New answers tagged

0

I haven't configured radius, but I am authenticating IPSec against AD with pfsense. On the mobile client tab you can select multiple auth points. The list runs top down.


0

Summary: Everything is possible on any system if you configure it correctly. The default route will depend on the VPN connection's setup. On common configurations, the VPN is used by default. If you were doing it on Windows, it would simply follow the last connected becomes the default route rule but this is not as obvious on Linux as the initial setup ...


1

There are a variety of solutions for this. OpenVPN will work, but my preferred solution is to set up an L2TP over IPSEC VPN, using an OpenSwan VPN server inside your AWS VPC. IMHO, IPSEC VPNs are a better option that SSL/TLS based VPNs (eg OpenVPN), given all the issues with SSL over the last few years. This allows you to create a local VPN connection on ...


0

You can also download an ssl vpn client for Linux from their support site if you have a valid support contract, it may be easier. I have been using it for a few years with differerent versions with no problems. https://support.fortinet.com/Download/FirmwareImages.aspx / FortiGate/ v5.00/ 5.2/ 5.2.7/ VPN/ SSLVPNTools/


1

Use ip command, from iproute2 tools. To access 10.20.1.0/24 vpn network ip route add 10.20.1.0/24 dev ppp0


1

You can login on the Linux server and use tcpdump in order to capture all traffic from/to relevant server. You can then use your captured dump in Wireshark for further analysis. tcpdump -i <youInterface> -w dump.cap Where: -i : Interface to capture traffic from. -w : Write captured traffic to file On "yourInterface" you might want to add your ...


0

You can also tie the CN (that houses the user login name) of the user cert to a login that you can administer, for example, with FreeRADIUS. I wrote a small integration script couple of years ago. This way you can simply block user access by removing them from FreeRADIUS user list. The idea is that the certificate will protect the VPN from anyone else, and ...


1

Amazon VPC peering connections don't allow for transitive connections across VPC networks. You would have to create a tunnel/vpngw for each and every VPC. http://docs.aws.amazon.com/AmazonVPC/latest/PeeringGuide/invalid-peering-configurations.html I currently have the same issue with 7 VPCs across three different consolidated billing accounts and can't ...


0

I've made a script that takes care of it. Linux vpnc - How to define a specific tunX number in vpnc Maybe you want to try it with the necessary adaptations like: #!/bin/bash # Run script as # nohup ./vpn-monitor.sh /dev/null 2>&1 & vpn_clientA(){ vpnName="clientA" endpoint="10.10.10.10" # endpoint1 inside tunnel endpoint2="10.20.30.40" # ...


0

Just in case someone comes across the same issue, here's the solution I've made. #!/bin/bash # Run script as # nohup ./vpn-monitor.sh /dev/null 2>&1 & # mjoao ################### Start functions ################### vpn_clientA(){ vpnName="clientA" endpoint="10.23.23.51" endpoint2="10.23.25.55" count=$( ping -c 3 $endpoint | grep icmp* | wc -l ...


0

I solved the problem for me by re-configuring the DNS settings to use Google DNS servers before the ones provided by FortiClient. Unfortunately, this has to be done after each re-connect. #!/bin/bash scutil <<EOF d.init d.add ServerAddresses 8.8.8.8 8.8.4.4 <IP ADDRESSES FOR DNS FROM FORTICLIENT> set State:/Network/Service/forticlientsslvpn/DNS ...


1

This is clearly possible and even at this very moment I'm connected using such setup. My VPN server is in Germany and exit node in US. I cannot test the setup below right now (mine is done a little different way, so it's not enough to copy/paste), but it should theoretically be enough. Your task can simply be achieved by pushing default routes to "all minus ...


0

Author of the IPsec VPN script here. In order to resolve the issue, please make the following changes: In /etc/ipsec.conf, remove this line: rightsubnet=192.168.1.0/24 And un-comment this line: #rightsubnetwithin=0.0.0.0/0 In /etc/xl2tpd/xl2tpd.conf, replace this line: local ip = 192.168.1.93 with the following: local ip = 192.168.42.1 Now ...


