Hot answers tagged

4

You must check the routing table. With the route command, you can see how you traffic is routed, if there is a line like default 123.456.78.x is likely that your traffic is redirected on the VPN, however if your public ip is your isp it is very likely that the VPN rotate only traffic headed to work. These lines indicate that the traffic with a destination ...


4

I've always had issues with iptables redirections (probably my fault, I'm pretty sure it's doable). But for a case like yours, it's IMO easier to do it in user-land without iptables. Basically, you need to have a daemon in your "default" workspace listening on TCP port 8112 and redirecting all traffic to 10.200.200.2 port 8112. So it's a simple TCP proxy. ...


3

/etc/resolv.conf is built from pieces that are in the directory /run/resolvconf/interface (actual location on current Debian and Ubuntu) /etc/resolvconf/run/interface (old location, still existing via a symbolic link on Debian). Each piece is named after the interface that it is associated with. When they aren't static, the entries in /etc/resolvconf/run/...


3

Allow first your local connection and your RELATED, ESTABLISHED connections protocols. $ sudo iptables -A INPUT -p tcp -s 127.0.0.1 -j ACCEPT $ sudo iptables -A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT $ sudo iptables -A INPUT -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT $ sudo iptables -A INPUT -p icmp -m state --state RELATED,...


3

Using the configuration file with a GUI If you look at the proxpn script, you will see that the command issued is: openvpn --config $OPENVPN_CONF \ --remote $remote $PORT \ --auth-nocache \ --auth-user-pass $AUTH_CREDS If you want to feed the OpenVPN config file to some other tool (like a GUI or a mobile client), you might need to add those extra ...


3

From OpenVPN's man page: --server network netmask ['nopool'] A helper directive designed to simplify the configuration of OpenVPN's server mode. This directive will set up an OpenVPN server which will allocate addresses to clients out of the given network/netmask. The server itself will take the ".1" ...


2

You need to add routing to your server so ssh packets get routed via the server's public ip not the vpn. Failing to do that means the ssh return packet gets routed via openvpn. This is why you get locked out of your server after you've inititated an openvpn client session. Lets assume your server's: Public IP is a.b.c.d Public IP Subnet is a.b.c.0/24 ...


2

Do something like this server=$(cat /etc/openvpn/anonvpn.conf |grep remote|cut -d" " -f2) nextserver=$(grep -A1 $server /etc/openvpn/list.txt|grep -v $server) if [ -z "$nextserver" ]; then nextserver=$(head -n1 /etc/openvpn/list.txt) fi sed -i "s!$server!$nextserver!" /etc/openvpn/anonvpn.conf create the file /etc/openvpn/list.txt with your list of ...


2

You would need policy routing to set up routing tables for each specific traffic. I've found a concise and good example in Linux Advanced Routing Mini HOWTO. Put the following line in /etc/iproute2/rt_tables: 1 DIRECT Then you can do like: iptables -t mangle -A PREROUTING -p tcp --dport 900:999 -j MARK --set-mark 1 ip route add default via <gateway ...


2

As openvpn needs root privileges to set routes or ip addresses for an interface it is very uncommon to run it as a user, if possible at all. But the command not found is a simple PATH topic. Check sudo which openvpn where root calls the binary. Normally openvpn lives in /usr/sbin, a location for daemon programs, that are started as root and possible ...


2

From 'man openvpn': --ping-restart n Similar to --ping-exit, but trigger a SIGUSR1 restart after n seconds pass without reception of a ping or other packet from remote. This option is useful in cases where the remote peer has a dynamic IP address and a low-TTL DNS name is used to track the IP address using a service such as http://dyndns.org/ + a dynamic ...


2

What the issue is So what you want is for the network address transfer to work (NAT). I don't pretend to be an iptables expert, but I can see based on this part of your iptables-save: *nat :PREROUTING ACCEPT [1710:298954] :INPUT ACCEPT [1480:280336] :OUTPUT ACCEPT [28:4162] :POSTROUTING ACCEPT [86:6162] -A PREROUTING -i wlan0 -p tcp -m mark --mark 0x3e7 -...


