Tag Info

Hot answers tagged

3

(This answer is specific to the use of key-direction for tls-auth keys. For static key mode, please always use key-direction.) The advantage of using different keys for each direction is that packets originating from one peer can never be replayed back to that peer by a man-in-the-middle attacker. Of course the underlying TLS and OpenVPN protocols should ...


2

I would use OpenVPN. IPSec is more mature than OpenVPN, but is heavier, have more overhead, and is a pain to configure and troubleshoot. L2TP and PPTP are other examples, but they are harder to make work and harder to cross firewalls and NAT. Configure OpenVPN with all security options turned on, create separate certificates to each client, configure the ...


2

I have been unsuccessful looking for examples of other folks having done this. I am doing something like above. I have a bunch of appliances I maintained deployed to customer's networks. They maintain an OpenVPN link so I can update, manage, and monitor them. IPsec, while good theoretically, often takes more work to get through firewalls. Setting up a ...


2

Use a dynamic DNS service. Get a hostname for each site. configure VPN connections to use hostname for each connection instead of the sites IP address (Since you said its dynamic and subject to change) The dynamic DNS service should come with an application that monitors for an IP address change, and updates the hostname record automatically.


2

You can solve the issue of not being able to browse the web through the VPN despite being able to ping, traceroute... by one of the two following ways: First, you can use TCP protocol instead of UDP, by changing 'proto udp' to 'proto tcp' in both client and server conf files. Second, you can use tap device instead of tun, by changing 'dev tun' to 'dev tap' ...


1

Confirm that your firewall on the CentOS server (internal zone if that where the tun0 device is located) has https available as a service. You should be able to ping the server on 10.8.0.1 from the Windows machine. If this works, then your VPN is up and working and it's probably the CentOS server's firewall blocking you. If the ping doesn't work, then you ...


1

This should be as simple as adding a route statement in your OpenVPN configuration on the client. Something like the below, if you only want to redirect the single address. route 10.0.0.130 255.255.255.255


1

pkill -SIGTERM -f 'openvpn --daemon --conf $OPENVPNCONFFILE' the pkill command allows you to signal a process based on name or other attributes This will send SIGTERM to the openvpn causing it to gracefully quit and close the tun interface. You may/will need to modify the section after -f to match the way you started the openvpn connection. I found this ...


1

Can it be done? Sure. Is it a good idea? No. Instead, use IPSec. It's a very mature technology that is baked into all modern OSes, and is a much better choice for "infrastructure" type VPN connections. OpenVPN is great, but IMO, should only be used for remote worker type use cases, not for infrastructure.


1

In the passive FTP mode, the server sends back to the client an IP address and a port the client needs to connect to for opening data transfer connection (for file transfers and directory listings). If that is a different IP address than the one you actually need use to connect to the server (due to NATing for example), the connection fails. Were the ...


1

Use the eFive OpenVPN CA cert to create cleint certs. You can not create client certs from username and password. There are utilities for managing certs. 'x509-util' and 'xca' packages are available on Ubuntu. Search for x509 utilities for other platforms.


1

It's not possible. Client certificates have to be created by a ca the openvpn server trusts. Update: I now had a look at the eFive docs. It seems like eFive OpenVPN Appliance only supports password authentication for clients. OpenVPN supports client certificates, password authentification and using both together. And, as I saw looking at the RUT550 docs: ...


1

tcpdump (and its replacement tshark) defaults to the "lowest numbered" interface. Typically this is eth0. In order to capture traffic on the OpenVPN interface tun0 you need something like this, tcpdump -i tun0 port 6514. (The interface name any can be used to capture on all interfaces.) See if you get any syslog traffic there. Another thing to try is to see ...


1

First of all, thanks to @Shivox for his answer. And here is the quick how-to: I recommend you create additional network (see "Networks" tab"). In network preferences, add allowing rules for: tcp:22 (if not exist), tcp:9700, tcp:17619. 17619 here is variable - change it to any port you like (range is 9075-65534). You only need 3 rules and 2 default routes, ...



Only top voted, non community-wiki answers of a minimum length are eligible