Hot answers tagged

13

After extensive study of the openvpn manual, I have found an answer for my question: I you don't want the routes to be executed automatically, but to be handled by your own tool, use the following option: --route-noexec Don't add or remove routes automatically. Instead pass routes to --route-up script using environmental variables. If you ...


13

Use the firewall-cmd command. Assuming you're opening the firewall up to OpenVPN on the default zone, carry out the following commands. If you are running it on a non-default zone, then add --zone=<zone> to the commands. Note: If you use default public zone for your external facing network adapter then your loopback interface could also be ...


9

You need to do three things on your VPN server (the Linode) to make this work: You must enable IP forwarding: sysctl -w net.ipv4.ip_forward=1 Set up destination NAT (DNAT) to forward the port. You've probably already figured this out because it's standard port forwarding stuff, but for completeness: iptables -t nat -A PREROUTING -d x.x.x.x -p tcp ...


6

push route "10.10.10.0 255.255.255.0 10.0.0.2 1" From the openvpn man page: --route network/IP [netmask] [gateway] [metric] This tells the server config to "push" to the client, the route command which sets a networking route of the 10.10.10.0/24 subnet via the gateway 10.0.0.2 with a metric of 1. Metrics are used to give "preference" if multiple routes ...


6

I think the Debian OpenVPN setup with systemd is currently a tad bit broken. To get it to work on my machines I had to: Create /etc/systemd/system/openvpn@.service.d (the directory), and place in it a new file with this:[Unit] Requires=networking.service After=networking.serviceI called my file local-after-ifup.conf. It needs to end with .conf. (This is ...


6

You need to tell your router to use your server for this VPN subnet: the correct solution to your problem is to add a route on the router for the OpenVPN subnet. If you can't do this because you can't touch the router, another solution is to setup a NDP proxy for the clients on the eth0 link. As you're using a VPS you probably can't add routes to the ...


6

Historically in IPv4, unnumbered interfaces were not possible. The only possible way to configured a point-to-point interface was with a local address and a remote address. The only way to route some other IP address through the point-to-point interface in question was to install a route using the interface's remote address as the gateway (there was no ...


6

I try to start it via normal service call:# service openvpn start work No, that's not normal. That's a quirk of System 5 rc toolsets that invokes a System 5 rc script with two arguments. The rc script takes the non-standard second argument as the basename of the OpenVPN configuration to use. This is Ubuntu Linux. You aren't using System 5 rc. You ...


5

You have the symptoms of an MTU problem: some TCP connections freeze, more or less reproducibly for a given command or URL but with no easily discernible overall pattern. A telltale symptom is that interactive ssh sessions work well as long as you don't run commands with large output. See Can't access select https sites on Linux over PPPoE for an ...


5

You might want to run fixfiles -R openvpn restore An ls -alZ should give you something like this (showing your files are in the correct selinux context now): [root@server openvpn]# ls -alZ /etc/openvpn/ drwxr-xr-x. root root system_u:object_r:openvpn_etc_t:s0 . drwxr-xr-x. root root system_u:object_r:etc_t:s0 .. drwxr-xr-x. root root ...


5

You would have to have them on unique ports. You can't have two applications listening simultaneously on a single port. So, in your example, because tunnels 1 and 2 both have an end on Site A, those endpoints must have unique ports. Hence the use of ports 1194, and 1195. Now, because the VPN links 1 and 2 are using unique ports 1194 and 1195 on A->B, and ...


4

I've done something similar with real interfaces, but I can't see why it wouldn't work with VPN interfaces. The idea is that, as you have the same subnet available at different interfaces on that router, it complicates the routing. Basically, when a packet for 10.10.13.123 enters the router, it is DNATed before routing to 192.168.0.123, so you have to be ...


4

Just wanted to mention that (at least on Ubuntu 12.04) there is --askpass /your/file argument for openvpn, that reads the private key password from a file.


4

How do I ensure that my torrent client actually uses this connection? There is a site, CheckMyTorrentIP, that does exactly that. Basically, you download a torrent file generated specifically for you and once you open it in your client it will report the IP address being used. The IP should be displayed directly in your client but you can also revisit the ...


4

There are two methods to handling this situation. The ideal way by having logrotate notify the process, either via signal or by restarting the process via the postrotate directive. The other way is using the copytruncate. The copytruncate method should work in your situation. Here is the description from the documentation: copytruncate Truncate ...


