New answers tagged

0

I managed to work it out. Although I had already added net.ipv4.ip_forward=1 to /etc/sysctl.conf (which most guides point out), I also need to add net.ipv4.conf.all.proxy_arp=1. The iptables configuration then just needs to allow all traffic on both interfaces and it works!


0

This is a designed-in limitation: If either VPC in a peering relationship has one of the following connections, you cannot extend the peering relationship to that connection: A VPN connection or an AWS Direct Connect connection to a corporate network http://docs.aws.amazon.com/AmazonVPC/latest/PeeringGuide/invalid-peering-configurations....


0

A quick turnaround way for this could be modifying how logging is working to make it record $http_x_forwarded_for values which will then log actual client IP. Not sure weather you will be able to modify how your logging is happening but i hope this helps.


1

Bad idea: My samba's (Version 4.1.21-SerNet-RedHat-11.el7) ca.pem has only year of validity. There's no CA private key. ca.pem - is CA certificate, cert.pem is AD's certificate and key.pem is AD's key, Short CA cert length (1024b) - minimum recommended by OpenVPN developers is 2048b. Solution? Do it backwards - use EasyRSA (3.0!) and regererate keys for ...


1

It's the EKU (ExtendedKeyUsage extension) rfc 5280 4.2.1.12 extKeyUsage says In general, this extension will appear only in end entity certificates. CABforum Baseline Requirements (v1.3.4) 7.2.2 g affirms this, but along with 7.1.5 allows one case: For a Subordinate CA Certificate to be considered Technically Constrained, the certificate MUST ...


1

If I understand your configuration and network topology, then you should delete the redirect-gateway directive and instead add: route 192.168.188.0 255.255.255.0 If you want reach work machines by name you should configure your work dns server (if any): dhcp-option DNS <your work dns server LAN IP> Delete the two Google DNS entries. Regards ...


0

Answer is that I were needed to add route on both clients


0

CCD is an overkill for simple task like assign statc IP. (Looking from sysadmin point of view, excuse me :) Source: man openvpn --ifconfig-pool-persist file [seconds] Persist/unpersist ifconfig-pool data to file, at seconds intervals (default=600), as well as on program startup and shutdown. The goal of this option is to provide a long-term ...


2

Hmm, OpenVPN's easyrsa creates certificates like this: CA1: X509v3 Subject Key Identifier: 87:13:73:D4:7C:9A:E1:EA:9A:F8:90:48:93:18:5A:B0:AF:B9:B6:25 X509v3 Authority Key Identifier: keyid:87:13:73:D4:7C:9A:E1:EA:9A:F8:90:48:93:18:5A:B0:AF:B9:B6:25 DirName:/CN=Easy-RSA CA serial:8B:E0:6F:16:C0:46:46:FC X509v3 Basic Constraints: CA:TRUE X509v3 Key Usage: ...


2

Is it possible to WOL via OpenVPN? Yes it is. Is there any way I can power on the PCs when tunnelling through OpenVPN? Yes, you've got following options: use OpenVPN in bridge mode (VPN & LAN share layer 2 segment, TAP device), forward UDP port 9 at your router from VPN side (when using VPN layer 3 subnet with TUN device), forward UDP port 9 ...


1

Okay,the setup does actually work. The iptables rules had not been saved after a reboot (Doh!)


-1

Openvpn tun is not intended to transport layer2 traffic as the one involved in DHCP setups. Even if you manage to configure a DHCP relay on the other side (work around) you'll have then to set routes properly.


0

Thanks a lot for the answer! Just to be sure - if the client uses eth0 to access the internet (work network), and client TAP adapter also uses eth0 to access VPN (home network) - the adapters aren't bridged (my home network isn't available to work network) - I think this is the most common use case? The interfaces would be bridged only if I manually make a ...


1

I do not know the Web UI. But you can push routes via the vpn in the server config, i.e. in /etc/openvpn/server.conf with the line: push route 172.17.0.0 255.255.255.0 Per client configuration can be done in a separate dir (with "client-config-dir client-dir" in the server config). Hope this helps a bit.


