Tag Info

New answers tagged

1

Without receiver (Fortigate) logs it is difficult to give a definite answer. Let's begin with the obvious: reconfigure your VPN in main mode (not aggressive mode) and change type from transport to tunnel. Re-try connection and, if possible, give us the Fortigate logs.


1

I'd use OpenVPN. Either put the VPS on the same OpenVPN instance you're using for remote access, or create a new OpenVPN server instance for VPSes. I do the latter to connect a slew of cheap test VPSes around the world back into my home network. The client export config archive option makes it easy to configure the VPS side.


3

After a lot of Googling and configuration file tweaks, I found the solution. I'm now getting sustained speeds of 60Mbps and burst up to 80Mbps. It's a bit slower than the transfer rates I receive outside the VPN, but I think this is as good as it'll get. The first step was to set sndbuf 0 and rcvbuf 0 in the OpenVPN configuration for both the server and the ...


0

According to the Config's you are using TCP as transport for the Tunnel. Consider using UDP instead of TCP since the stacked TCP connections tent to create problems in packet loss situations. As reference see Why TCP Over TCP Is A Bad Idea


0

Solved this one, there was an errant POSTROUTING MASQUERADE rule in the iptables unrelated to the OpenVPN installation. I removed the rule with: iptables -t nat -D POSTROUTING 1 Where 1 is the rule number retrieved from service iptables status.


0

The significance is that in order for you to be able to connect to the VPN tunnel you should have a rule that handles the traffic needed to create the VPN tunnel through your WAN-connected interface and all of you other traffic towards the VPN interface where it will be encrypted and then sent to the other side of the VPN. Without having an internal IP given ...


0

After further discussion, the situation is that server A in site A makes a VPN connection to Server B in Site B allowing server A to access Site B's resources. Server B does the reverse.The VPNs are established using RRAS The correct solution here would be to configure RRAS to use LAN and demand dial routing, and then set up a Demand Dial interface on each ...


0

First of all, I have to say that I don't know SoftEther at all. But I will post you some general hints to think about. 1.) You should not add manual routes with a default gateway of "0.0.0.0". This will lead to nothing. Try it with: route add 0.0.0.0 mask 0.0.0.0 192.168.0.1 metric 2 if 22 Where 192.168.0.1 is the internal IP of your SoftEther VPN ...


1

I'm not sure whether it completely fulfils your needs, but you should probably take a look at tinc: http://www.tinc-vpn.org/. It quite closely matches the mesh network orchestrated by a central server as you described, but I'm not sure whether it will succeed in discovering peers in your local network.


3

Actually it's not colliding. One subnet has more specific mask 192.168.0.0/24 has more specific mask than 192.168.0.0/16 For example default gateway is default because it has less specific mask /0. If you add a route to 192.168.0.3/32 via another interface it would have more specific mask than other two routes.


0

I also experienced some issues connecting to my Raspberry Pi while connected to open hot spot (in my case it was Optimum WiFi) (SSH into my Raspberry Pi 2@Optimum WiFi - Raspberry Pi Stack Exchange). So, I'd like to share my way of getting into my Raspberry Pi 2 using this ssh reverse tunnel: pi@raspberrypi ~ $ crontab -l | tail -1 @hourly ssh -S ...


0

Nikita, you actually have a couple of options. I have setup RPs this way on dedicated power but with only a mifi card on a board. The simplest solution is to contact your ISP and request a public or static NAT IP address. Most wireless providers will do this but they may charge you for it. Verizon has a $500 charge per account but then you can setup as ...


1

Using username/password authentication disables any Common Name use by OpenVPN. So it doesn't set the client Common name when logging in. The solution is to set the following flag in the server.conf file and restart the OpenVPN server: username-as-common-name This tells OpenVPN to set the username to the client's Common Name when connecting. Since the ...


2

First, do you have a client-connect script in place? If so, any IP directives from that take precedence. Secondly, according to the OpenVPN documentation, the client-config-dir only uses the client's X.509 common name to determine which file to use. You can validate if the joel file is not matching by creating a DEFAULT file. It appears that you are not ...


1

redirect-gateway is meant to tell the client to send all traffic through to the server. It redirects your default gateway through the VPN. If you want to disable it for one client, you can put the following in the client config to override redirect-gateway: route 0.0.0.0 192.0.0.0 net_gateway route 64.0.0.0 192.0.0.0 net_gateway route 128.0.0.0 192.0.0.0 ...


0

There are several ways this could work. The most likely, for the remote buildings, is an MPLS-based L3VPN (if each building has different parts of the 172.x.x.y range) or VPLS (if they don't) setup -- the CPE for these is usually a switch (Cisco 3550, 3750 Metro, ME3400 are typical.) Next possibility would be a leased-wavelength service, with plain ...


0

I don't know the finer points of how this kind of thing works, but ISPs can offer this kind of infrastructure which connects remote sites directly so that they're effectively on an enormous LAN. It's not a VPN, and it's not technically going through the internet. It's just a really big LAN connection that's being managed by the ISP. My company does this, ...


1

Three possibilities: Your VPC route table for the subnet is missing an entry pointing 0.0.0.0/0 to the IGW Your instance was launched into the default or wrong security group that is missing the incoming ssh rule You have a NACL on the subnet that is blocking the traffic


0

Have you tried Dome9? http://dome9.com They provide on-demand access from your local IP address, or you can send a invitation to a remote employee. Dome9’s Secure Access Lease Invitations use patent-pending security automation to invite only those you authorize to securely access your cloud servers. Instead of relying solely on usernames and ...


