Tag Info

Hot answers tagged

5

Historically in IPv4, unnumbered interfaces were not possible. The only possible way to configured a point-to-point interface was with a local address and a remote address. The only way to route some other IP address through the point-to-point interface in question was to install a route using the interface's remote address as the gateway (there was no ...


3

You might want to run fixfiles -R openvpn restore An ls -alZ should give you something like this (showing your files are in the correct selinux context now): [root@server openvpn]# ls -alZ /etc/openvpn/ drwxr-xr-x. root root system_u:object_r:openvpn_etc_t:s0 . drwxr-xr-x. root root system_u:object_r:etc_t:s0 .. drwxr-xr-x. root root ...


3

You should use the same CA and make sure it's secured (as anyone compromising it would be able to issue certificates for it and perform a MITM attack). You might consider putting a machine offline and using it for this purpose only. As long as it's for internal use only, a self-signed cert will work fine. Remember that you'll have to install the CA root ...


3

You can check the MAC of the client only if the client is on the same network segment, i.e. if there's no router in between (a switch is ok). You can see that with traceroute: if you run traceroute 192.0.2.1 from the server where 192.0.2.1 is the address of one of the devices, it must report only a single hop, the destination. Nasha's and yaegashi's answers ...


2

You could modify the zone and add a Rich Rule which blocks all ssh traffic other than from a certain range - the Employee subnet. Find which zone your tun interface is in by listing all zones: firewall-cmd --list-all-zones | less In the output you should see something similar to: internal (active) interfaces: tun0 sources: services: dhcpv6-client ...


2

From the Red Hat article in the comments the solution says This is expected behaviour. Not very helpful but it also points out the reason it happens. It references commit a17c2153d2e271b0cbacae9bed83b0eaa41db7e1 in the sunrpc package that moves where nfs authentication takes place. I won't copy/paste the entire commit but it mostly changes these ...


2

SELinux is disallowing the openvpn executable from accessing files on the filesystem in a specific location. Your best friend for dealing with these is to use the SELinux troubleshooter GUI. $ sealert -b     You'll then want to follow the advice to add the necessary contexts to your filesystem to appease SELinux.      ...


2

You can use the resolv.conf.head and resolv.conf.tail files to add lines before and after the content generated by resolvconf


2

For the message "Address already in use", I think it's because https listen also on TCP port 443.


2

Encryption prevents your data from being read. But someone could still modify them; they won't know exactly what changes they're making (due to the encryption), but depending on what you're running over the link, that could be quite catastrophic to the application. Note that traffic analysis (looking at the size and timing of packets) can often give an ...


2

I try to start it via normal service call:# service openvpn start work No, that's not normal. That's a quirk of System 5 rc toolsets that invokes a System 5 rc script with two arguments. The rc script takes the non-standard second argument as the basename of the OpenVPN configuration to use. This is Ubuntu Linux. You aren't using System 5 rc. You ...


2

If there's a direct connection between your Raspberry Pi and the client, i.e. there's no routing and both are in the same segment, it's possible. Just use an ARP resolution, e.g. : arp <client_ip_address>.


2

Is your server a Linux host? If you have a white list of your clients, you can use iptables to accept requests only from them on specific input ports. You can also log requests from bad clients in dmesg. The following script defines MACCHECK chain to accept packets from approved 3 MACs, and drop others with logging. Then routes all packets of tcp/80 or ...


2

With very few exceptions, if somebody has your hardware in their hands, they can duplicate everything, simply by accessing and copying the whole storage. There's no extra encryption that would help. If you encrypt the disk, the disk encryption key has to be readable somewhere. Disk encryption is useless in your scenario. There is hardware that can't be ...


2

You would need policy routing to set up routing tables for each specific traffic. I've found a concise and good example in Linux Advanced Routing Mini HOWTO. Put the following line in /etc/iproute2/rt_tables: 1 DIRECT Then you can do like: iptables -t mangle -A PREROUTING -p tcp --dport 900:999 -j MARK --set-mark 1 ip route add default via <gateway ...