4

I cannot say if VPNC will or won't work with Checkpoint, and in the past when I've attempted to use VPNC with Aventail/Nortel it did not work for me, so I reverted to using the native client software that was included by Aventail/Nortel on Fedora/CentOS/Ubuntu systems. I cover some of this at a highlevel on my blog in this article titled: Setting up Aventail ...


4

This type of unit file is an Instantiated Service - more details are available here The following is the unit file for openvpn on CentOS 7: [Unit] Description=OpenVPN Robust And Highly Flexible Tunneling Application On %I After=syslog.target network.target [Service] PrivateTmp=true Type=forking PIDFile=/var/run/openvpn/%i.pid ExecStart=/usr/sbin/openvpn ...


4

You must check the routing table. With the route command, you can see how you traffic is routed, if there is a line like default 123.456.78.x is likely that your traffic is redirected on the VPN, however if your public ip is your isp it is very likely that the VPN rotate only traffic headed to work. These lines indicate that the traffic with a destination ...


3

/etc/resolv.conf is built from pieces that are in the directory /run/resolvconf/interface (actual location on current Debian and Ubuntu) /etc/resolvconf/run/interface (old location, still existing via a symbolic link on Debian). Each piece is named after the interface that it is associated with. When they aren't static, the entries in ...


3

Using the configuration file with a GUI If you look at the proxpn script, you will see that the command issued is: openvpn --config $OPENVPN_CONF \ --remote $remote $PORT \ --auth-nocache \ --auth-user-pass $AUTH_CREDS If you want to feed the OpenVPN config file to some other tool (like a GUI or a mobile client), you might need to add those extra ...


3

I've always had issues with iptables redirections (probably my fault, I'm pretty sure it's doable). But for a case like yours, it's IMO easier to do it in user-land without iptables. Basically, you need to have a daemon in your "default" workspace listening on TCP port 8112 and redirecting all traffic to 10.200.200.2 port 8112. So it's a simple TCP proxy. ...


3

Allow first your local connection and your RELATED, ESTABLISHED connections protocols. $ sudo iptables -A INPUT -p tcp -s 127.0.0.1 -j ACCEPT $ sudo iptables -A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT $ sudo iptables -A INPUT -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT $ sudo iptables -A INPUT -p icmp -m state --state ...


3

The approach I would recommend is to route all your traffic through the VPN except SSH; this provides much more protection for your privacy and significantly reduces the risk of any personal information leaking. This approach has several separate components. Torrent client rtorrent is an excellent torrent client for running in a headless environment. Run ...


3

I had the same problem and could solve it by removing the line "local xxx.xxx.xxx.xxx." out of the server.conf. via


3

Those are the IP addresses of the local and remote tunnel endpoints (in that order). They're used for routing (and of course the local one is a local IP address, just like on any other interface). You could use public IPs, but its a waste of IP addresses in most cases—you can use internal (RFC1918) addresses even if you're routing a public subnet over the ...


3

I don't know about pfSense, but from the OpenVPN perspective the line of interest here is Options error: --server directive network/netmask combination is invalid This means that you've specified a VPN network address and netmask that do not combine. OpenVPN checks the network address to have zeroes where the netmask expects zeroes. E.g. 192.168.1.0 + ...


3

You should use the same CA and make sure it's secured (as anyone compromising it would be able to issue certificates for it and perform a MITM attack). You might consider putting a machine offline and using it for this purpose only. As long as it's for internal use only, a self-signed cert will work fine. Remember that you'll have to install the CA root ...


3

You can check the MAC of the client only if the client is on the same network segment, i.e. if there's no router in between (a switch is ok). You can see that with traceroute: if you run traceroute 192.0.2.1 from the server where 192.0.2.1 is the address of one of the devices, it must report only a single hop, the destination. Nasha's and yaegashi's answers ...


3

If you're using NetworkManager you can use the command line tool that's part of it, nmcli to get this list: $ nmcli dev list iface wlan0 | grep IP4 IP4-SETTINGS.ADDRESS: 192.168.1.110 IP4-SETTINGS.PREFIX: 24 (255.255.255.0) IP4-SETTINGS.GATEWAY: 192.168.1.1 IP4-DNS1.DNS: 192.168.1.8 IP4-DNS2.DNS: ...


3

Do this command to track those files down when an RPM is installed: $ rpm -ql openvpn and see where those files might actually be. For packages that haven't been installed yet you can query the yum repository using the command repoquery: $ repoquery -l openvpn Different distros put files in different locations. Though on my Fedora system the ...



Only top voted, non community-wiki answers of a minimum length are eligible