0

I had a similar issue... What I had to do was tell the connection to not use the remote gateway to connect through internet. On the XP machine (works on Vista and 7 also) go to the properties of the VPN connection. Click on the Networking tab and double click Internet Protocol Version 4 (TCP/IPv4). Click Advanced and uncheck the box for "Use default gateway ...


0

Often you need to specify a domain with username. i.e. DOMAIN\password What type of VPN service are you connecting to? Failing that, comment out\remove require-mppe-128 and try again. If neither of those help individually or together, enable debug logging and post the output i.e. run with logfd 2 (see below) ...


0

Okay, got it sorted. There was a check box on the PAN config that said "append local IP range to ICMP requests". Disabled that and the pings work. Evidently, when the RETURN messages were coming into the PAN, they were having the AWS subnet address stripped off of them, replaced with the LOCAL subnet address, and then black-holed because the rules didn't ...


1

Even though the Cisco Client has its own virtual adapter showing in Network Connections, it is still utilizing the physical adapter to tunnel through. The physical adapter is controlled by Microsoft's somewhat less than brilliant Network Location Awareness Service. This service disregards any Windows Firewall or third party firewall rules, and allows no ...


1

Old question but for anyone trying to find an answer there is a better solution via elevated powershell: Add-VpnConnection -Name MY_VPN_NAME -ServerAddress MY_VPN_SERVER -AllUserConnection $true -SplitTunneling $true -AuthenticationMethod MSChapv2 -TunnelType Automatic -EncryptionLevel Required -PassThru Source


0

Basically, Windows does not know about the VPNs IP address at all. The Cisco VPN client does some magic with how the packets are routed, but there is no separate network interface for that tunnel. So to Windows it seems like all traffic comes from its only interface with that public IP, regardless of VPN on or off. Potential solutions: have a hardware ...


2

What you're looking for is the Routing and Remote Access role in Windows Server. You'll want to configure a site-to-site VPN utilizing your servers at each site as a router/VPN gateway. Of course, there are many security considerations to take into account when doing this, and I wouldn't run any other roles or services on a box being used for RRAS, but ...


0

The next-hop usually means you need to add the destination IP address, netmask and gateway into your routing table. There is a default gateway in your routing table, all of the traffic will go through the default gateway, if you need some traffic to use other gateway, you need to use "next-hop". e.g. on your DC side: route add -net 10.116.0.0/16 gw ...


0

Make sure you have appropriate rules in your DC firewall to allow all traffic from 10.16.x.x subnet to enter into your network.


0

OpenVPN has no such functionality you're looking for, but please take a look at pfsense: You could analyze PHP code in pfsense and create something similar using RRDtool like they did.


0

As far as I know, the difference would be: Price, Azure VPN would be cheaper for you on the long run compared to running your own VPN setup inside a VM. SLA, 99.9 for VPN, while for VM they won't support the configuration inside it. And Internet access is enabled by default once you create a Vnet or a VM.


1

You can use mod_proxy to proxy pass requests to any service then the response from that service will go through apache and back to the client https://httpd.apache.org/docs/current/mod/mod_proxy.html Your VPN server would have to talk http since that is the protocol that it would get getting from apache


0

You need, at least, this 2 routes: DEFAULT via dev PPP_DEVICE VPN_SERVER via LOCAL_NETWORK_GATEWAY You can have this two routes with this commands: ip route add VPN_SERVER via LOCAL_NETWORK_GATEWAY ip route add default via PPP_DEVICE(ex: ppp0) Probably you will need to remove the local default gateway route: ip route del default via ...


1

The IKE daemon used by the NetworkManager plugin (charon-nm) is different than the regular IKE daemon (charon) that you interact with via the ipsec script. Therefore, you won't be able to see the status of connections established via NetworkManager plugin in ipsec statusall as that will only show you connections and SAs managed by the regular daemon, which ...


0

Changing /etc/ppp/pptpd-options to the following options worked for me: refuse-pap refuse-chap refuse-mschap #require-chap #require-mschap #require-mschap-v2 #require-mppe-128 mppe-stateful


2

I think the best way to do this, is to generate certificates (based on PKI solution). Then you can have a server certificate for each server and a client certificate also for each client. The easiest in that case is to use PKCS12 format which embed the complete chain, with CA, sub-ca and private key. Then to manage revocation, you can use a an OCSP ...



Top 50 recent answers are included