2

Do something like this server=$(cat /etc/openvpn/anonvpn.conf |grep remote|cut -d" " -f2) nextserver=$(grep -A1 $server /etc/openvpn/list.txt|grep -v $server) if [ -z "$nextserver" ]; then nextserver=$(head -n1 /etc/openvpn/list.txt) fi sed -i "s!$server!$nextserver!" /etc/openvpn/anonvpn.conf create the file /etc/openvpn/list.txt with your list of ...


1

I understand the routing table is a "fall through" table Not really. The routing table is ordered from "most specific route" to "least specific route". Your default route is via br0, and is defined as the route of last resort because there is no netmask (i.e. genmask is 0.0.0.0). because the 1st entry is 0.0.0.0 all traffic will go through the tun1 ...


1

OpenVPN doesn't document the exact algorithm it uses to find free addresses in the pool because it's an implementation detail and it doesn't really matter as long as it's a free address. Nevertheless, you can see what algorithm it uses by looking at the function ifconfig_pool_find in pool.c: If in duplicate_cn mode, take the first free address. If the IP ...


1

Hardware network links can be either point to point or point to multipoint. ppp links are point to point, ethernet is point to multipoint. tun can act as either, in your case it is acting as a point to point link. a point to multipoint interface has four addresses associated with it, specifically ip address (the address of the interface), network address, ...


1

By default, OpenVPN does not reconfigure the DNS on non-Windows. You could use a hook (sorry the explanations are in French) in order to do this: #!/bin/sh # Write foreign options to stdout: foreign_options() { local i while true; do local varname=foreign_option_$i local value="$(eval echo \$$varname)" if [ -z "$value" ]; then ...


1

I turned out that I needed to update a second OpenVPN config file to look for auth.dat. Now it works.


1

I've found the problem: my key sizes were way too large. I am now using 2048 bit successfully. Obviously 8192 bits is a bit too much for openvpn


1

I recommend you go though OpenVPN HOWTO, it will get you started in no time, except installing. For install on CentOS I'll do: install EPEL repo with yum install epel-release install openvpn server with yum install openvpn


1

OpenVPN is an ordinary Unix daemon, you can run it just fine from the command line. Extra Packages for Enterprise Linux (EPEL) contains an OpenVPN package you can install. You'll then have to write (or copy over) a config file, certificates, etc.


1

i use the following iptables-rules for forwarding traffic from my ovpn server IPT=$(which iptables) WWW="eth0" ${IPT} -A INPUT -i ${WWW} -p udp --dport 1194 -m state --state NEW -j ACCEPT ${IPT} -A INPUT -i tun0 -j ACCEPT ${IPT} -A FORWARD -i tun0 -o ${WWW} -j ACCEPT ${IPT} -A FORWARD -i ${WWW} -o tun0 -j ACCEPT


1

On your server, net.ipv4.ip_forward=1 isn't enough, it only enables the forwarding code. You still have to tell the kernel (via iptables) what it's allowed to forward, from who, and to where. You should read the Linux IP Masquerade HOWTO. That's if you want to redirect all network traffic through your VPN connection (which is sometimes wanted for security ...


1

Run app1 on the default https port (443) and run app2 on another port (444 - Unless you're using SNPP in which case you'll need to choose another free port). Clone the https.xml file (located in /usr/lib/firewalld/services) to /etc/firewalld/services and rename it to (for example) https-app2.xml. Edit this new file and change the port to 444. Ensure that ...


1

This is a very broad question. I'll try to address a few of these. As installed, logrotate is called daily via a cron type of situation. In Centos 7, you can find the invokation of logrotate under /etc/cron.daily which is invoked via the daily entry (0daily) in a /etc/cron.d file. Of course, you can make changes to run this every hour or make further ...


1

You haven't added your tun0 device to any zone, so it defaults to the default zone, which in your case is the public zone. As root, run: firewall-cmd --zone=internal --add-interface=tun0 You can then leave ssh and https enabled in the internal zone and disable it in the public zone.


1

Gateway of your server (in the 192.168.1.0 network) most likely doesn't know about the existence of the 10.8.0.0 network. Either add a route in the router so it redirects those packets to your server or use NAT on the server for packets coming from the tun interface.



Only top voted, non community-wiki answers of a minimum length are eligible