Tag Info

New answers tagged

0

It seems like your S1 service config not listening tun interface. There is no problem with routing. What is your service ? Can you show config of it ? Anyway - try telnet 10.8.0.1 1800 on S1 telnet X.x.x.221 1800 on S1. If you will receive an answer in one of cases - search problem in service config file.


0

You could manually remove the existing static routes on C1 for 10.8.0.1 and 10.8.0.5; example: route del -net 10.8.0.1 gw 10.8.0.5 netmask 255.255.255.255 dev tun0 Then add a new route on C1 using: route add -net 10.8.0.1 gw 10.8.0.6 netmask 255.255.255.255 dev tun0 See if that works. Remember to keep track of your old routes, in case you need to ...


0

I resolved this by adding the following lines in my config route 10.1.30.0 255.255.255.0 push "route 10.1.10.0 255.255.255.0" push "route 10.1.30.0 255.255.255.0" and added the following lines for my client in the CCD folder less /tmp/etc/openvpn/server1/ccd/CALPHA iroute 10.1.30.0 255.255.255.0


0

So your service S1 must be listening on the VPN IP, 10.8.0.1, and your client C1 need to connect to 10.8.0.1:1800 ... as long as your VPN if fully working.


0

Roughly: Cron job at the first of the month that resets the accumulated count to 0. A regular script (per minute?) that dumps the current interface counter, compares the last counter value, and adds that back to the current accumulated count. That part is necessary because the interface counter might be reset to 0 and you want an increasing count only. ...


1

Briefly, the following points can be used as reference: Ensure that the DH params key is >= 2048 bits in size. If not, it should be re-generated. Ensure that the tls-cipher setting in the OpenVPN configuration file isn't overwritten, or if it is, that no weak and export-grade ciphers are included. (If it is not defined at all in the configuration, the ...


0

Based on the idea of deleting a route proposed by @MadHatter, I created an alias that does essentially this: sudo openvpn --config /path/to/config --route-nopull sudo ip route add x.x.x.x/24 dev tun0 Where x.x.x.x/24 is the path of the internal network you are connecting to through the VPN. Now I can use this alias when I want only traffic for the ...


0

It's been a long time. However, I would like to encourage anyone who is having such an issue to ensure their VPN is a site-to-site setup. After switching to UBNT EdgeRouter with Site-to-Site OpenVPN, printing time is practically instantaneous.


1

If the server publishes a default route to you, you may ignore it, with eg route delete default tun0 and you can restore your pre-vpn-connection default route similarly. If on the other hand the server doesn't publish such a route, you may opt to route all your traffic over the VPN, though in this case you will need to ensure that (a) the VPN server is ...


4

The attacks only affect OpenVPN in very limited ways, because: OpenVPN encourages users to generate their own DH-group using 'openssl dhparam', instead of using common groups. The man page / examples used to provide 1024 bits DH keys (updated to 2048 recently), and although 1024 bits dh params can be broken, that is still very expensive. Probably too ...


0

As we can't know anything about that how your network looks like. Long shot; do you have client-to-client in your server's openvpn config file? If your servers are connected to VPN network using openvpn as client, then the sentence could be true. PS. What kind of distro are you using?


0

To force manual IP assignment use ifconfig-pool-persist ipp.txt 0 instead of ifconfig-pool-persist ipp.txt make sure that you have added IPs to all clients.


2

As you said, we spend hours together to debug this... Regarding all tests we have done and all trace we retrieved, it finally appears that we were experiencing some weird behaviours regarding the Virtual Interface eth0:1. e.g : http://lartc.org/howto/lartc.iproute2.html Most Linux distributions, and most UNIX's, currently use the venerable arp, ...


1

If you can ping, there is traffic in your bridged interface. You can watch the traffic using the appropriate options of tcpdump: tcpdump -elnXXi br0 In the same way, you can totally filter this traffic using iptables, taking into account that it will only operate to the IP layer. You would need ebtables if you need to filter traffic on layer 2 (Ethernet)


0

You can set up DHCP server and push routes using it: http://superuser.com/questions/874671/how-can-i-inform-mac-os-and-ios-clients-of-vpn-routes Remove persist-tun and pushing IP to client in VPN server configuration file. I have this setup in a company I take care about, works perfectly. Basic idea of this solution is that Windows will deconfigure VPN ...


1

I assume from your question and configuration that you intend on allowing internet access to the client through the server. In that case, it seems to me that your openvpn configuration is correct. However, your filtering is not complete. As it is, you set it up to forward new packets from tun0 to em0 (which I assume to be the ethernet connection on the ...


