Hot answers tagged

6

You say "I want to provide remote work solution to devs on my team" but it seems that network-management is NOT under your direct control, as well as you are UNABLE to directly expose "your" services to the Internet (in other words: you cannot have YOUR VM directly exposed on the Internet). From the other side, your personal-computers/workstations DO have ...


5

Performance Monitor (perfmon.exe) is great for monitoring in windows. Run perfmon.exe and click the plus button to add the counters that you want to monitor. Depending on your VPN, you probably want the IPsec counters. Add everything that says IPsec in the name, then watch the live graph to determine the interesting counters for your setup. From there you ...


5

The equipment listening on the public IPs of the tunnel endpoints is listening for traffic specifically from your customer gateway's assigned IP address with your VPN connection's keys. The internet-routable IP address for the customer gateway device's external interface -- The value must be static. https://docs.aws.amazon.com/vpc/latest/adminguide/...


4

If you use SSL based VPN from Fortinet, you can use openfortivpn software which is part of Ubuntu. $ sudo apt install openfortivpn $ touch openfortivpn.conf $ chmod go= openfortivpn.conf Edit openfortivpn.conf: host = port = username = password = # trusted-cert = Connect the first time: $ sudo openfortivpn -c openfortivpn.conf ERROR: Gateway ...


3

It will use the new default gateway.


3

"Enter Private Key Password" suggests you may be barking up the wrong tree. It sounds like you are authenticating based on PKI and your private key is encrypted and requires a password to use (an entirely local process). auth-user-pass, on the other hand, is for authenticating to the VPN server with username and password, which is unrelated. One option ...


3

The VPN Interoperability Guides documentation offered by Google 1 is a great place to start exploring the VPN connectivity with third party solutions. Main idea is to make sure that your networks and subnets from each side of the VPN do not overlap. For instance, if you use 10.0.1.0/24 for your Kubernetes deployment, you cannot have the same 10.0.1.0/24 ...


3

You just have to add a route: route add -net 192.168.100.0/24 gw 192.168.100.1 metric 1 In this example 192.168.100.0/24 is the VPN network and 192.168.100.1 is your VPN gateway. More info about routing on AWS can be found here https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html


3

Any private range can conflict with a company’s internal range. You can try using the TESTnet ranges, e.g. 192.0.2.0/24 or 203.0.113.0/24, but even these can be used in some companies. If you want to be sure there won’t be any addressing conflicts ever, you must use public IP addresses that you own. Edit: limit the range as much as possible to decrease the ...


3

That is not accurate, and you are missing the point why NLA was created. Without NLA, a computer can establish a session to a remote desktop server before authenticating. It's trivial to create enough sessions to exhaust all resources on the server. That is straight from the Wikipedia page: https://en.wikipedia.org/wiki/Network_Level_Authentication It isn'...


3

Your "Local connection" is your regular (physical) connection over which the IPsec VPN tunnel is built. Disabling that interface will completely isolate your windows client from the network; thus the VPN tunnel will go down as well. You can try using traceroute to verify whether or not your traffic is going through the VPN tunnel. To provide more ...


3

Problem solved. By unchecking "Use default gateway" in IPv4 and IPv6 settings of VPN properties.


3

Your iptables rules from the question comments: -A FORWARD -d 192.168.2.37/32 -o ens34 -p udp -m udp --dport 500 -j ACCEPT -A FORWARD -d 192.168.2.37/32 -o ens34 -p udp -m udp --dport 4500 -j ACCEPT -A FORWARD -d 192.168.2.37/32 -o ens34 -p udp -m udp --dport 53 -j ACCEPT I don't really see why you'd need the port 53 forwarded: making the DNS server of ...


3

Forwarding an IP packet occurs whenever a device (which is not the intended recipient) receives an IP packet, and the device understands how to send the IP packet to the intended recipient. This happens constantly on the Internet. Your PC wants to connect to Google, but your computer is not directly connect to a Google Server, so the packet has to be ...


