Tag Info

Hot answers tagged

5

Use the firewall-cmd command. Assuming you're opening the firewall up to OpenVPN on the default zone, carry out the following commands. If you are running it on a non-default zone, then add --zone=<zone> to the commands. First, list what's currently open: # firewall-cmd --list-services http https ssh Next, add the openvpn service: # firewall-cmd ...


4

You need to tell your router to use your server for this VPN subnet: the correct solution to your problem is to add a route on the router for the OpenVPN subnet. If you can't do this because you can't touch the router, another solution is to setup a NDP proxy for the clients on the eth0 link. As you're using a VPS you probably can't add routes to the ...


3

You might want to run fixfiles -R openvpn restore An ls -alZ should give you something like this (showing your files are in the correct selinux context now): [root@server openvpn]# ls -alZ /etc/openvpn/ drwxr-xr-x. root root system_u:object_r:openvpn_etc_t:s0 . drwxr-xr-x. root root system_u:object_r:etc_t:s0 .. drwxr-xr-x. root root ...


3

I don't know about pfSense, but from the OpenVPN perspective the line of interest here is Options error: --server directive network/netmask combination is invalid This means that you've specified a VPN network address and netmask that do not combine. OpenVPN checks the network address to have zeroes where the netmask expects zeroes. E.g. 192.168.1.0 + ...


2

You could modify the zone and add a Rich Rule which blocks all ssh traffic other than from a certain range - the Employee subnet. Find which zone your tun interface is in by listing all zones: firewall-cmd --list-all-zones | less In the output you should see something similar to: internal (active) interfaces: tun0 sources: services: dhcpv6-client ...


2

I think the Debian OpenVPN setup with systemd is currently a tad bit broken. To get it to work on my machines I had to: Create /etc/systemd/system/openvpn@.service.d (the directory), and place in it a new file with this:[Unit] Requires=networking.service After=networking.serviceI called my file local-after-ifup.conf. It needs to end with .conf. (This is ...


2

SELinux is disallowing the openvpn executable from accessing files on the filesystem in a specific location. Your best friend for dealing with these is to use the SELinux troubleshooter GUI. $ sealert -b     You'll then want to follow the advice to add the necessary contexts to your filesystem to appease SELinux.      ...


2

For the message "Address already in use", I think it's because https listen also on TCP port 443.


1

On your server, net.ipv4.ip_forward=1 isn't enough, it only enables the forwarding code. You still have to tell the kernel (via iptables) what it's allowed to forward, from who, and to where. You should read the Linux IP Masquerade HOWTO. That's if you want to redirect all network traffic through your VPN connection (which is sometimes wanted for security ...


1

Run app1 on the default https port (443) and run app2 on another port (444 - Unless you're using SNPP in which case you'll need to choose another free port). Clone the https.xml file (located in /usr/lib/firewalld/services) to /etc/firewalld/services and rename it to (for example) https-app2.xml. Edit this new file and change the port to 444. Ensure that ...


1

This is a very broad question. I'll try to address a few of these. As installed, logrotate is called daily via a cron type of situation. In Centos 7, you can find the invokation of logrotate under /etc/cron.daily which is invoked via the daily entry (0daily) in a /etc/cron.d file. Of course, you can make changes to run this every hour or make further ...


1

You haven't added your tun0 device to any zone, so it defaults to the default zone, which in your case is the public zone. As root, run: firewall-cmd --zone=internal --add-interface=tun0 You can then leave ssh and https enabled in the internal zone and disable it in the public zone.


1

I assume that you want: one specific secondary VPN server to become the default gateway for a given client. If this is so, that can be done using route push. You already know that you can tell the client the address of its "new" gateway after the OpenVPN connection has gone up. Well, you can do so dynamically. From the manual: --client-connect ...


1

It turns out that you can put a tunnel interface into a network namespace. My entire problem was down to a mistake in bringing up the interface: ip addr add dev $tun_tundv \ local $ifconfig_local/$ifconfig_cidr \ broadcast $ifconfig_broadcast \ scope link The problem is "scope link", which I misunderstood as only affecting routing. It causes ...


1

This type of unit file is an Instantiated Service - more details are available here The following is the unit file for openvpn on CentOS 7: [Unit] Description=OpenVPN Robust And Highly Flexible Tunneling Application On %I After=syslog.target network.target [Service] PrivateTmp=true Type=forking PIDFile=/var/run/openvpn/%i.pid ExecStart=/usr/sbin/openvpn ...