0

Sure that u can reuse it. I'd say it's preferred if your client is same machine / user. You can also use OpenVPN config directive duplicate-cn, which will tell OpenVPN daemon to accept multiple clients with the same certificate. No it's not good practice: because if one certificate compromises you may lose security in many points of your network, you can ...


2

Routing table looks okay, look at metric column. Route with the lowest metric will be preferred. Your routing table contains now two default routes and 10.11.12.13 will be preferred over 192.168.178.1 because of lower metric. About the traffic on physical interface; this is also normal because you have listening services which respond for ...


0

You should try using reneg-sec 0. Just sayin.


0

The easiest mesh vpn I have found and used is PeerVPN (http://www.peervpn.net/). PeerVPN Features Ethernet tunneling support using TAP devices. IPv6 support. Full mesh network topology. Automatically builds tunnels through firewalls and NATs without any further setup (for example, port forwarding). Shared key encryption and authentication support. ...


0

Another solution, add recursion to 10.1.0.0/24 net, by adding this line in /etc/bind/named.conf.options, as follow: allow-recursion { 10.1.0.0/24; };


0

Main advantages of Open VPN are: Very easy to install and use Released in 2002, this OpenVPN open-source software is very easy install and use. You can install it on a server and client on any platform (such as Linux, Windows, Mac OS X, and others) without restrictions. OpenVPN server waits until a client submits a request for connection, and the client ...


0

Since you want to affect the traffic generated on the local machine, you need to edit the OUTPUT target rather than the PREROUTING. (Or maybe keep both of them)


0

OK, I figured this out. openvpn 2.3.6 supports this by default (no need to recompile, plugins, etc). So I need to add to ovpn conf file: static-challenge "Enter Google Authenticator Code" 1


0

I don't think it is possible with openvpn when you enable the client-to-client setting, but if you put a proxy in between and direct communication between openvpn clients on the same openvpn server to the proxy then communication between clients will appear to come from that proxy. I think in that case client-to-client does not (should not?) need to be ...


1

Privoxy is an HTTP proxy. What you're trying to do is feed it intact network packets, which I'm 99% sure it's not going to accept that without some very complex mangle rules in iptables. Instead you should expose the proxy to the VPN (seems like it is already), and push it as a DHCP option to your VPN clients. Instructions for doing that via OpenVPN can be ...


2

You can push proxy configuration to the OpenVPN clients. From the OpenVPN Access Server web interface go to Advanced VPN Settings → Server Config Directives and enter the following directive with your proxy ip/port info. push "dhcp-option PROXY_HTTP 111.222.333.44 8118" I am not sure if all OpenVPN clients support this config. But on IOS it works well.


0

You need to have keepalive enabled. Ask your VPN provider to add: keepalive 10 900 to the servers config file.


0

Solutions (from comments) add allow-recursion in the bind (which was changed from the default permissive settings around bind 9.4) Possible solution: Try using public DNS server like google famous 8.8.8.8/8.8.4.4. Push route of 10.0.0.9 IP to VPN client by adding this line in your server.conf: push "route 10.0.0.9 255.255.255.255" I hope it worked. ...


1

Is it possible, that the SSH server will 'understand' that the user has already authenticated? No. Just implement key auth for SSH as well. Then your users can ssh into your servers without typing a password at all (save for the initial private key load into your ssh key agent). You really should be using key authentication anyway. Doing this is a ...


0

I failed to understand why to shoot from cannon to the fly. IHMO there's a simpler way: To use build-in OpenVPN features and linux iproute2 for multipath redundancy. I'll be safer, more stable and less resource consuming. Source: https://openvpn.net/index.php/open-source/documentation/howto.html Implementing a load-balancing/failover configuration Client ...


0

Failover? Yes, I do it all the time, using heartbeat and CRM. It's not worth trying to replicate or preserve state; when the failover happens, all connected clients will reauthenticate anyway, and that's fine for road-warriors. It wouldn't be fine for site-to-site VPNs, but (imho) OpenVPN is the wrong tool for those, anyway.


1

Ensure that management is enabled in your server's config file. If not, add the directive: management 127.0.0.1 5000 Here, you can access all information available from a running OpenVPN server. Connect with: telnet localhost 5000 In order to extract and log custom data, I suggest using this perl module. Here is a simple example script, which extracts ...


0

Is it VPS (OVH) @ Canada? If so then you should contact your support. Your setup looks perfectly normal for me. According to iptables counters dump OS kernel does not receive anything @ openvpn's port (1194/UDP). It smells like connection issues for me. That's why openvpn doesn't work. You can't diagnose it, only your provider can. They usually use complex ...



Top 50 recent answers are included