Hot answers tagged

13

After extensive study of the openvpn manual, I have found an answer for my question: I you don't want the routes to be executed automatically, but to be handled by your own tool, use the following option: --route-noexec Don't add or remove routes automatically. Instead pass routes to --route-up script using environmental variables. If you ...


13

Use the firewall-cmd command. Assuming you're opening the firewall up to OpenVPN on the default zone, carry out the following commands. If you are running it on a non-default zone, then add --zone=<zone> to the commands. Note: If you use default public zone for your external facing network adapter then your loopback interface could also be ...


9

You need to do three things on your VPN server (the Linode) to make this work: You must enable IP forwarding: sysctl -w net.ipv4.ip_forward=1 Set up destination NAT (DNAT) to forward the port. You've probably already figured this out because it's standard port forwarding stuff, but for completeness: iptables -t nat -A PREROUTING -d x.x.x.x -p tcp --...


6

push route "10.10.10.0 255.255.255.0 10.0.0.2 1" From the openvpn man page: --route network/IP [netmask] [gateway] [metric] This tells the server config to "push" to the client, the route command which sets a networking route of the 10.10.10.0/24 subnet via the gateway 10.0.0.2 with a metric of 1. Metrics are used to give "preference" if multiple routes ...


6

You need to tell your router to use your server for this VPN subnet: the correct solution to your problem is to add a route on the router for the OpenVPN subnet. If you can't do this because you can't touch the router, another solution is to setup a NDP proxy for the clients on the eth0 link. As you're using a VPS you probably can't add routes to the ...


6

I think the Debian OpenVPN setup with systemd is currently a tad bit broken. To get it to work on my machines I had to: Create /etc/systemd/system/openvpn@.service.d (the directory), and place in it a new file with this:[Unit] Requires=networking.service After=networking.serviceI called my file local-after-ifup.conf. It needs to end with .conf. (This is ...


6

Historically in IPv4, unnumbered interfaces were not possible. The only possible way to configured a point-to-point interface was with a local address and a remote address. The only way to route some other IP address through the point-to-point interface in question was to install a route using the interface's remote address as the gateway (there was no ...


5

You would have to have them on unique ports. You can't have two applications listening simultaneously on a single port. So, in your example, because tunnels 1 and 2 both have an end on Site A, those endpoints must have unique ports. Hence the use of ports 1194, and 1195. Now, because the VPN links 1 and 2 are using unique ports 1194 and 1195 on A->B, and ...


5

I had the same problem and could solve it by removing the line "local xxx.xxx.xxx.xxx." out of the server.conf. via


5

You might want to run fixfiles -R openvpn restore An ls -alZ should give you something like this (showing your files are in the correct selinux context now): [root@server openvpn]# ls -alZ /etc/openvpn/ drwxr-xr-x. root root system_u:object_r:openvpn_etc_t:s0 . drwxr-xr-x. root root system_u:object_r:etc_t:s0 .. drwxr-xr-x. root root ...


5

You have the symptoms of an MTU problem: some TCP connections freeze, more or less reproducibly for a given command or URL but with no easily discernible overall pattern. A telltale symptom is that interactive ssh sessions work well as long as you don't run commands with large output. See Can't access select https sites on Linux over PPPoE for an ...


5

I try to start it via normal service call:# service openvpn start work No, that's not normal. That's a quirk of System 5 rc toolsets that invokes a System 5 rc script with two arguments. The rc script takes the non-standard second argument as the basename of the OpenVPN configuration to use. This is Ubuntu Linux. You aren't using System 5 rc. You aren'...


4

Just wanted to mention that (at least on Ubuntu 12.04) there is --askpass /your/file argument for openvpn, that reads the private key password from a file.


4

As penguin359 correctly said, the problem is that the return packets will be routed over the VPN instead of via your local router, which is where the incoming connection came from. SNAT on the router is one solution, but if that's not feasible, you can use advanced routing on your PC. You'll need to add these advanced routing rules in addition to your ...


4

I've done something similar with real interfaces, but I can't see why it wouldn't work with VPN interfaces. The idea is that, as you have the same subnet available at different interfaces on that router, it complicates the routing. Basically, when a packet for 10.10.13.123 enters the router, it is DNATed before routing to 192.168.0.123, so you have to be ...


4

How do I ensure that my torrent client actually uses this connection? There is a site, CheckMyTorrentIP, that does exactly that. Basically, you download a torrent file generated specifically for you and once you open it in your client it will report the IP address being used. The IP should be displayed directly in your client but you can also revisit the ...