3

Could be an IP fragmentation issue. Due to the certificate the IKE_AUTH response is larger than the MTU (1744 bytes): charon[11943]: 09[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ] charon[11943]: 09[NET] sending packet: from SERVER_IP_HERE[4500] to CLIENT_IP_HERE[44710] (1744 bytes) So this gets fragmented into multiple IP fragments. ...


3

So, let's try to solve your issue. To better understanding I've drawn the network topology diagram. To clarify what happens, I've splited graphically l2 and l3 processing inside your ubuntu host - it'll help in a further reasoning. Check the following steps: Check the routing on the wifi client (here and further - 10.24.11.X - replace to your actual ip ...


3

No. Mobile user experience is poor as they may not be able to control which ISP they have access to. An IP address is not an authenticator by definitions like NIST sp800-63b. It is not a secret, nor is it in control of the user. The MAC address isn't even constant, it can be changed on Android (temporarily) without root. Android is not interested in EUI-...


2

I found the reason. Microsoft stopped supporting TLS1.0 and TLS1.1 As my client computer is Windows7, I receive this error. Mitigation is described here: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-vpn-faq#tls1 Thanks to all for participation, Sergei.


2

You need to enable the option 'Support invisible proxying' in Burp's options.


2

At the very least, you'll want to make sure you have the following bases covered: Make sure that your Synology NAS[es] and other endpoints are always caught up on security updates. Make sure both Synology endpoints have valid SSL certificates in use and that all traffic is going through encrypted ports. Configure and use MFA (multi-factor authentication) ...


2

Getting TAP devices to work well on Ubuntu 17.10 and upwards (and other OS's that use systemd-resolved and/or network-manager) is no picknick in my experience, but after a lot of experimenting I've arrived at a setup which works well. Before I will describe my solution, here's my situation and requirements. I run OpenVPN server on a router (Asus RT-AC87U ...


2

You can use ip rule (see man ip-rule) to setup specific routing tables based on source or destination IP and based on source or destination interface. It should be able to achieve what you want. SELECTOR := [ from PREFIX ] [ to PREFIX ] [ iif STRING ] [ oif STRING ] ...


2

Given the link posted in the comments, I decided to take another look at this openvpn article: https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux I was able to achieve ~150Mbit/s average using a couple of the settings from this article. Here are the steps I took to configure my OpenVPN to achieve this. These are the steps I tried in order: ...


2

You would have to use the OpenVPN client since they all use different protocols. The SoftEther server however creates a server with different protocols.


2

If I may, I will take the liberty of decomposing your question, taking a step back, and helping to step through the entire solution design process so we can determine a workable solution for you. There are a number of inaccuracies in your question around the SSH protocol, VPNs, and in general, how we design secure systems. Let's work through them here. At ...


2

I contacted GCP support and got my issue fixed using the following steps: After setting up the first VPN Gateway, do these steps for each one of the remaining branches: Goto your VPN in your web console. In the VPN page, click "Google VPN Gateways". Click your desired gateway. On the page, click "add tunnel". Then a page will pop up same as to setup a VPN ...


2

Don't expect it to work through a VPN. (In fact, don't expect to it work in the future at all.) net view does not use DNS, nor mDNS, nor LLMNR, nor Active Directory. Its only purpose is to get a list of computers visible via NetBIOS "Browsing". (As far as I know, it does not support WS-Discovery either.) Valid parameters for /domain: would be either NetBIOS ...


2

Problem solved - posting it here if somebody needs it. The problem was with AWS Security groups which were not accessing ingress connections from region C subnets.


2

You can't have the VPN server on your "EntryMachine" inside the firewall/NAT. Instead, you should use the firewall/router/UTM as your VPN server. Also, if you don't control the firewall or if you are not allowed to use VPN connections to the company network, you should not try to circumvent it. That could be possible by establish some kind of connection ...


2

Cloudflare's 1.1.1.1 is not a VPN provider, it's a DNS resolver service. It doesn't encrypt your traffic. However, it can encrypt your DNS queries. By using DNS over HTTPS (DoH) you can transparently offer enhanced security to your customers while improving the speed of your devices. The automatic configuration tool probably configures the DNS servers ...


Only top voted, non community-wiki answers of a minimum length are eligible