1

You're website's security is partially dependent on your office's network security. You're talking about adding a means of making a remote connection into your office's network. Adding the VPN will provide a new attack vector (hacking the VPN logon or VPN device) so you'll be weakening your existing security. That said, what you're proposing is a fairly ...


0

Solved this by creating a static route in the router like this: 192.168.2.0 MASK 255.255.255.0 192.168.1.2


1

Nope. There are no settings for creating metrics and traffic priorities, you're also stuck with Dynamic Routing so all the prioritizing is done in the background. This means that you cannot connect different endpoint to the same range of a local network. it is even stated in "Requirements and considerations" page under the Vnet VPN Documentation. ...


0

SOLVED! ANSWER: DO NOT OVERWORK entire week long 16-18hours a day until 4:30am and expect your brain to not be FRIED! IT WAS A STUPID WINDOWS FIREWALL ISSUE!!! YES, I "THOUGHT" I had disabled it but apparently I was too sleepy to have noticed I only disabled domain and maybe outgoing but not incoming firewall! OK, I'm going to try and get some sunlight ...


0

Basically, a VPN-connected client appear as a "normal" network node, so it should be pingable/reacheable. That said, it really depends on the IPSec policies installed during client/server negotiation. If client/server negotiate a bi-directional policy (and no NAT is applied), the client will be visible. For example, I had similar configs both with a ...


0

SOLVED! ANSWER: DO NOT OVERWORK entire week long 16-18hours a day until 4:30am and expect your brain to not be FRIED! IT WAS A STUPID WINDOWS FIREWALL ISSUE!!! YES, I "THOUGHT" I had disabled it but apparently I was too sleepy to have noticed I only disabled domain and maybe outgoing but not incoming firewall! OK, I'm going to try and get some sunlight ...


1

As far as I understand the background of your question, you have 3 options to accomplish what you want: Use a IPMI - Card that supports some kind of VPN. For example, some of the DELL RAC Cards support openVPN or pptp (which is not good, anyway) Use a IPMI - Card with public IP (unsecure and dangerous!) Use a IPMI - Card and connect it directly to some ...


1

Your company restriction excluding terminating a VPN on a dedicated device is not necessarily our problem. Other comments and answers have given you the best practice and standard approaches to this solution. It sounds like you have a political issue and aren't given the tools necessary to do your job. Are you sure you've made the right case and ...


1

If I understand this correctly, you want to access the OOB Management interface on a server from a remote location - is that correct? I do this at a lot of clients sites, and I generally setup a VPN to their network router and then connect to the OOB management via that VPN (either production or management VLAN dependent on their setup). If the server OS is ...


0

Yes. Windows Server 2008 R2 and newer has a technology that specifically works this way. It's called Direct Access. It's easier to setup in most network architectures under Server 2012. The client must be Windows 7 Enterprise or Ultimate, or Windows 8 Enterprise. It uses IPSec and HTTPS; it works based on the machine containing a cert from your domain, and ...


0

As an alternative, can you make the OpenVPN server public? Eliminate the dual VPNs, and just have people connect directly to the lab.


2

ysdx's answer is great, and describes very well how the traffic will look on the wire. Left unmentioned, however, is that traffic analysis can go a long way toward identifying applications. Let's assume that your OpenVPN connection looks just like an https connection on the wire, so an attacker cannot read the byte stream and know what kind of ...


5

OpenVPN over TLS Your VPN is using TCP as a transport protocol. The stunnel instance is used to encapsulate the content of the TCP stream in TLS/TCP. You get this protocol stack: [IP ]<------------------------>[IP ] [OpenVPN]<------------------------>[OpenVPN] [TLS ]<~~~~~>[TLS] [TCP ]<->[TCP ...


0

You would only need to allow SSL (port 443). Because your VNC traffic is going to get piggybacked by SSL. From the IPS/Router's stance, VNC traffic is going to look like SSL.


0

I have experienced a similar situation when the office was using Cisco Virtual Office(CVO). R&D dept had its own ASA/FW to host a lab subnet. We solved the problem by using hardware vpn. Issue an ASA or router to build site-to-site or DMVPN with the HQ router. Then the hosts connecting behind the hardware VPN only has to use OpenVPN(in your case) to ...


0

This is the kind of situation that Read-Only Domain Controllers are intended for. Since it's read-only, you would have to depend on your site-local DC to join the domain, but after that the RODC could handle logins for your colo servers. It would also handle read-only DNS, even when the tunnel goes down. This feature requires Server 2008 or higher, with ...


-1

I had this same question years ago and attempted to explain it in straightforward terms (which I personally found lacking in other resources) on my blog: An OpenVPN Primer Hope it helps someone


0

I do not recommend to join your productive web servers located in the data center to your site-local Active Directory Domain! If the link is down or the connection to your office is bad, you risk losing access to those servers! You could configure DNS forwarding on your data center’s DNS server for your site-local Active Directory domain. For example, ...


0

I turns out, I had made a mistake and there was a post-routing issue on the client gateway, hence why traffic was only being permitted in one direction. StrongSwan and AWS were configured correctly.



Top 50 recent answers are included