Tag Info

New answers tagged

0

Is it VPS (OVH) @ Canada? If so then you should contact your support. Your setup looks perfectly normal for me. According to iptables counters dump OS kernel does not receive anything @ openvpn's port (1194/UDP). It smells like connection issues for me. That's why openvpn doesn't work. You can't diagnose it, only your provider can. They usually use complex ...


3

After a lot of Googling and configuration file tweaks, I found the solution. I'm now getting sustained speeds of 60Mbps and burst up to 80Mbps. It's a bit slower than the transfer rates I receive outside the VPN, but I think this is as good as it'll get. The first step was to set sndbuf 0 and rcvbuf 0 in the OpenVPN configuration for both the server and the ...


0

According to the Config's you are using TCP as transport for the Tunnel. Consider using UDP instead of TCP since the stacked TCP connections tent to create problems in packet loss situations. As reference see Why TCP Over TCP Is A Bad Idea


0

Solved this one, there was an errant POSTROUTING MASQUERADE rule in the iptables unrelated to the OpenVPN installation. I removed the rule with: iptables -t nat -D POSTROUTING 1 Where 1 is the rule number retrieved from service iptables status.


1

I'm not sure whether it completely fulfils your needs, but you should probably take a look at tinc: http://www.tinc-vpn.org/. It quite closely matches the mesh network orchestrated by a central server as you described, but I'm not sure whether it will succeed in discovering peers in your local network.


0

The thing that lead me to the solution was that interestingly after I did a restart and not shutdown, the connection has established at startup. The problem comes from hybrid shutdown, implemented as default shutdown from Window 8. To turn this feature of I have followed these steps: Search for “power settings” from the Start screen. Click on “Change what ...


0

You have at least three possible solutions. Setting up policy based routing on your private PC. (hard to setup, more permanent, pretty) http://lartc.org/howto/lartc.rpdb.multiple-links.html Set up ssh port forwarding. (easy, junky solution) https://help.ubuntu.com/community/SSH/OpenSSH/PortForwarding Set up destination NAT (PAT) and source NAT @ VPS. ...


0

Logs, configs? You may have problems with your ISP's firewalling when using VPN @ broken location. You should set up openvpn @ port 443/TCP. If it still won't work you can also give a try to push traffic via HTTP proxy to mask it.


0

I think I've hit similar problem years ago. You can give a shot for: --multihome Configure a multi-homed UDP server. This option can be used when OpenVPN has been configured to listen on all interfaces, and will attempt to bind client sessions to the interface on which packets are being received, so that outgoing packets will be sent out of the ...


1

Using username/password authentication disables any Common Name use by OpenVPN. So it doesn't set the client Common name when logging in. The solution is to set the following flag in the server.conf file and restart the OpenVPN server: username-as-common-name This tells OpenVPN to set the username to the client's Common Name when connecting. Since the ...


2

First, do you have a client-connect script in place? If so, any IP directives from that take precedence. Secondly, according to the OpenVPN documentation, the client-config-dir only uses the client's X.509 common name to determine which file to use. You can validate if the joel file is not matching by creating a DEFAULT file. It appears that you are not ...


1

redirect-gateway is meant to tell the client to send all traffic through to the server. It redirects your default gateway through the VPN. If you want to disable it for one client, you can put the following in the client config to override redirect-gateway: route 0.0.0.0 192.0.0.0 net_gateway route 64.0.0.0 192.0.0.0 net_gateway route 128.0.0.0 192.0.0.0 ...


1

What does your firewall look like? OpenVPN doesn't have anything to do with source address of outgoing packets from routed VPN clients. You almost certainly have some kind of SNAT/MASQ rule in your iptables/firewall config. You need to change that. Or add an additional rule for your OpenVPN clients. The port OpenVPN listens on has nothing to do with ...


0

The 3 rules required are: iptables -t nat -A POSTROUTING -o eth0 -s 172.19.233.0/24 -j SNAT --to-source 46.aaa.xxx.bbb iptables -t nat -A PREROUTING -i eth0 -p tcp -m multiport ! --dports 22,53,80,123,443,1194 -j DNAT --to-destination 172.19.233.2 iptables -t nat -A PREROUTING -i eth0 -p udp -m multiport ! --dports 53,123,1194 -j DNAT --to-destination ...


1

In SSL terms, there should be no problems with this. The serial number and hash of the certificate may be the same. Its all part of the standard lifecycle of a certificate. The fact that it is a client certificate makes no matter. Disclaimer: I have no experience with OpenVPN.


0

Sound like you have successfully setup a remote-access vpn. http://en.wikipedia.org/wiki/Virtual_private_network Q: What do I need to configure in Windows/Linux to get access to the internal network of the client side? A: You need to use a site-to-site VPN tunnel. ...


