Tag Info

New answers tagged

0

I have found a set of scripts at dnsleaktest.com which removes any existing links to DNS resolvers before the tunnel is created and adds those of the VPN connection. It also reverses this once the connection is closed.


0

I have found a set of scripts at dnsleaktest.com which removes any existing links to DNS resolvers before the tunnel is created and adds those of the VPN connection. It also reverses this once the connection is closed.


1

You can change your HELO policy to: smtpd_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_unknown_helo_hostname ...and add your home mail server's address to mynetworks = ... line. Although the answer by @JennyD is valid and should solve your problem, it can be better to keep ...


0

TL;DR version: On the EC2 Dashboard, select the EC2 instance running OpenVPN Access Server Click Actions -> Networking -> Change Source/Dest. Check -> Yes, Disable For more information: Disabling Source/Destination Checks It turns out that all my OpenVPN and route settings were correct, and it was an issue specific to AWS. I stumbled upon the answer ...


1

Sounds like Qos (Quality of service) needs to be implemented. Depending on where your OpenVPN set up is configured (local, device behind the router, or on the router itself) and if the other people saturating the connection are also using the VPN connection, either your router or VPN device will need to have QoS applied to it.


1

Here's the issue: smtpd_helo_restrictions = reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_unknown_helo_hostname The last of those, reject_unknown_helo_hostname, tells Postfix to reject mail if the hostname given in the HELO command cannot be resolved. If you remove that, your problem should go away. You should reverse the ...


0

You won't be able to diagnose the error you are getting purely by looking at the route tables. That particular error is almost always related to you trying to add a new route that is identical to a route that already exists on your system. If you bump up your OpenVPN logging you should see what route command is failing in your logs. OpenVPN is slightly ...


0

This problem can happen when the default gateway for the hosts on the LAN is not the OpenVPN server. In such a case, the hosts need a static route for the VPN addresses so that the replies go to the VPN server instead of the default gateway. On the LAN hosts, check the routes (route print for Windows, route -n for Linux, Ē¹etstat -rn for Mac).


0

As suggested, probably best to change your network layout if it's really that important. However, it should be possible to add a static route to the remote router interface. I'm not 100% familiar with the Windows syntax for adding a route but on the VPN client it should be something like: route -p add 192.168.1.1 mask 255.255.255.255 ...


5

Change the IP address scheme of your network.


0

I used another guide and had the same error message. In the first step I could assure that packets are arriving at the server (by using tcpdump). The verbose log files stated that after some received packets there were no more received. At the end the firewall on the server was the problem. This firewall was blocking packets in iptables FORWARD chain. ...


1

I found answer to my question: Start OpenVPN: openvpn --config /path/to/config.file & Wait until it successfully connects: until ip l sh tun0 >/dev/null 2>&1 ; do sleep 1; done Delete rule which makes tun0 default interface: ip route del 0.0.0.0/1 via 192.168.101.1 dev tun0 Enable ip forwarding: sysctl -w net.ipv4.ip_forward=1 ...


1

Yes, you can do this by writing a client-connect script that checks the source IP of the connection (in the trusted_ip or trusted_ip6 env var) and then returns non-zero if it doesn't like it. You'll need to set script-security to 2 in order to permit OpenVPN to actually run your script.


0

use hosts file as in 10.8.42.12 example.org or add entry to DNS server. create file with (e.g.) contents modifying the ns1.exampledns.com to point to a valid address ; Zone file for example.org $TTL 3600 $ORIGIN example.org @ IN SOA ns1.exampledns.com. root.example.org. ( ...


-1

Sure, the DNS solution as per tomstephens89 answer is one possible answer, but it works only if you type any domain name, and also that won't work if the client alter the DNS servers pushed by the server. What do you really want is a solution, which is sometimes called Captive Portal. I am not strictly inside that topic, but SQUID which is a powerful HTTP ...


1

You need to set a DNS A record somewhere, either on your VPN network or another network to which the clients can reach. If you have a DNS server on the VPN network (or a network routable from the vpn connection) then you can configure openVPN to push DNS server addresses down to the clients so that when they connect, DNS's requests will go to the server you ...


0

It is actually possible with VxLAN Extract : Virtual Extensible LAN (VXLAN) is a network virtualization technology that attempts to ameliorate the scalability problems associated with large cloud computing deployments. It uses a VLAN-like encapsulation technique to encapsulate MAC-based OSI layer 2 Ethernet frames within layer 4 UDP packets, using 4789 as ...


3

LLDP is a layer 2 protocol. Therefore it cannot work over a routed connection.


1

You're most likely missing routes. On your VPN server, add this directive to add routes to your local subnet: push "route 10.20.0.0 255.255.255.0". That will tell VPN clients to route traffic through the VPN for that subnet. It looks like you might have done this, but be aware that yours has a subnet mask of /16 while the routing table on the LAN client ...


0

Why server-bridge? Why would you use a bridge if you want to implement firewall rules? If you give clients a layer 2 tunnel to work with, then they are going to be able to change their layer 3 addressing.


