1 06:43:27 2020 ******* WARNING *******: All encryption and authentication features disabled -- All data will be tunnelled as clear text and will not be protected against man-in-the-middle changes. PLEASE DO RECONSIDER THIS CONFIGURATION!
Sat Aug  1 06:43:27 2020 TUN/TAP device tap0 opened
Sat Aug  1 06:43:27 2020 TUN/TAP TX queue length set to 100
Sat Aug  1 06:43:27 2020 Could not determine IPv4/IPv6 protocol. Using AF_INET
Sat Aug  1 06:43:27 2020 Socket Buffers: R=[212992->212992] S=[212992->212992]
Sat Aug  1 06:43:27 2020 UDPv4 link local (bound): [AF_INET]192.168.0.250:1194
Sat Aug  1 06:43:27 2020 UDPv4 link remote: [AF_UNSPEC]
Sat Aug  1 06:43:30 2020 Peer Connection Initiated with [AF_INET]172.227.224.139:1194
Sat Aug  1 06:43:30 2020 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sat Aug  1 06:43:30 2020 Initialization Sequence Completed

从服务器 ping 隧道 ip：

root@ubcloud:~# ping 10.80.0.1
PING 10.80.0.1 (10.80.0.1) 56(84) bytes of data.
64 bytes from 10.80.0.1: icmp_seq=1 ttl=64 time=0.048 ms
64 bytes from 10.80.0.1: icmp_seq=2 ttl=64 time=0.059 ms
^C
--- 10.80.0.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1030ms
rtt min/avg/max/mdev = 0.048/0.053/0.059/0.009 ms
root@ubcloud:~# ping 10.80.0.2
PING 10.80.0.2 (10.80.0.2) 56(84) bytes of data.
From 10.80.0.1 icmp_seq=1 Destination Host Unreachable
From 10.80.0.1 icmp_seq=2 Destination Host Unreachable
From 10.80.0.1 icmp_seq=3 Destination Host Unreachable

任何想法我做错了什么？如何在客户端设置路由，让局域网内的所有流量让局域网内的流量通过隧道从服务器出去？

再次感谢！

networking bonding

2 个回答

  1. 在我们的姊妹网站 Network Engineering 上提出的类似问题：

    将这些链接“粘合”在一起在纸面上听起来是个好主意，但在实践中效果并不好。如果您尝试在两个链接之间拆分单个连接，您将得到无序数据包，尤其是在两个不同的网络上，这将显着降低您的吞吐量。你最好只使用一个链接。

    远程用户的 VPN 软件不够复杂，无法建立两个 VPN 连接，然后做出路由决策以使用最佳路径。我不知道有任何此类产品。您可能必须创建一些自定义的东西，但我怀疑这是否值得付出努力。

    • 0
  2. Best Answer

    我认为您应该考虑升级 VPN 基础设施而不是绑定作为解决方法。

    2 个绑定的 VPN 链接永远不会像具有单个链接所需带宽的专用 VPN 连接那样好。

    • 0

相关问题