Итак, вот проблема.
Я установил сервер OpenVPN на Openstack VPS (хостинггер, если это важно). Я использовал руководство https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-ubuntu-16-04
Все хорошо до того момента, когда я смог установить vpn-соединение. Но когда я пытаюсь зайти практически на любой сайт - у меня таймаут соединения.
Я отключил ufw для отладки.
Iptables:
$ iptables -t nat -v -x -n -L
Chain PREROUTING (policy ACCEPT 43527 packets, 3644888 bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 4095 packets, 441234 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 33 packets, 2279 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 33 packets, 2279 bytes)
pkts bytes target prot opt in out source destination
1453 104793 MASQUERADE all -- * ens3 10.0.0.0/8 0.0.0.0/0
ens3 это мой интерфейс по умолчанию на сервере.
Когда я пытаюсь tracert с локальной машины
$ tracert google.com
Tracing route to google.com [172.217.16.46]
over a maximum of 30 hops:
1 73 ms 73 ms 72 ms 10.8.0.1
2 76 ms 86 ms 75 ms 185.181.208.1
3 74 ms 81 ms 73 ms static-217-195-202-1.fibersunucu.com.tr [217.195.202.1]
4 79 ms 75 ms 74 ms static-177-159-92-77.sadecehosting.net [77.92.159.177]
5 75 ms 75 ms 75 ms 212.156.128.169.static.turktelekom.com.tr [212.156.128.169]
6 74 ms 75 ms 77 ms 00-atakoy-xrs-t2-1---00-atakoy-t3-7.statik.turktelekom.com.tr [212.156.120.130]
7 106 ms 75 ms 74 ms 00-gayrettepe-xrs-t2-1---00-atakoy-xrs-t2-1.statik.turktelekom.com.tr [81.212.203.102]
8 * * 75 ms 00-ebgp-gayrettepe-k---00-gayrettepe-xrs-t2-1.statik.turktelekom.com.tr [81.212.201.195]
9 81 ms 76 ms 75 ms 212.156.120.178.26-eskisehir-t3-1.06-ulus-t3-7.statik.turktelekom.com.tr [212.156.120.178]
10 83 ms 86 ms 83 ms 307-sof-col-1---00-ebgp-gayrettepe-k.statik.turktelekom.com.tr [212.156.104.22]
11 112 ms 103 ms 124 ms 74.125.51.94
12 106 ms 106 ms 111 ms 108.170.250.168
13 145 ms 147 ms 142 ms 108.170.226.42
14 132 ms 132 ms 134 ms 72.14.239.245
15 132 ms 132 ms 132 ms 216.239.58.5
16 136 ms 132 ms 141 ms 108.170.250.193
17 132 ms 132 ms 132 ms 74.125.251.103
18 135 ms 131 ms 132 ms waw02s14-in-f14.1e100.net [172.217.16.46]
Trace complete.
Пинг тоже работает.
Я бегал tcpdump
tcpdump -A -s 0 'src president.gov.by and tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
Для запроса с локального компьютера, подобного этому curl -sSL -D - http://president.gov.by/robots.txt - работает - вижу robots.txt
вывод tcpdump:
listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes
23:30:02.115218 IP 178.124.139.203.http > 10.8.0.6.51344: Flags [P.], seq 272799366:272799764, ack 63565427, win 96, length 398: HTTP: HTTP/1.1 200 OK
E.....@./.(..|..
....P...B.....sP..`....HTTP/1.1 200 OK
Server: nginx
Date: Fri, 26 Jul 2019 20:30:02 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 173
Connection: keep-alive
Last-Modified: Fri, 26 Jul 2019 04:28:06 GMT
Accept-Ranges: bytes
User-agent: *
Disallow: /ru/search_ru
Disallow: /en/search_en
Disallow: /by/search_by
Disallow: /*printv
Host: president.gov.by
Sitemap: http://president.gov.by/sitemap.xml
Но когда я пытаюсь curl -sSL -D - http://president.gov.by/
Я вижу это в выводе tcpdump сервера, но никогда на моем локальном компьютере:
23:30:39.493302 IP 178.124.139.203.http > 10.8.0.6.51366: Flags [.], seq 2193652739:2193654079, ack 1503148830, win 96, length 1340: HTTP: HTTP/1.1 200 OK
E..d..@......|..