0

The real answer is : Publish a vpn endpoint. This can be behind building NAT (it is better in a publicly visible endpoint). From remote, you vpn to your network and then rdp over the vpn. Making RDP publicly accessible is a bad bad idea.


2

To get this setup working, is it simply a case of asking the people who own the building to forward port 1194 to the ip address they have assigned our router? Yes.* Or is it potentially more complicated than that? No.* Also, if we want to remote desktop in to one of our pcs, is it just a case of getting them to forward port 3389 to our router ...


1

You could create a Virtual LAN (VLAN) for the VPN users. Then you would configure the VPN router to deny access to specific ports/IP addresses/domain. You could also configured the EC2 instance to allow access based on the users IP address: "IpAddress": { "aws:SourceIp": "xxx.xxx.xxx.xxx/24" } Found that here: http://blogs.aws....


1

According to http://serverfault.com/a/698480/315895 you need the "multihome" option for openvpn to ensure it sends packets to clients from the correct IP (otherwise there is a very high chance they will be dropped by firewalls).


0

Ok, I managed to fix this. Problem is that server and client configuration files have to have same settings. I first had TLS on one side but not on other, then second problem is that I had comp-lzo on one side but not on other. Linux is working over network manager because there I also trifled with configuration files, and I had this problem there to, but ...


0

This sounds like a routing issue and I suspect it is at the client. You firstly need to verify on the client that the packets with a destination of your server network(10.79.79.81 or whatever) are going through the VPN tunnel and not through your normal interface. Check your routing tables or use traceroute to verify. If this traffic isn't going through the ...


0

I finally solved my issue. Here is how I did it. In OpenVPN Access Server web admin settings, under Routing section of VPN Settings, I checked No for question "Should client Internet traffic be routed through the VPN ?" Then, I came back on the client side and flushed all previous rules added in mangle table. Then, came the magic ! I am now ...


0

server 192.168.57.0 255.255.255.0 tells your server that it has to operate on 192.168.57.0/24 subnet so it will never assign addresses from 192.168.58.0/24 subnet. You have to change netmask in server option to server 192.168.56.0 255.255.252.0 so it will span to 192.168.58.0/24 subnet. sipcalc 192.168.56.0 255.255.252.0 -[ipv4 : 192.168.56.0 255.255.252.0] ...


0

I struggled with this, too. In my setup, the OpenVPN server was a separate machine from the router, and no matter what config I did I could not get pings to travel correctly to other machines on the network. Eventually I found this thread: http://ubuntuforums.org/archive/index.php/t-951733.html Which makes it clear what is actually needed is a static ...


0

You can do this by adding the following directive to the client config file: redirect-gateway def1 And optional specify dns servers: dhcp-option DNS <IP> But if the router uses NAT, it has to be configured to also NAT the vpn subnet. This is a server side only configuration.


0

You can use the iptables quota match extension as shown with a good example in this answer to limit the traffic volume of a specific IP address.


0

You are missing this in your VirtualHost: SSLProxyEngine On


1

I'm a bit late to the party, but you can use the client-config-dir option to assign each client conf a local IP address. Then you can use Linux's Traffic Control (tc) to limit the bandwidth for each IP (and thus for each client). Would that work for you ?


0

Given the diagram I see is specifies that you are using a tun adapter, meaning a routed network, and not a layer 2 vpn network. You need to have IP forwarding working properly. Plus for your situation you will also need to do some NAT on the VPN server due to the security involved in the ssh protocol to ensure that traffic goes back and forth via the same ...


0

Use policy routing on the client side to do that. Policy routing Example policy routing http service (port 80) via internet: echo "1 inet" >> /etc/iproute2/rt_tables Add default route to inet routing table ip route add default via <router_ip> dev <if> table inet <if>: replace with the name of the interface, directly connected ...