0

I'm not 100% sure but I think the issue is you are also pushing out a /24 to the clients so they are free to change it because of that. You want to push out a smaller subnet to each client. ifconfig-push 10.113.20.10 10.113.20.9 The next one would be ifconfig-push 10.113.20.14 10.113.20.13


1

You'll need the redirect-gateway option in your openVPN server config, as described here (redirects all traffic). Alternatively, there's the push "route <ip> <mask>" option to send traffic to specific IP/ranges through the VPN, as described here.


0

Going by your diagram, you should use client specific configuration and the iroute command to expose the LAN networks behind Client A and Client B to each other if you haven't done so. Also set up routes for traffic to the other LAN on every client http://backreference.org/2009/11/15/openvpn-and-iroute/ Also check that you have added the right advertised ...


0

FIXED I just forgot to change the network adapter from eth0 to venet0 (its a openvz vserver). My IPTABLES rules: sysctl -w net.ipv4.ip_forward=1 iptables -A FORWARD -o eth0 -i tun0 -s 10.8.0.0/24 -m conntrack --ctstate NEW -$ iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -t nat -A POSTROUTING -o venet0 -j MASQUERADE


1

Its likely you havn't set outbound NAT for the VPN network that your server uses. Therefore your router on the server network doesn't know to translate traffic from your VPN network to a WAN side IP.


0

Compression only works if the data you are transmitting can be compressed well. Binary data does not compress well, so if you are going from client to HTTPS sites through an OpenVPN tunnel, you will have both the overhead of encryption and compression without much gain in reducing your bandwidth. It wasn't clear to me if client CPU load was a secondary ...


0

Reducing bandwidth can be handled in a variety of ways: compression caching with a proxy like squid eliminating traffic. Installing ad blockers has been shown to reduce bandwidth consumed by 25-50%.


0

You must make sure your router has an outbound NAT entry for the VPN 192.168.2.0/24 network and that DNS has been set. See this: https://openvpn.net/index.php/open-source/documentation/howto.html You must redirect the gateway: push "redirect-gateway def1" Make sure the client has DNS set or push it with openVPN using push "dhcp-option DNS x.x.x.x" The ...


0

Solved it. I ended up simply bridging eth0 with tap0 on the client. This united both initial routes into a single route pointing to br0. Unlike the server, the interface bridging on the client's side must take place after the openvpn connection has been established!


0

I encountered the same problem and came to the conclusion that Linode is not well suited for this kind of VPN configuration. First of all: what you tried to do (setup a route) from 192.168.137.63 (eth0:1 on nix03) to 172.20.1.1 (tun0 on internal) is indeed correct and works in non-Linode setups. I described the same setup in Linode forums and I got a reply ...


1

It is simply a part of the OpenVPN protocol, indicating some initialisation instructions. For the exact decoded meaning, you'll probably have to check the OpenVPN source to see exactly what it's saying.


0

You may get some useful diagnostics out of increasing the logging verbosity (verb 4 seems to be the sweet spot). I think that at low verbosity, the log stopping there means that the client isn't managing to establish any sort of connection to the server, so the first port of call will be to verify the firewalling situation on both ends, and of course wave a ...


0

for anyone killing themselves over some weird NAT issue like mine. Well it was the modem in the end. The one provided by my ISP. A "ZTE ZXHN H108L" with firmware "ZXHN H108LV4.0.0e_ZRQ_GR4" (the problem first appeared with version "d" of the firmware, but the upgrade did not solve it). I replaced the modem with another one I had laying around and voila. ...


2

You probably want to specify an up script, which will receive the ifconfig_local and ifconfig_remote environment variables, which contain the local and remote IP addresses assigned to the VPN tunnel. You'll also need to set script-security 2 in order to have your script actually run.


0

Your routing is fine. The server is the destination because you are looking at the IP header. You have to look at the Ethernet frame header to see the routing towards your gateway. Obviously, you won't see IPs there, what you will see is that the destination of your packet is the MAC address of your gateway (192.168.3.1). Unfortunately it's impossible ...


2

Generally, your situation seems to predicate CCD, "client config dir". CCD is a directory containing one file per connection profile. The file is tied to a unique client key, so that the key "johndoe" gets the profile specified in ccd/johndoe assigned when connecting. With this approach, you know which IP a specific client has. However, if you just want to ...


-1

On both Site A and Site B For your VPN Tunnel instead of using 10.1.10.0/24 try 10.1.10.0/30 I believe what you are doing should work, and I think this may be a bug in pfSense - I can't get the way you are doing it to work either, however it works from if I use /30...


0

As per the first warning, you should add ns-cert-type server to your client config [OpenVPN Manual][1] As per the last line, you need to regenerate one of your keys, or change your config: openvpn --genkey --secret /share/MD0_DATA/Download/vpn/vpn.key ; or Remove the number from behind --tls-auth in your client config. You need to then remove Group ...


3

Your clients need a route to 192.168.2.0/24 (the network being used by your vpn clients). The easiest way to do this is to ensure that the default gateway for your network (192.168.1.1) knows you to reach that network, possibly by setting up a static route to 192.168.2.0/24 via your OpenVPN server. How to do this depends on your router; on Linux, that ...


1

Solved using 2 instances of openvpn and subnet topology. It was enough copy server.conf to server1.conf, change port and server's ip range and also rename some files which clashes with server.conf (logs etc). When service restarts it automatically creates instance of openvpn for each config.



Top 50 recent answers are included