Hot answers tagged

3

This is not possible, as the MAC of a specific user is only visible on that user's network. Once that user's traffic transits a layer 3 boundary, the MAC is no longer present, nor is it useful information in the first place, as it is trivial for any user to change their MAC address. I would recommend looking into username-based limiting options.


2

Use "auth-user-pass credentials-file.txt" option in your client config file. The credentials file should be in the form: username password Yes, you will have the plaintext file with username and password.


2

when a user connects to OpenVPN the following learn-address script is called The $1, $2, and $3 are the arguments passed to the script, that are documented in the man page. --learn-address cmd ... Three arguments will be appended to any arguments in cmd as follows: [1] operation -- "add", "update", or "delete" based on whether or not the address ...


2

The systemd service file for OpenVPN (/lib/systemd/system/openvpn@.service) must be updated with a After=network.target network-online.target entry: [Unit] Description=OpenVPN connection to %i PartOf=openvpn.service ReloadPropagatedFrom=openvpn.service Before=systemd-user-sessions.service After=network.target network-online.target # This is needed ...


2

Hmm, OpenVPN's easyrsa creates certificates like this: CA1: X509v3 Subject Key Identifier: 87:13:73:D4:7C:9A:E1:EA:9A:F8:90:48:93:18:5A:B0:AF:B9:B6:25 X509v3 Authority Key Identifier: keyid:87:13:73:D4:7C:9A:E1:EA:9A:F8:90:48:93:18:5A:B0:AF:B9:B6:25 DirName:/CN=Easy-RSA CA serial:8B:E0:6F:16:C0:46:46:FC X509v3 Basic Constraints: CA:TRUE X509v3 Key Usage: ...


2

Is it possible to WOL via OpenVPN? Yes it is. Is there any way I can power on the PCs when tunnelling through OpenVPN? Yes, you've got following options: use OpenVPN in bridge mode (VPN & LAN share layer 2 segment, TAP device), forward UDP port 9 at your router from VPN side (when using VPN layer 3 subnet with TUN device), forward UDP port 9 ...


2

To get this setup working, is it simply a case of asking the people who own the building to forward port 1194 to the ip address they have assigned our router? Yes.* Or is it potentially more complicated than that? No.* Also, if we want to remote desktop in to one of our pcs, is it just a case of getting them to forward port 3389 to our router ...


1

Bad idea: My samba's (Version 4.1.21-SerNet-RedHat-11.el7) ca.pem has only year of validity. There's no CA private key. ca.pem - is CA certificate, cert.pem is AD's certificate and key.pem is AD's key. Solution? Do it backwards - use EasyRSA (3.0!) and regererate keys for samba's AD.


1

If I understand your configuration and network topology, then you should delete the redirect-gateway directive and instead add: route 192.168.188.0 255.255.255.0 If you want reach work machines by name you should configure your work dns server (if any): dhcp-option DNS <your work dns server LAN IP> Delete the two Google DNS entries. Regards ...


1

It's the EKU (ExtendedKeyUsage extension) rfc 5280 4.2.1.12 extKeyUsage says In general, this extension will appear only in end entity certificates. CABforum Baseline Requirements (v1.3.4) 7.2.2 g affirms this, but along with 7.1.5 allows one case: For a Subordinate CA Certificate to be considered Technically Constrained, the certificate MUST ...


1

You could create a Virtual LAN (VLAN) for the VPN users. Then you would configure the VPN router to deny access to specific ports/IP addresses/domain. You could also configured the EC2 instance to allow access based on the users IP address: "IpAddress": { "aws:SourceIp": "xxx.xxx.xxx.xxx/24" } Found that here: http://blogs.aws....


1

According to http://serverfault.com/a/698480/315895 you need the "multihome" option for openvpn to ensure it sends packets to clients from the correct IP (otherwise there is a very high chance they will be dropped by firewalls).


1

Okay,the setup does actually work. The iptables rules had not been saved after a reboot (Doh!)


1

I do not know the Web UI. But you can push routes via the vpn in the server config, i.e. in /etc/openvpn/server.conf with the line: push route 172.17.0.0 255.255.255.0 Per client configuration can be done in a separate dir (with "client-config-dir client-dir" in the server config). Hope this helps a bit.


1

They could only access services and files they owned through a service like FTP or SSH for example. If all you have is a vanilla server with just openvpn installed and those services are disabled then they have no way to access files on that server by normal means. However, OpenVPN does have an option that allows connected clients to work/connect together ...


1

You can use the directive route-noexec and manually set up the routing with up and down scripts on this specific client. You should have all required information in environment variables, see section Environmental Variables in the manpage.


1

If you are using dnsmasq as your DHCP server, you can push the DNS domain, DNS search list, and router to the clients. This should resolve your issue. dhcp-option=3,192.0.2.1 # Router dhcp-option=6,192.0.2. # DNS servers dhcp-option=15,example.com # Domain dhcp-option=119,example.com,com,org # Domain search list (clients ...


1

Display IPv4 firewall rules: iptables -L -nv - look at input chain, iptables -P INPUT ACCEPT - this will change firewall policy to accept all packets, iptables -F INPUT - flushing (deleting) all rules from the INPUT chain. IPv6: Same parameters different command, instead iptables use ip6tables. The above will ensure that packet filtering won't touch ...


1

Main Office LAN: 192.168.16.0/24 Branch office LAN: 192.168.1.0/24 Interconnection LAN: 192.168.2.0/30 (for example) On the main office router, add a PPP secret with local address 192.168.2.1 and remote address 192.168.2.2. On the branch router, create your PPTP client to the Main office (just like you did), it should get the correct IP (192.168.2.2). ...


1

OpenVPN per client traffic control To have a simple solution for traffic control on a per client basis, you could do something like the following. This solution only works for a /24 VPN subnet. Tested on Ubuntu 14.04. OpenVPN server example configuration: port 1194 proto udp dev tun topology subnet server 10.8.0.0 255.255.255.0 keepalive 10 60 comp-lzo ...


1

The following steps were needed to achieve my goal. echo "200 VPN" > /etc/iproute2/iproute ip route add default via 10.0.0.200 table vpn ip rule add from 10.8.0.0/24 lookup vpn Which gives me the following.


1

I'm a bit late to the party, but you can use the client-config-dir option to assign each client conf a local IP address. Then you can use Linux's Traffic Control (tc) to limit the bandwidth for each IP (and thus for each client). Would that work for you ?



Only top voted, non community-wiki answers of a minimum length are eligible