Hot answers tagged

41

You can use netcat - just start it, and type something inside, and pres the return key. nc -u <host> <port> And on the other side you can listen with netcat too (you should see the written text), or just start a tcpdump, and see packets coming in.


40

If client-to-client is enabled, the VPN server forwards client-to-client packets internally without sending them to the IP layer of the host (i.e. to the kernel). The host networking stack does not see those packets at all. .-------------------. | IP Layer | '-------------------' .-------------------. ...


33

OK, this question is asked over and over again over the Internet and most of the time there is a (semi-) incorrect answer that you cannot do what was described in the original post. Let me clarify it once and for all :) The short answer is L2TP (and PPTP for that matter) do not have facilities to do route pushes inside the protocol, but it can be achieved ...


31

There is one theoretical way of determining the DNS resolver of your clients, but it's quite advanced and I don't know any off-the-shelf software that will do that for you. You'll for sure have to run a authoritative DNS server for that in addition to your nginx. In case the HTTP Host header is incorrect, serve an error-document and include a request to a ...


25

My word, you do have your work cut out. OK; here's a sort of outline primer, because at the moment you've got the fundamentals so wrong that the details don't matter. Before anything else, the fact that you haven't got static public addresses for each of your internet connections is a problem. IPSec doesn't easily support tunnels in such configurations [1]...


24

After a lot of Googling and configuration file tweaks, I found the solution. I'm now getting sustained speeds of 60Mbps and burst up to 80Mbps. It's a bit slower than the transfer rates I receive outside the VPN, but I think this is as good as it'll get. The first step was to set sndbuf 0 and rcvbuf 0 in the OpenVPN configuration for both the server and the ...


22

OpenVPN over TLS Your VPN is using TCP as a transport protocol. The stunnel instance is used to encapsulate the content of the TCP stream in TLS/TCP. You get this protocol stack: [IP ]<------------------------>[IP ] [OpenVPN]<------------------------>[OpenVPN] [TLS ]<~~~~~>[TLS] [TCP ]<->[TCP ]<----->[TCP]<->[...


21

And my favorite method (no java applet required): Presumably: your url: 'https://some.site.com/dana-na/auth/url_default/welcome.cgi' (or whatever) your username=username your password=password you know your realm or you can find it from the web page or with: - REALM=$(wget -q --no-check-certificate -O - 'https://some.site.com/dana-na/auth/url_default/...


19

No. There are multiple subnets set aside for private networks: 10.0.0.0 – 10.255.255.255 172.16.0.0 – 172.31.255.255 192.168.0.0 – 192.168.255.255 See RFC1918 for full details. People are free to choose whichever ones they want from that list. But there's no way to tell if the network is a VPN or not unless you actually know the network. By their very ...


18

It is possible to solve this using NAT; it's just not very elegant. So under the assumption you couldn't solve this by having internal nets which have so uncommon network numbers as to never actually come into conflict, here's the principle: As both the local and remote subnet have identical network numbers, traffic from your client will never realize it ...


17

It appears to me that StrongSwan and LibreSwan are the two main viable products now-a-days. strongswan vs openswan has one good comprehensive comment with some comparisons between StrongSwan and LibreSwan. StrongSwan seems to win the argument in that link. But to be fair, I saw Paul Wouters, who represents the LibreSwan project at RedHat, talking today ...


15

If you have multiple VPNs you might run into the issue that when they connect in random order, their interface IDs change. In that case the normal ROUTE -P ADD 10.0.0.0 MASK 255.255.0.0 10.0.0.1 IF 42 does not work. The next time the VPN connects it might have a different interface number. Powershell has a cmdlet available that adds routes on VPN connection ...


15

If you need a temporary dirty workaround to a single or a handful known server ips, the simplest solution should be the static client side routing option. In my case I added my desired destination server (192.168.1.100) to my routing table on my linux client via: route add 192.168.1.100 dev tun0 Afterwards, remove this static route with the route delete ...


14

The OpenConnect VPN client has (nascent) support for Juniper SSL VPN. See the announcement at http://lists.infradead.org/pipermail/openconnect-devel/2015-January/002628.html Edit 2015-02-02: The Juniper support is coming along nicely now and is definitely ready for more testing. It's reached the point where we're happy to admit to its existence on the ...


14

There are 2 options. First, you could modify your routes so that the SSH packets naturally go through the correct interface. Or you could use the -b SSH option (or in a similar way the -B one): -b bind_address Use bind_address on the local machine as the source address of the connection. Only useful on systems with more than ...