....P....|.Y.;.P..`)"..HTTP/1.1 200 OK
Server: nginx
Date: Fri, 26 Jul 2019 20:30:39 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 112378
Connection: keep-alive
Last-Modified: Fri, 26 Jul 2019 16:38:45 GMT
Accept-Ranges: bytes
<!DOCTYPE HTML>
<html lang="ru-RU">
<head>
blah-blah-blah some html here
23:30:39.493315 IP 178.124.139.203.http > 10.8.0.6.51366: Flags [.], seq 1340:2680, ack 1, win 96, length 1340: HTTP
E..d..@......|..
....P.....?Y.;.P..`........................ .................... ................, .. .......... ...................... .................., .........., .............."/>
</head>
<body>
blah-blah-blah some html here
23:30:39.493317 IP 178.124.139.203.http > 10.8.0.6.51366: Flags [.], seq 2680:4020, ack 1, win 96, length 1340: HTTP
E..d..@......|..
....P.....{Y.;.P..`I".. class="search" id="search_form">
<div class="search_left"></div>
blah-blah-blah some html here
23:30:39.493320 IP 178.124.139.203.http > 10.8.0.6.51366: Flags [.], seq 4020:5360, ack 1, win 96, length 1340: HTTP
E..d..@......|..
....P......Y.;.P..`...............">..............</a>blah-blah-blah some html here </div>
<div class="top_m
23:30:39.493323 IP 178.124.139.203.http > 10.8.0.6.51366: Flags [.], seq 5360:6700, ack 1, win 96, length 1340: HTTP
E..d..@......|..
....P......Y.;.P..`/...enu_right"></div>
blah-blah-blah some html here
23:30:39.493325 IP 178.124.139.203.http > 10.8.0.6.51366: Flags [.], seq 6700:8040, ack 1, win 96, length 1340: HTTP
E..d..@......|..
....P...../Y.;.P..`u>.blah-blah-blah some html here
<div class="bm_da
23:30:39.494547 IP 178.124.139.203.http > 10.8.0.6.51366: Flags [P.], seq 8040:8173, ack 1, win 96, length 133: HTTP
E.....@...gp.|..
....P.....kY.;.P..`....te">25 ........ 2019 ........</div>
<a href="http://president.gov.by/ru/news_ru/view/rabochaja-poezdka-v-vetkovskij-rajon-gomel
23:30:39.633147 IP 178.124.139.203.http > 10.8.0.6.51366: Flags [.], seq 12193:13533, ack 1, win 96, length 1340: HTTP
E..d..@...b..|..
....P......Y.;.P..`blah-blah-blah some html here
23:30:40.186755 IP 178.124.139.203.http > 10.8.0.6.51366: Flags [.], seq 0:1340, ack 1, win 96, length 1340: HTTP: HTTP/1.1 200 OK
E..d..@...b..|..
....P....|.Y.;.P..`)"..HTTP/1.1 200 OK
Server: nginx
Date: Fri, 26 Jul 2019 20:30:39 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 112378
Connection: keep-alive
Last-Modified: Fri, 26 Jul 2019 16:38:45 GMT
Accept-Ranges: bytes
<!DOCTYPE HTML>
<html lang="ru-RU">
<head>
blah-blah-blah some html here
23:30:41.575025 IP 178.124.139.203.http > 10.8.0.6.51366: Flags [.], seq 0:1340, ack 1, win 96, length 1340: HTTP: HTTP/1.1 200 OK
E..d..@...b..|..
....P....|.Y.;.P..`)"..HTTP/1.1 200 OK
Server: nginx
Date: Fri, 26 Jul 2019 20:30:39 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 112378
Connection: keep-alive
Last-Modified: Fri, 26 Jul 2019 16:38:45 GMT
Accept-Ranges: bytes
<!DOCTYPE HTML>
<html lang="ru-RU">
<head>
blah-blah-blah some html here
23:30:44.350585 IP 178.124.139.203.http > 10.8.0.6.51366: Flags [.], seq 0:1340, ack 1, win 96, length 1340: HTTP: HTTP/1.1 200 OK
E..d..@...b..|..
....P....|.Y.;.P..`)"..HTTP/1.1 200 OK
Server: nginx
Date: Fri, 26 Jul 2019 20:30:39 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 112378
Connection: keep-alive
Last-Modified: Fri, 26 Jul 2019 16:38:45 GMT
Accept-Ranges: bytes
<!DOCTYPE HTML>
<html lang="ru-RU">
<head>
blah-blah-blah some html here
^C
11 packets captured
15 packets received by filter
3 packets dropped by kernel
Я застрял здесь. Почему я могу получить доступ к robots.txt, но не к файлам большего размера (index.html и т. Д.)