Tag Info

Hot answers tagged

5

You have the symptoms of an MTU problem: some TCP connections freeze, more or less reproducibly for a given command or URL but with no easily discernible overall pattern. A telltale symptom is that interactive ssh sessions work well as long as you don't run commands with large output. See Can't access select https sites on Linux over PPPoE for an ...


3

Those are the IP addresses of the local and remote tunnel endpoints (in that order). They're used for routing (and of course the local one is a local IP address, just like on any other interface). You could use public IPs, but its a waste of IP addresses in most cases—you can use internal (RFC1918) addresses even if you're routing a public subnet over the ...


3

There are two methods to handling this situation. The ideal way by having logrotate notify the process, either via signal or by restarting the process via the postrotate directive. The other way is using the copytruncate. The copytruncate method should work in your situation. Here is the description from the documentation: copytruncate Truncate ...


2

A VPN network usually uses a different interface on your host so you can still use your other interface and public IP. So, you will still be able to access your SSH server as before. The usual implementation used to set up a VPN network is openvpn (clientside and serverside). The whole configuration process is a bit long to be described entirely here and it ...


2

If you're using NetworkManager you can use the command line tool that's part of it, nmcli to get this list: $ nmcli dev list iface wlan0 | grep IP4 IP4-SETTINGS.ADDRESS: 192.168.1.110 IP4-SETTINGS.PREFIX: 24 (255.255.255.0) IP4-SETTINGS.GATEWAY: 192.168.1.1 IP4-DNS1.DNS: 192.168.1.8 IP4-DNS2.DNS: ...


2

How about workaround to logging into syslog? See usage --daemon [progname] (or --syslog [progname]) in man openvpn (http://openvpn.net/index.php/open-source/documentation/manuals/65-openvpn-20x-manpage.html)


2

Gilles' answer is completely correct, but there is also another potential cause for this. There was a bug in version 2.3.0 of OpenVPN which would disconnect clients when sending large chunks of data: https://community.openvpn.net/openvpn/ticket/263 This issue only occurred when using TCP. UDP was completely unaffected.


2

This one is the fatal error: Cannot load CA certificate file /home/mak/Downloads/ca.key There are a couple reasons that it may not be able to load the key: Permissions are wrong. Check to make sure the file is readable File doesn't exist. Confirm the path & name is correct. File is in the wrong format, or is not a CA certificate. Try openssl x509 ...


1

I don't have the full output pre-grep because my scrollbuffer filled up, but: # ip addr show dev eth0 |grep 192.168.[12] inet 192.168.1.1/16 scope global eth0 inet 192.168.1.2/16 scope global secondary eth0 inet 192.168.1.3/16 scope global secondary eth0 inet 192.168.1.4/16 scope global secondary eth0 inet 192.168.1.5/16 scope global secondary eth0 ... ...


1

You can also use racoon, if cert is used for authentication. Configuration /etc/racoon/racoon.conf # Racoon IKE daemon configuration file. # See 'man racoon.conf' for a description of the format and entries. path include "/etc/racoon"; path pre_shared_key "/etc/racoon/psk.txt"; path certificate "/etc/racoon/certs"; path script "/etc/racoon/scripts"; sainfo ...


1

Is the openvpn server a vmware virtual machine on a ESX/ESXi/VSphere server? If yes, you may need to enable the promiscuous mode in the vmswitch. The problem is that vmware ESX virtual switch will not "learn" new mac address by default, it just accept the VM mac address and nothing more. In bridge mode the client TAP mac address is used in the openvpn ...


1

It's not even possible. Ethernet interfaces have a link layer (MAC address), tun interfaces don't. You can bridge Ethernet to tap interfaces. Apart from that: What is the purpose of a VPN? Usually it is to separate legitimate communication partners from the rest. What is the point if someone just needs to connect to the LAN in order to get privileged ...


1

That's actually the best error message I've seen. It tells you exactly what's wrong and how to fix it. I don't see any kind of problem if you really want to allow openvpn use port 1194. BTW, to make errors in english you can use LANG=C before the commands (not sure if you can with auth.log).


1

The problem is SELinux, editing /etc/sysconfig/selinux and setting SELINUX=permissive and then rebooting fixed it for me. I remember in fedora that there was a command that had to be run to allow the cert directory to be used properly, but I forget what that command is. Setting to permissive fixes completely but a more preferred way would be to fix it so ...


1

I found several: CentOS 6 How to Setup and Configure an OpenVPN Server on CentOS 6 How to Build OpenVPN Server on CentOS 6.x OpenVPN Community Wiki and Tracker - RHEL6 How to create a OpenVPN VPN Server on CentOS 6 64bit. Secure Communications with OpenVPN on CentOS 6 CentOS 5 OpenVPN Server On CentOS 5.2


1

Do this command to track those files down when an RPM is installed: $ rpm -ql openvpn and see where those files might actually be. For packages that haven't been installed yet you can query the yum repository using the command repoquery: $ repoquery -l openvpn Different distros put files in different locations. Though on my Fedora system the ...


1

it's hard to tell without more information... anyhow, you have either not properly configured your installation via the vars file or you haven't activated the vars file by running source vars prior to running ./build-ca the vars file contains (among other things) the definition of the KEY_CONFIG variable. the default (on my Debian system) is to call a ...


1

The error line: Thu Aug 29 12:02:46 2013 us=870025 MANAGEMENT: Socket bind failed on local address [AF_INET]xxxxx:1194: Cannot assign requested address is your clue to the problem. I would imagine there is some process already listening on port 1194. You can check that with a netstat -pnta and see if 1194 is listed as a state LISTEN proces: Active ...


1

Before you start your VPN take a copy of netstat -rn and ifconfig -a. Start your VPN, and the differences in those two commands will tell you what networks the VPN creates in terms of routes, and what IP you've been assigned to gain visibility of those networks. You will also need to get the IP of the server providing your VPN (or traffic to the VPN server ...


1

You can configure OpenVPN not to exit when the connection goes down, and instead to reconnect (e.g., ping-restart instead of ping-exit). Also make sure you don't have things like inactive (exit on inactivity), or single-session. You can also configure OpenVPN to keep the tunnel around, so traffic will potentially be sent insecurely with persist-tun. In ...


1

I don't have a Fedora system right now to check with, but now that I'm reading this some time later "openvpn" as a name seems kind of generic. To the point where it's possible that the OpenVPN package itself might have a module named that for the type information that it adds when it gets installed. Does this still happen if you give the module a different ...


1

it seems you're routing all traffic through eth1 (default via 10.0.0.1 dev eth1 table 2 is prefered over default via 10.0.0.1 dev eth0 table 1) but using -I eth0 just replaces src IP of icmp packets (correct me if I'm not right). Also, does 10.0.0.1 gateway exist in both networks? I believe this LARTC article should definitely help you. Btw, it would be ...


1

It coud be both a routing or firewall problem. First of all you should check if you can ping the server/firewall from the vpn client. Check if you can ping the address of eth1 and the tun1 one. If these check fails you probably have a missing route. Maybe openVPN does not force the client to set routes for internal subnet. On the client, supposing it's a ...



Only top voted, non community-wiki answers of a minimum length are eligible