4

There are two methods to handling this situation. The ideal way by having logrotate notify the process, either via signal or by restarting the process via the postrotate directive. The other way is using the copytruncate. The copytruncate method should work in your situation. Here is the description from the documentation: copytruncate Truncate ...


4

I cannot say if VPNC will or won't work with Checkpoint, and in the past when I've attempted to use VPNC with Aventail/Nortel it did not work for me, so I reverted to using the native client software that was included by Aventail/Nortel on Fedora/CentOS/Ubuntu systems. I cover some of this at a highlevel on my blog in this article titled: Setting up Aventail ...


4

This type of unit file is an Instantiated Service - more details are available here The following is the unit file for openvpn on CentOS 7: [Unit] Description=OpenVPN Robust And Highly Flexible Tunneling Application On %I After=syslog.target network.target [Service] PrivateTmp=true Type=forking PIDFile=/var/run/openvpn/%i.pid ExecStart=/usr/sbin/openvpn --...


4

You must check the routing table. With the route command, you can see how you traffic is routed, if there is a line like default 123.456.78.x is likely that your traffic is redirected on the VPN, however if your public ip is your isp it is very likely that the VPN rotate only traffic headed to work. These lines indicate that the traffic with a destination ...


4

I've always had issues with iptables redirections (probably my fault, I'm pretty sure it's doable). But for a case like yours, it's IMO easier to do it in user-land without iptables. Basically, you need to have a daemon in your "default" workspace listening on TCP port 8112 and redirecting all traffic to 10.200.200.2 port 8112. So it's a simple TCP proxy. ...


3

You should use the new Plugin system. Although there isn't an OpenVPN plugin right now, you can install software within the jail. The jail is not affected on FreeNAS updates. And if you so, you might want to create a plugin and contribute it to the FreeNAS community :-) Further readings: http://doc.freenas.org/index.php/Plugins


3

You can use the down directive in your client configuration to fire off a custom script when the connection drops. In the script, you could do several things for limiting public network connections. Here's my ideas: Setup some iptables that only allow connections to the VPN server, all other connections dropped. Of course, do not forget to remove this ...


3

Sat Jul 9 13:14:21 2011 WARNING: potential route subnet conflict between local LAN [192.168.80.0/255.255.255.0] and remote VPN [192.168.80.1/255.255.255.255] For some reason, your configuration seems to be sharing ip address space. Your VPN is selecting addresses from the 192.168.80.x address space, and your local LAN is selecting addresses from the 192....


3

From the Red Hat article in the comments the solution says This is expected behaviour. Not very helpful but it also points out the reason it happens. It references commit a17c2153d2e271b0cbacae9bed83b0eaa41db7e1 in the sunrpc package that moves where nfs authentication takes place. I won't copy/paste the entire commit but it mostly changes these lines....


3

OpenVPN provides a link. If running in tun (recommended) mode, it provides a link for IP traffic. If running in tap mode, it provides a link for Ethernet traffic (which includes IP, but also all kinds of other things). If you run in tap mode, you need to bridge your OpenVPN tap interface to your Ethernet interface. You can do that with brctl, but, generally,...


3

In your server config, "listen localhost" is wrong. That would listen on 127.0.0.1 (or similar), meaning it would not accept connections from outside the box. Your comment next to it doesn't make sense either; and also, you'd normally listen on a public IP. Assuming the above is anonimizing (which you forgot to do in the client config): The ; comments are ...


3

If you're using NetworkManager you can use the command line tool that's part of it, nmcli to get this list: $ nmcli dev list iface wlan0 | grep IP4 IP4-SETTINGS.ADDRESS: 192.168.1.110 IP4-SETTINGS.PREFIX: 24 (255.255.255.0) IP4-SETTINGS.GATEWAY: 192.168.1.1 IP4-DNS1.DNS: 192.168.1.8 IP4-DNS2.DNS: ...


3

Do this command to track those files down when an RPM is installed: $ rpm -ql openvpn and see where those files might actually be. For packages that haven't been installed yet you can query the yum repository using the command repoquery: $ repoquery -l openvpn Different distros put files in different locations. Though on my Fedora system the ...


3

Those are the IP addresses of the local and remote tunnel endpoints (in that order). They're used for routing (and of course the local one is a local IP address, just like on any other interface). You could use public IPs, but its a waste of IP addresses in most cases—you can use internal (RFC1918) addresses even if you're routing a public subnet over the ...



Only top voted, non community-wiki answers of a minimum length are eligible