1

https://forums.openvpn.net/topic10575.html http://openvpn.net/archive/openvpn-users/2007-02/msg00183.html http://openvpn.net/archive/openvpn-users/2005-11/msg00258.html https://groups.google.com/forum/#!topic/tunnelblick-discuss/7lGWKR1-rC4 http://comments.gmane.org/gmane.network.openvpn.user/30934 ...


1

Try starting the client with the --daemon option: openvpn --daemon From openvpn's man page: --daemon [progname] Become a daemon after all initialization functions are completed To interact with openvpn once it is a daemon, add the --management option to the command. This allows you to interact with it using telnet as described here. Alternatively, ...


1

Set your client to have a route parameter to only your home LAN. For example if your home LAN was 192.168.2.0, the the parameter would look like this in the .conf file: route 192.168.2.0 255.255.255.0 and dont push any routes from the server onto the client. This way when the tunnel comes up all you will route through it is the network you put in the ...


1

The first error is clear; the line you've commented out gives the permission that audit says is missing. The second part is more interesting, but what I suspect is the problem is the target context of the socket you're modifying (owned by unconfined_u). Because you've moved to static device nodes, your interfaces are no longer created by the openvpn process ...


1

I'm not 100% sure about whether or not storing the username/password combination in a variable will work - it definitely won't if your sudo configuration requires a password, but at the least you can implement a loop similar to what's below. If storing the username/password in the variable does work, you won't need to write a file with your credentials at ...


1

Nope, it's not enough to ACCEPT traffic on tun interface. You will also need to open 1194/udp port in INPUT chain. -A INPUT -i wlp3s0 -j ACCEPT -m udp -p udp --dport 1194 -m state --state NEW -j ACCEPT You should also setup a default policy for INPUT chain to DROP. Now you allow all incoming connections! *filter :INPUT DROP [323:24107] HTH


1

There's two parts to this answer, since an OpenVPN connection consists of two parts. Part 1 is the control channel, this is a TLS connection over which OpenVPN sends control messages and keys for the second part; the data channel. The data channel is where the actual network packets are transferred over. For the TLS control channel, support for GCM is ...


1

From what I know, you can't implement every feature you require without custom / commercial products to lock down everything. Here are some thoughts to keep in mind while elaborating on how to meet the required critera: Typical VPN-solutions add routes. For routes to be added, the user needs to have administrative rights on the client computer. This isn't ...


1

You can use the resolv.conf.head and resolv.conf.tail files to add lines before and after the content generated by resolvconf


1

Gateway of your server (in the 192.168.1.0 network) most likely doesn't know about the existence of the 10.8.0.0 network. Either add a route in the router so it redirects those packets to your server or use NAT on the server for packets coming from the tun interface.


1

To me it looks like a simple login script that immediately connects to another box. Something like: ~$ cat .bash_profile clear telnet <the-other-box> Not sure why you mention OpenVPN. It doesn't look like OpenVPN is involved here...


1

From the Red Hat article in the comments the solution says This is expected behaviour. Not very helpful but it also points out the reason it happens. It references commit a17c2153d2e271b0cbacae9bed83b0eaa41db7e1 in the sunrpc package that moves where nfs authentication takes place. I won't copy/paste the entire commit but it mostly changes these ...


1

The LSB headers at the top of scripts in /etc/init.d/ define a bit more about the program and what they depend on. It looks like there's no LSB headers in the denyhosts init script. You could try to update (apt-get update) and then reinstall the package (apt-get install --reinstall denyhosts) but changes are you'll get the same (incorrect) script back. Try ...


1

If I read your question as 'I am remotely configuring my server to which I am logged in using scp', then here are a few guidelines on how to set up openvpn on that server (and your client): To start the OpenVPN listening service automatically on the server make sure you have a valid .conf file in the /etc/openvpn/ directory. When the openvpn service starts ...


1

Do I understand correctly? You want to establish a VPN connection as soon as you log in? There's a pam-module that sounds promising: pam-openvpn is a Linux PAM-module which works together with OpenVPN. With this pam-module it is possible to establish VPN connections when a user logs into a system and tear down the connection when the user logs ...



Only top voted, non community-wiki answers of a minimum length are eligible