Tag Info

New answers tagged

0

Problem was caused by Windows OpenSSL, which can't work with sha256 algorithm. Solution, I found - edit config file /etc/openvpn/easy-rsa/openssl-1.0.0.cnf(or other, depending on OpenSSL version on your server), and set: default_md = md5 instead of default_md = sha245 Then - re-generate all you server and client's certificates and keys ...


0

OpenSSL 0.9.7 is WAY old and does not support SHA256, and therefore cannot verify your server's cert. You must either upgrade the client OpenSSL to at least 0.9.8 (which isn't binary compatible thus probably requires recompiling, or obtaining a different compilation of, OpenVPN), OR change to a server cert signed with SHA1-RSA. "SHA1 is bad": Browsers and ...


0

I figured it out. Before you edit connstore.dat to delete the GUID line, you must first to go into Services and stop Juniper Unified Network Service. Or in Task Manager, you can kill: dsAccessService.exe / Juniper Access Service The service will restart itself when you restart the Junos client.


0

We have lot of possibilities to create or extend a DC to cloud. firstly, we have EC2 services to host a new AD or extend your AD to cloud. Please refer to the AWS directory services. AWS Directory Service Now you could also launch a windows server with AD service configured over a VPN connection(you can use direct connect or linux server VPN) to the ...


0

To connect to the Azure VPN network using a Point-To-Site configuration, you need two things: Install a PFX certificate on the client computers connecting to Azure Create a VPN connection profile on your computers that will be used to connect to the Azure network, Azure is nice enough to provide and automated .exe file that you can send to you users so ...


8

How would this be setup connection wise without forcing all traffic through the domain controller? With site to site VPNs. You'd set up your cloud assets as a site, and then establish a site-to-site VPN between your cloud site and each of your physical sites. An alternate option, that Microsoft uses, but is generally ill-advised (unless you really, ...


0

Is all traffic from the remote office going through the VPN, e.g. is the vpn the default gateway? If not, then you might need to SNAT all the connections from the internet going to port 22 on the remote machine. Else the connections will return through your internet connection at the remote office. Another possibility is to do remote port forwarding via ...


1

What that's likely doing is checking the Host header that your web browser is sending to determine what domain to proxy to (and using wildcard DNS to make all the subdomains under their domain go to their server). That part's easy, but translating any resource requests to also use the proxied domain is a much trickier problem to solve. Something like ...


1

It would be pretty trivial to setup: Multiple wildcard A records (*.unblocksit.es, ..unblocksit.es, ..*.unblocksit.es, etc) - so any request goes back to their webserver. Apache config or PHP script that reads the requested URL, strips off the end, and proxies the content.


0

To come back to an old question I posted: The answer is... Get a new router! I wasted far too much time on this... It turns out that MANY off the shelf routers, just can't cope. Sonicwall and Juniper are just a few that failed. The problem is, you have to define your WAN and LAN, and IPSEC/VPN interfaces are attached to WAN, then, if there is a bit of ...


-2

client dev tun proto tcp remote 1.2.3.4 1194 resolv-retry infinite nobind persist-key persist-tun verb 1 keepalive 10 900 inactive 3600 comp-lzo <ca> -----BEGIN CERTIFICATE----- .................................... -----END CERTIFICATE----- </ca> <cert> -----BEGIN CERTIFICATE----- ........................... -----END CERTIFICATE----- ...


1

A client informed me, that connecting my device, caused another of his systems to lose connection with the network. Could the vpn cause this. Yes, that's possible. What you're describing can be caused by an address space collision - your VPN uses an address range that is also used on the other network, so when the VPN is connected, there is a range ...


0

The dedicated server has 250Mbps DL speed and 150Mbps UP speed My home internet has 100Mbps DL speed and 7Mbps UP speed So the link between the two is theoretically maxing at 10MiB/s. Well, your circuit at work and your circuit at home are only a small piece of the whole system. When you purchase a circuit that will provide X Mbps download or X Mbps ...


0

I finally sorted it. The client remote and local networks were set to 192.168.0.1 and 192.168.10.1, which is wrong. It should have been the networks (0.0 and 10.0). The client is using a Draytek Vigor 3200 Router for reference.


0

I notice that you have mentioned that you've successfully established a site-to-site VPN, but you haven't listed its interface in your post - basically you want to alter your default gateway to the VPN gateway interface on the Cisco in your configuration as above (not your WAN IP).


0

i have the same similar issue with you, Failed negotiation on phase 2, but the problem isn't on the phase 2 conf. i just change the Negotiation mode on phase 1 as Aggressive then IPSec working properly . hope this answer can fix your issue :)


0

Let's consider following scenario: your VPS has a single ethernet interface, configured with IP address 4.3.2.1/24; your VPS can access the Internet via a default-gateway 4.3.2.254 your VPS has not yet activated any OpenVPN connection; hence there are no tun interface active In such a scenario, from your machine (let's suppose your machine is 9.8.7.6/24 ...


0

This can help: put TCPKeepAlive=yes in your /etc/ssh/sshd_config From man sshd_config | less +/'^ *TCPKeepAlive' TCPKeepAlive Specifies whether the system should send TCP keepalive messages to the other side. If they are sent, death of the connection or crash of one of the machines will be properly noticed. However, this means that ...


