Tag Info

New answers tagged

1

What you will have problems to retrieve is the ca.key. The ca.cert is distributed to the clients alongside the client.crt and client.key. You should be able to get it from there. The ca.key on the other side not distributed and it is what is used to signing server and client certificates. The whole point of the PKI, Public key infrastructure, is to make ...


1

I happen to be running an OpenVPN server in TCP mode, and I can confirm that you cannot use openssl s_client to get the certificate: [me@risby 17]$ openssl s_client -connect openvpn.example.com:1194 CONNECTED(00000003) 140413456672632:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:184: --- no peer certificate available --- No client ...


0

By default, Ubuntu ships OpenVPN with a legacy startup script. This makes Upstart unable to restart service when it crashes. Legacy scripts also make use of pid files, which are not necessary with native Upstart jobs. So having a native job looks like a solution to your problem. I've written Upstart job definition for OpenVPN myself and use it for 2 years ...


-1

i think its necessary to have certification authority but its not necessary to have private key with .key and .crt file when you using active directory s such as LDAP and other authorization tools such as radius


0

several things I can think of, 1) make sure your server is a router, e.g it will forward packages from your clients to other networks.. .this is done like this: echo 1 > /proc/sys/net/ipv4/ip_forward or to make this more permanent: pico /etc/sysctl.conf uncomment or add something like this: net.ipv4.ip_forward=1 also, does the client get ip ...


0

Existence of file: /dev/net/tun (character device) is not equal to existence of kernel module called 'tun'. Solution: add tun device to kernel configuration and recompile the kernel.


0

First, I never recommend keeping SSL CA private key on a device directly connected to WAN. This is insecure. In OpenWRT a configuration for OpenVPN is in /etc/config/openvpn - option names are almost identical as in OpenVPN original config, except for in OpenWRT hyphens (-) should be converted to underscores (_). Follow this howto. Remove ...


0

My question is, when is the DNS lookup performed by clients to resolve the new IP for OpenVPN When the connection is first established. how can I trigger a lookup to make clients use the new IP? This varies depending on OS. If your users are using OSX, for example, $ dscacheutil -flushcache will flush the local cache. Other OSes have similar ...


0

Looks like I forgot to move the client.conf from the /etc/openvpn/ directory so when I uncommented those lines it just looped all the traffic of the server within the server! Doh!


0

http://askubuntu.com/questions/28733/how-do-i-run-a-script-after-openvpn-has-connected-successfully tells how you can execute custom scripts after connection going up or down. So, you should create a down script, which would clean up the routes and make OpenVPN execute that when connection goes down.


0

This is how I solved it: Check whether OpenVPN is listening on Port 443 TCP. Check according to the config, as well as an port check service. Set port-share to port-share {IP} {PORT} How to know the {IP} and {PORT}? In nginx: server { listen {IP}:{PORT}; } In Apache: <VirtualHost {IP}:{PORT}> ServerName {IP} ServerAlias {IP} ...


0

The questions you are asking are mismatched. OpenVPN is a service to provide a secure, private network to a group of hosts. TightVNC is a remote desktop server and viewer application that you would use to view and possibly control a remote machine that is running a VNC server. If the end result is you would like users to view and possibly control your ...


1

One of my clients depends heavily on OpenVPN over a multi-site setup, and we take two approaches: The main OpenVPN service is provided by two machines, in an HA-failover pair using heartbeat/CRM. If one goes down, the other takes over the shared IP addresses, and service continues. Existing sessions will be dropped, but the clients usually reauthenticate ...


0

We want to setup an other VPN server, but how we solve the failover part, if something would happen. Ok. If you using Linux , then 1) Simple way is use monit https://mmonit.com/monit/ 2) Bash script in cron like my https://github.com/darkhex/bash_scripts/blob/master/work-scripts/check_vpn.sh 3) Zabbix with triggers


0

If you're having this issue and are running the server from a VM in ESXi, the problem is that ESXi doesn't allow promiscuous network interfaces by default. To solve this, go into vSphere client, then Configuration -> Networking -> Properties -> Edit -> Security ->change Promiscuous Mode to Accept.


0

I solved my problem and now it's work for me. I changed the iptables rules both machine to this: iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth1 -j MASQUERADE iptables -t filter -A FORWARD -i tun0 -o eth1 -j ACCEPT iptables -t filter -A FORWARD -i eth1 -o tun0 -j ACCEPT


0

Since you have static IP at 'client'... (which is also the IP of your PFSense I bet?) Simply set up port forwarding on your PFSense. Just so you get from the static public socket (public ip and port) of your pfsense to the private socket (LAN ip and port) of the 'client' box. That way you will be able to connect to 'client' while on the road. Once you can ...


0

On their page, they say that the service is down with a listed alternative. Use that instead


0

Okay, I simply forgot the masquerading: -A POSTROUTING -o eth0 -j MASQUERADE -A POSTROUTING -o tun0 -j MASQUERADE It's solved.


1

What are you seeing re: "receives the packet"? It doesn't appear it's responding at all. Try to telnet to the port where you're running OpenVPN. Guessing maybe you didn't add a firewall rule on WAN allowing traffic to reach the OpenVPN server instance and it's getting blocked. You'll see that in the firewall log if that's the case. You're best off using ...


0

It should be push route [subnet] [subnet mask] [metric] Example: If the OpenVPN server's info is: Server IP: 10.10.10.254 Subnet: 255.255.255.0 Gateway: 10.10.10.1 OpenVPN IP: 10.10.11.1 Subnet: 255.255.255.0 Then the configuration should be: push route 10.10.10.0 255.255.255.0 1 This should let your VPN clients add the necessary static routes to ...


1

The problem was not in Shorewall config at all. There actually WAS access from VPN to the Internet, but VPN clients had wrong DNS server address. There was a line in OpenVPN's server.conf push "dhcp-option DNS 192.168.0.1" Which didn't make sense in given setup. I corrected the address, and now VPN clients do have access to the Internet.


0

After a lot of a research, and trial and error, it turns out this is pretty easy to do. You do have to run multiple instances, one per bridge, in order to isolate all of the users to their respective networks. You just add a new .conf file for each instance and Debian will automatically create a new instance per .conf file. Just make sure you use different ...


1

I once did something like this for individually firewalling each user's connection. I have implemented it using the learn-address script in OpenVPN which is called when a user connects or disconnects. I have adapted it for your use case. The script looks as follows: #!/bin/bash statedir=/tmp/ function bwlimit-enable() { ip=$1 user=$2 # ...


0

I think it is all a matter of setting the topology parameter to subnet, and then specifying the netmask on the server parameter at the server's config file, like: server 10.8.0.0 255.255.255.0 Without the topology parameter it seems those changes will not work. Extracted from here.



Top 50 recent answers are included