14

Make sure that the ip forwarding is acutally enabled echo 1 > /proc/sys/net/ipv4/ip_forward Also, in order for route push to work, the servers on the inside also needs to know the route to your OpenVPN client IP address. So they will need to know the route to 192.168.2.0/24 You can most likely make iptables do the routing via masquerade using /sbin/...


14

Simply add a route for that IP to your local gateway. You can do this in your openvpn client config like this. route 10.99.77.55 255.255.255.255 net_gateway In the config net_gateway is automatically replaced with the correct address.


14

What you don't want is a VPN. What you do want is indeed IPsec, but not in tunnel mode. Rather, you want IPsec in transport mode. In this configuration, each host communicates directly to its peer, and only packet payloads are encrypted, leaving IP headers in place. This way, you don't need to do any routing gymnastics to get things working. Yes, you'll ...


14

These are academic distinctions. In the real world, you will find some combination of all of these concepts going by different terms. In some organizations, a DMZ has a separate ISP network connection and has no access to internal resources. In other organizations, there are domain-joined machines in the DMZ that can communicate to a restricted set of ...


14

Let's suppose your AWS is reachable via SSH at IP "your.ec2.ip.address". Let's suppose your office network has Internet access via a router that apply some NAT translations and, as such, your office PCs are seen, on the Internet, with IP "your.office.external.ip". Let's also suppose that you are located OUTSIDE of your office, with your laptop connected ...


14

Try --authgroup instead of -g openconnect -v --authgroup CLUSTER-DLCE -u anaphory vpn-gw1.somewhere.net Regards


13

I'm using SNX (by checkpoint) and it works perfect. It can be downloaded from here. I used this guide in order to install snx on my client, check it out and see if you got all the required packages installed. In addition, you can create a .snxrc file in your /home/user/ directory and include there the server's IP and username like so: server 1.1....


13

To resolve this issue you will need to set up both iptables and routing rules. The specific problem you're encountering is that outgoing SSH packets are being routed via your anonymous VPN tunnel interface instead of your Ethernet interface. This is happening because your VPN software set up a routing rule to send any and all unhandled traffic via the ...


13

As of 2017 this is now possible. Add this line to your client config file: pull-filter ignore "dhcp-option DNS" and it will ignore all pushed config lines that start with the quoted text. Options are matched top-down, so the first match is used. You can use this to allow some routes and reject others, if it suits your needs. The three action keywords are ...


13

Techspot has A List of Common Default Router IP Addresses that helps with this. Usually home routers uses /24 subnets. Nowadays mobile phones are often used for sharing network connection, so we must take these ranges into account, too. According to the list we can deduce we should avoid: 192.168.0.0/19 - most of the routers seems to use some of these, ...


13

I sort it out using "Task Scheduler" Here are steps to do it Make VPN Connection and give it Some Name Let say "My VPN" Open "Task Scheduler" from Start Menu and click "Create Task" (Option can be found on right side of Task Scheduler) POPUP will appear asking for Task Information. Fill in information like below After that go to Trigger Tab and Select "...


12

NOTE: FlushIpNetTable failed on interface [22] {88C21B16-3D85-4B9C-A65F-10F89A2DEACB} (status=5) : Access is denied. C:\WINDOWS\system32\route.exe ADD 208.111.39.186 MASK 255.255.255.255 192.168.11.1 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=11] Route addition via IPAPI failed [adaptive] Route addition ...


12

OK, found a great resource here: http://rdpfiles.com/2011/08/25/windows-vpn-client-and-local-dns-resolution/ It's not perfect, but just might work. The binding order is stored in the registry in the following location: HKLM\System\CurrentControlSet\Services\Tcpip\Linkage\Bind. The list includes all the device GUIDs for network adapters and active ...


12

Short answer: disable comp-lzo. I realize this is an old post, but I was also suffering from poor OpenVPN performance. I had tried everything, adjusting the MTU, changing the snd and rcv buffers, mss clamping, you name it. CPU load was negligible. On a whim, I disabled compression (removed comp-lzo from the client and the server) and performance increased ...


12

You asked: "Can someone explain why this problem occurs in the first place?" Based on what is reported in the official OpenVPN FAQ I bet it's caused by a routing problem within the OpenVPN engine. To better clarify the scenario, let me refer to following diagram: Here you can see: an OpenVPN "server" connected to the HEADQUARTER internal network (10.0.1....


Only top voted, non community-wiki answers of a minimum length are eligible