77
votes
Accepted
OpenVPN client-to-client
If client-to-client is enabled, the VPN server forwards client-to-client packets internally without sending them to the IP layer of the host (i.e. to the kernel). The host networking stack does not ...
- 1,643
33
votes
openconnect cannot connect to Anyconnect VPN group using -g
Try --authgroup instead of -g
openconnect -v --authgroup CLUSTER-DLCE -u anaphory vpn-gw1.somewhere.net
Regards
- 431
31
votes
Auto Reconnect VPN on Disconnection due to any reason - Persistent VPN
I sort it out using "Task Scheduler"
Here are steps to do it
Make VPN Connection and give it Some Name Let say "My VPN"
Open "Task Scheduler" from Start Menu and click "Create Task" (Option can be ...
- 631
29
votes
Connect to a Fortinet VPN with Ubuntu
If you use SSL based VPN from Fortinet, you can use openfortivpn software which is part of Ubuntu and Fedora.
$ sudo apt install -y openfortivpn || yum install -y openfortivpn
$ touch openfortivpn....
- 17k
28
votes
Connecting to a remote server through a VPN when the local network subnet address conflicts with a remote network
If you need a temporary dirty workaround to a single or a handful known server ips, the simplest solution should be the static client side routing option.
In my case I added my desired destination ...
- 381
28
votes
Accepted
Very low TCP OpenVPN throughput (100Mbit port, low CPU utilization)
After a lot of Googling and configuration file tweaks, I found the solution. I'm now getting sustained speeds of 60Mbps and burst up to 80Mbps. It's a bit slower than the transfer rates I receive ...
- 1,336
25
votes
Accepted
stunnel vpn traffic and ensure it looks like SSL traffic on port 443
OpenVPN over TLS
Your VPN is using TCP as a transport protocol. The stunnel instance is used to encapsulate the content of the TCP stream in TLS/TCP. You get this protocol stack:
[IP ]<--------...
- 1,643
24
votes
Accepted
IPsec for Linux - strongSwan vs Openswan vs Libreswan vs other(?)
It appears to me that StrongSwan and LibreSwan are the two main viable products now-a-days. strongswan vs openswan has one good comprehensive comment with some comparisons between StrongSwan and ...
22
votes
Can I automatically ROUTE ADD xxxx after i make a VPN connection in Windows 7?
If you have multiple VPNs you might run into the issue that when they connect in random order, their interface IDs change. In that case the normal ROUTE -P ADD 10.0.0.0 MASK 255.255.0.0 10.0.0.1 IF 42 ...
- 369
22
votes
Allow OpenVPN client to push it's own DNS servers, regardless of OpenVPN server's pushed dns?
As of 2017 (OpenVPN 2.4) this is now possible. Add this line to your client config file:
pull-filter ignore "dhcp-option DNS"
and it will ignore all pushed config lines that start with the quoted ...
- 2,319
21
votes
Accepted
Connect to OpenVPN using Windows 10 built-in VPN
VPNs do have multiple protocols and for different protocols, different type of configurations are needed.
Here are the top 5 VPN protocols are explained:
https://www.makeuseof.com/tag/major-vpn-...
- 326
20
votes
Accepted
What is the difference between AWS site-to-site VPN and AWS client VPN?
In general the protocol doesn't have much to do with it. You can have IPSec tunnels in both site-to-site or client (aka road warrior) configurations, just like you can have OpenVPN (TLS) tunnels in ...
- 24.3k
18
votes
Should I use tap or tun for openvpn?
Because I find simple advice hard to come by:
You can use TUN if you just use the VPN to connect to the internet.
You need to use TAP if you want to connect to the actual remote network (printers, ...
- 427
17
votes
Connected to openvpn, but no Internet connection
I checked your logs and haven't find any problems. But you said that there is No firewall on the server. It could cause problems, because you should enable forwarding for working NAT. Here is output ...
- 4,558
16
votes
How to connect to a Juniper VPN from Linux
The OpenConnect VPN client has (nascent) support for Juniper SSL VPN.
See the announcement at http://lists.infradead.org/pipermail/openconnect-devel/2015-January/002628.html
Edit 2015-02-02:
The ...