2

The systemd service file for OpenVPN (/lib/systemd/system/openvpn@.service) must be updated with a After=network.target network-online.target entry: [Unit] Description=OpenVPN connection to %i PartOf=openvpn.service ReloadPropagatedFrom=openvpn.service Before=systemd-user-sessions.service After=network.target network-online.target # This is needed ...


0

A. Link the application and the network card. Here is an example: Firewall redirect based on source port. Define source ports for applications. Use a firewall rule to redirect outgoing traffic to the proper interface (eth0) based on source ports. Make sure that the interface (eth0) has a gateway, even if for your computer, tun0 is the default gateway at ...


0

Thanks for the above answer, but what worked for me is: iptables -t mangle -A OUTPUT -p tcp -m multiport --dports 80,443 -j MARK --set-mark 0x1 iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE sysctl -w net.ipv4.conf.tun0.rp_filter=2 ip rule add fwmark 0x1 lookup 201 ip route add default dev tun0 table 201


1

You can use the directive route-noexec and manually set up the routing with up and down scripts on this specific client. You should have all required information in environment variables, see section Environmental Variables in the manpage.


0

Yes, if you do not bridge the TAP adapter on the client host with any other interface, then the vpn network will only be accessible from that host you are running the vpn client on. An exception would be if the client is configured as a router and has routes defined to the vpn subnet.


0

In fact, it is a problem with permissions, but that has been fixed. I just updated to the latest version of OpenVPN for Windows (2.3.11 at time of writing) and now it works flawlessly. OpenVPN can be downloaded here.


1

They could only access services and files they owned through a service like FTP or SSH for example. If all you have is a vanilla server with just openvpn installed and those services are disabled then they have no way to access files on that server by normal means. However, OpenVPN does have an option that allows connected clients to work/connect together ...


0

First, one point: this has nothing to do with OpenVPN specifically. Solving your problem as stated is really no different than solving the same problem anywhere else. Things you'll need to do: Do not give your users administrative access to their machines. Configure your clients to use a proxy server that you run, and that has a restrictive access list of ...


0

You could have two different .opvn files in the client that you use depending on your situation. Then in one of these .opvpn files you could use the route-nopull directive and use custom alternative routes (example). It's not perfect, but it's the best I could come up with.


0

Use rule-based policy routing. Netfilter will add mark to packets: iptables -t mangle -A PREROUTING -p tcp -m multiport --dports 80,443 -j MARK --set-mark 0x1 then Linux should be told if it sees this mark it should use alternate routing table: ip rule add fwmark 0x1 lookup 201 and you need a route in that table: ip route add default via [your-...


2

Use "auth-user-pass credentials-file.txt" option in your client config file. The credentials file should be in the form: username password Yes, you will have the plaintext file with username and password.


0

In addition to what @quanta suggested: Use OpenVPN management interface and its "status" command. "man openvpn" will tell you how to set up and use this interface (search for "--management") OpenVPN in peer-to-peer (1.x), server (2.x) and client (2.x) mode produces different outputs, but it will let you see if it is connected. In server mode it will ...


0

You can use the directives client-connect <cmd> and client-disconnect <cmd>. An environment variable $common_name is passed to the script specified at <cmd> and can be evaluated to use specific tc settings on that particular client as follows: #!/bin/bash if [ "$common_name" == "client1" ]; then downrate=100mbit uprate=100mbit ...


0

Could it be that you should pass also "--config" option? eg. openvpn --config /etc/openvpn/vpn.conf --script-security 2 --ifconfig-noexec --route-noexec --up ./netnsvpn-up --route-up ./netnsvpn-up And netnsvpn-up something like: case $script_type in up) ip netns add vpntun0 ip netns exec vpntun0 ip link set dev lo ...


0

Here is a solution, how to do traffic shaping for data rate limiting of individual clients with tc (traffic control) using a script called by OpenVPN. The traffic control settings are handled in a script tc.sh with the following features: Called by OpenVPN using directives: up, down, client-connect and client-disconnect All settings are passed via ...



Top 50 recent answers are included