0

To answer my own question; in the ipsec.conf on the server we had left=<server's subnet>. Changing this to left=0.0.0.0/0 got the forwarding working as expected.


0

Isn't phone-based auth an option? I prefer that because it's much less of a maintenance burden than certs. For example, to allow someone new to use VPN, you just fill his/her phone number in LDAP, then maybe add him/her to the VPN-enabled users group (if you do that kind of filtering at all), and that's it. Whereas with certs you have to generate a cert, ...


0

Stoney, your best bet is to work with the remote VPN host on this or hire a sysadmin consultant to help you out. The issue is likely that they aren't allowing multiple connections from your WAN IP to create a client VPN tunnel or they are limiting a certain number of connections, but they should be able to troubleshoot it on their end easy enough to be ...


1

OK, I've stumbled across the solution by removing the lines leftprotoport=17/1701 and rightprotoport=17/%any. Not sure why this worked buy hey ho! I can now ping from the server to the router and can ping devices hanging off the router. I've got another problem now but I'll post another question for that. Thanks all.


0

After testing this, it seems that your script should have more mandatory parameters - Add-VpnConnection won't accept just the parameters passed with just your enforced ($Client). When running the "minimal set", the return asks for further details. Add-VpnConnection -Name "Test Name" -AuthenticationMethod MSChapv2 -SplitTunneling -AllUserConnection cmdlet ...


0

Failed to get sainfo means that the racoon process cannot get the sainfo line from the racoon.conf config file that will match the incoming pair of IP addresses. In your particular case the following pair doesn't match (for obvious reason): Dec 2 08:41:03 racoon: DEBUG: cmpid source: '192.168.10.0/24' Dec 2 08:41:03 racoon: DEBUG: cmpid target: ...


0

You could spin up a micro instance and you could use it as udp proxy. sysctl -w net.ipv4.ip_forward=1 iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE iptables -t nat -A PREROUTING -i eth0 -p udp --dport 53 -j DNAT --to 10.10.0.2


1

Fortunatelly I'm already able to answer - I want to allow someone else to spare several hours and lot of headache. we have had configured everything correctly - NAT, ACL, CACL, routes etc. But we we have forgot for one crucial thing - this interface was new and IPSEC was not enabled on that interface. crypto ikev1 enable newiface was the solution for our ...


0

While not relevant to serverfault, the short version is yes. To pass port 88 back to your home server, you will need three rules at least: iptables -t nat -A PREROUTING -p tcp --dport 88 -j DNAT --to <internal VPN address> iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -o tun+ -p tcp --dport 88 -j ACCEPT ...


0

Turns out I was being blind. Edit the VPN connection -> IPv4 Settings -> Click "Routes", and finally check "Use this connection only for resources on its network".


0

IP subnet ranges need to be unique per interface. eth2 & eth3 should be on different subnets, for example 192.168.0.1/24 as the address on eth2, and 192.168.1.1/24 as the address on eth3. Broadcast address on eth3 should end in 255 for a /24 subnet. Verify ip_forward sysctl is enabled. this might help Verify appropriate iptables -L FORWARD rules are in ...


2

Best option is to actually utilize the VPN that AWS already includes in their VPC setup. Speaking from having already set up what you're trying to do. Assuming having your users connect to a central location, like an office or data center is an option. If it's not, then an expanded version of the setup below would work, adding another VPN instance for people ...


5

Reverse DNS points an IP to a domain name. An ISP/Hosting company should own the IP range, and it should be no problem at all for them to create a reverse DNS entry for your IP, unless it's not just your IP (you're on shared hosting). Should that be the case, you are not going to get anywhere. Your ISP/Hosting probably can get you your own individual IP, ...


0

Connect via DNS for the Java app, add an entry for the DNS under your win7 hosts for the java app, check connectivity from the VPN ip range over to the Java app ip if it doesn't work. Another method would be to have specificall routing for incoming traffic via the VPN and route it to that IP(but that would be an overkill if you are the only user.


0

Always make sure to disable the Source/Destination check on your Openswan instance. I see no mention of that being done.


0

Just add an identical route (as the one being pushed to you) to your OpenVPN config, e.g. route 192.168.1.0 netmask 255.255.255.0 net_gateway This will prevent OpenVPN from adding it's own route. Alternatively, use a lower metric value for your route. This way both routes will be created, but the local one will be preferred. P.S. Tested on ...


-1

(The IPSEC VPN client was neither available, nor of any use for their configuration) Our solution, in the hops of allowing other people to figure this out without banging their heads against the wall for 3 days: Install openswan ( https://www.openswan.org/ ) to an intermediary linux box. Having tried 5 different VPN software on Windows, openswan appears ...


1

compare your configurations with settings in this article and it may help you identify the problems.


0

Here is how I fixed the issue thanks to Xavier Lucas' comment. I changed the following line in my iptables: ## Allow VPN iptables -A UDP -p udp --dport 1194 -j ACCEPT



Top 50 recent answers are included