- 161
16
votes
Accepted
MULTI: bad source address from client - any one-off solutions?
You asked: "Can someone explain why this problem occurs in the first place?"
Based on what is reported in the official OpenVPN FAQ I bet it's caused by a routing problem within the OpenVPN engine.
...
- 3,998
16
votes
Accepted
Strongswan IKEv2 vpn on Windows 10 client "policy match error"
The problem is most likely that the Windows client proposes a weak Diffie-Hellman (DH) group (1024-bit MODP). That group is not used anymore by strongSwan unless the user configures it explicitly.
...
- 3,870
15
votes
Improving OpenVPN Performance
Short answer: disable comp-lzo.
I realize this is an old post, but I was also suffering from poor OpenVPN performance. I had tried everything, adjusting the MTU, changing the snd and rcv buffers, mss ...
- 151
14
votes
Accepted
Can I add a static route to a VPN network if the default gateway IP is dynamic? (Windows 7)
I've found out the answer myself:
You don't actually need to specify the default gateway - you can use the catch-all of 0.0.0.0 and then specify the interface number instead (the docs do not make this ...
- 654
14
votes
Accepted
Correct Network IP addressing if your users have ability to VPN in
Techspot has A List of Common Default Router IP Addresses that helps with this. Usually home routers uses /24 subnets. Nowadays mobile phones are often used for sharing network connection, so we must ...
- 44.8k
14
votes
openVPN Could not determine IPv4/IPv6 protocol. Using AF_INET
This message is printed when no IPv4/v6 preference is given in the config (i.e. proto udp/tcp is used) and OpenVPN is running as a server.
Just change in server.conf on what you need udp4/upd6:
;...
- 251
14
votes
VPN instead of VLANs
There is frequent employee turnover, which currently forces changes in the configuration of vlans on the switch ports.
As it seems, you might be using port-based VLANs instead of privilege groups. ...
- 9,232
12
votes
How can I stop openconnect from changing /etc/resolv.conf?
Create the following script /etc/vpnc/no_resolverupdate.sh
#!/bin/sh
#
#
export INTERNAL_IP4_DNS=
. /usr/share/vpnc-scripts/vpnc-script
Make it executable:
chmod +x /etc/vpnc/no_resolverupdate.sh
...
- 121
12
votes
Accepted
Limit/Throttle per user OpenVPN bandwidth using TC
I once did something like this for individually firewalling each user's connection. I have implemented it using the learn-address script in OpenVPN which is called when a user connects or disconnects. ...
- 5,933
12
votes
How to Bond Two (Multiple) Internet Connections for Increased Speed and Failover
This solution applies Linux Ethernet Bonding to two independent OpenVPN connections from a local gateway server to a server in the cloud that you have root access to, like a Linode or a DigitalOcean ...
- 346
11
votes
Accepted
How to get forticlient working in OSX El Capitan
Edited Answer
(Re)improved on just about everybody else's improved answer (@elmart, @user26312,myself). Edits should not be needed in the script:
#!/bin/bash
default_line=$(netstat -rn |grep default)...
- 411
10
votes
How to ping OpenVpn server to see if it's up?
If you want to know that the host is alive you can just ping its IP or hostname. Make sure the firewall is open for incoming ICMP echo packets from wherever you try to ping it.
However if you want to ...
- 24.3k
10
votes
Accepted
How to configure StrongSwan IKEv2 VPN with PSK (pre-shared key)?
Assuming that you want to setup your right side with psk.
This is fairly easy.
1. remove eap_identity and rightsendcert fields.
2. set rightauth=secret
Now edit /etc/ipsec.secrets file:
1. remove ...
- 271
10
votes
Disable global routing with OpenVPN
If you control the server then you can push specific routes by adding directives to your config file e.g.
push "route X.X.Y.Z 255.255.255.255"
push "route 192.0.2.0 255.255.255.0"
You will likely ...
- 115k
9
votes
Setting up a proxy server that uses a vpn connection
Six year later I came to this question and almost let it down based on the accepted answer. As of today, it is not complicated, using policy routing. All the details are available on this same site, ...
- 91
Only top scored, non community-wiki answers of a minimum length are eligible