0

Locate the OpenVPNgui.exe, openvpn.exe and openvpnserver.exe files in the bin folder of your open vpn install. Right-click the executables, select properties and then the compatibility tab. Click the "Run this program as an administrator" check box, and close the properties panel. Completely close out of OpenVPN (use task manager to confirm none of the ...


2

It simply depends on how the OpenVPN server is setup. Specifically which routes it pushes to the client. It can be that all your traffic will be sent to it (meaning the OpenVPN client changes your default route). But it's also very possible that only specific sub-nets are accessed via OpenVPN and other traffic is not.


0

SOLVED! ANSWER: DO NOT OVERWORK entire week long 16-18hours a day until 4:30am and expect your brain to not be FRIED! IT WAS A STUPID WINDOWS FIREWALL ISSUE!!! YES, I "THOUGHT" I had disabled it but apparently I was too sleepy to have noticed I only disabled domain and maybe outgoing but not incoming firewall! OK, I'm going to try and get some sunlight ...


0

If I've understood your question correctly what you're trying to achieve is addressed by the Linux Virtual Server project - http://linuxvirtualserver.org/. At the very least it will give you pointers to the issues.


0

Basically, a VPN-connected client appear as a "normal" network node, so it should be pingable/reacheable. That said, it really depends on the IPSec policies installed during client/server negotiation. If client/server negotiate a bi-directional policy (and no NAT is applied), the client will be visible. For example, I had similar configs both with a ...


0

Something similar happened to me in the past. It turn out that the OpenVPN server run out of disk space. This caused the OpenVPN daemon to stop operation because no more logs could be written. If possible, check your server free disk space.


0

I have a feeling you are not pushing your routes correctly from the server. I noticed that your gateway for the VPN is an IPv6 address. Try using the push option in server.conf to push your routes. You might also want to add the server directive so you can reserve the client subnet. If you're on linux you will need to have net.ipv4.ip_forward = 1 on the ...


0

Not being too Windows savvy wrt. OpenVPN, FWIW, here is my bid on what the culprit might be here: Looking at the output from your Windows route command, it seems you are missing a gateway entry for the OpenVPN network. True, you have an address on the VPN net (the 172.16.1.40 address), but no gw is defined for that net. On my box, I have access to several ...


0

I think you may have a misunderstanding on how internet circuits are sold. You have 70/20 and 60/10 circuits. Those numbers are bandwidth to the core network of your ISP. They are not making any promises that you will be able to upload at 20Mbit to any place on the Internet, nor could they make that promise technically speaking. Unless you have control over ...


0

As an alternative, can you make the OpenVPN server public? Eliminate the dual VPNs, and just have people connect directly to the lab.


0

What you have looks fine. To make it more readable and maintainable I would create a chain for the DNAT to your client. It creates more rules, but it's a lot easier to read and add/remove/change ports in the future. iptables -t nat -N DNAT_NET2VPN iptables -t nat -A DNAT_NET2VPN -p tcp --dport 22 -j RETURN iptables -t nat -A DNAT_NET2VPN -p tcp --dport 53 ...


2

ysdx's answer is great, and describes very well how the traffic will look on the wire. Left unmentioned, however, is that traffic analysis can go a long way toward identifying applications. Let's assume that your OpenVPN connection looks just like an https connection on the wire, so an attacker cannot read the byte stream and know what kind of ...


5

OpenVPN over TLS Your VPN is using TCP as a transport protocol. The stunnel instance is used to encapsulate the content of the TCP stream in TLS/TCP. You get this protocol stack: [IP ]<------------------------>[IP ] [OpenVPN]<------------------------>[OpenVPN] [TLS ]<~~~~~>[TLS] [TCP ]<->[TCP ...


1

Original link supporting the OpenVPN 2.x client-to-client feature: https://openvpn.net/index.php/open-source/documentation/howto.html#scope Uncomment this directive to allow different clients to be able to "see" each other. By default, clients will only see the server. To force clients to only see the server, you will also need to appropriately firewall ...


0

I have experienced a similar situation when the office was using Cisco Virtual Office(CVO). R&D dept had its own ASA/FW to host a lab subnet. We solved the problem by using hardware vpn. Issue an ASA or router to build site-to-site or DMVPN with the HQ router. Then the hosts connecting behind the hardware VPN only has to use OpenVPN(in your case) to ...


-1

I had this same question years ago and attempted to explain it in straightforward terms (which I personally found lacking in other resources) on my blog: An OpenVPN Primer Hope it helps someone


0

You need to explicitly add the CAP_MKNOD capability to your container. lxc.cap.keep Specify the capability to be kept in the container. All other capabilities will be dropped. When a special value of "none" is encountered, lxc will clear any keep capabilities specified up to this point. A value of "none" alone can ...



Top 50 recent answers are included