2

You do not really bind eth0 and tun0 any more than you bind wlan0 and tun0. You actually allow the the packets to pass from one interface to another, by setting ip_forwarding=1, either permanently by changing /etc/sysctl.conf, or temporarily by echo-ing 1 into /proc/sys/kernel/net/ipv4/ip_forward. The only thing that is missing is the change of packet ...


2

The correct way to replace the default gateway is ip route del default via 192.168.144.1 ip route add default via x.y.w.z dev $DEV The reason why I did not include the values you would like to see (10.135.0.2 and tap0) in the previous command is that this is not the correct way to force all traffic thru the VPN. However, you cannot have a correct ...


2

Target context type of the files is still wrong: svirt_sandbox_file_t The files in ~/.cert should be labeled as home_cert_t. Give it a try once more with restorecon -Rf ~/.cert or try to force the type: chcon -t home_cert_t ~/.cert/* It might be possible that there is some bug in selinux-policy or docker selinux policy that causes wrong default ...


2

Shorewall is a tool for configuring iptables/netfilter firewall rules, so the documentation for netfilter is a more effective place to look. It says: It is perfectly legal to specify an interface that currently does not exist; the rule will not match anything until the interface comes up. This is extremely useful for dial-up PPP links (usually interface ...


2

You will need both sets of rules within iptables. The two rulesets ensure that traffic leaving by the specified interfaces is appropriately masqueraded. Here is my suggestion, which is a little simpler than yours: # Masquerade outgoing traffic iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE # Allow ...


1

I've managed to redirect the traffic on my Raspi with the following command: iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o tun0 -j MASQUERADE When I traceroute out of my NAS it goes through the tunnel. Now I only need to forward ports in this tunnel. UPDATE (solving the whole project): I finally found the correct port forwarding commands after ...


1

This applies to a routed network, not bridged (otherwise just configure the DHCP server). You should use the client-config-dir option on the server. You have to supply a directory that has a per-client configuration file. The name of the file should be the same as the name of the certificate (ie. the name of the certificate supplied to easy-rsa). Then you ...


1

The Deluge User Guide has a page about that : Setting up Deluge with VPN. Scripts for a basic torrent-VPN setup can be found on this GitHub repo. The README.md file even has a little something about OpenVPN : To use these scripts with OpenVPN, make a clone of the repo and set the correct values for the interfaces and user in vpn_base.sh. Edit the openvpn ...


1

You cannot specifically target an application so the only solution with no dependencies is to create a iptables configuration that directs all the ports to your VPN. But you have to know what to forward and that is error prone. A better solution would be to use Linux Containers and run your app inside. Then have the container's network card forward all ...


1

I don't understand the second default gateway, this is the default when the vpn is not active, is it simply bypassed? This is one of OpenVPN's hacks to route traffic through your tunnel while maintaining your default gateway. The 0.0.0.0/1 and 128.0.0.0/1 routes take precedence over the 0.0.0.0/0 route and still match all addresses. Search for "def1" in ...


1

I solved problem with changing the network interfaces of pfsense from VIRTIO to E1000. It seems that some packages get lost with Proxmox's VIRTIO drivers.


1

The state extension differentiates the following states for a connection: NEW, ESTABLISHED, RELATED, INVALID, plus three others which are rarely used. A packet is only NEW if, informally speaking, server and client haven't been communicating in any way. After that, a packet usually belongs to an ESTABLISHED connection or is RELATED to one. This means that ...


1

You overwrite the one possible path to your real gateway: default via 10.89.0.153 dev tun0 proto static metric 50 which has higher priority than your real default route, and 192.168.1.0/24 via 10.89.0.153 dev tun0 proto static metric 50 which is useless and possibly harmful for your setup. Both these routes redefine 192.168.1.1 to go through tun0 ...


1

You get locked out of your vps because once the vpn service is up, your ssh packets get routed via the vpn not your vps's public IP 50.2.1.3. Lets assume your server's: Public IP is 50.1.2.3 (as per your example setup) Public IP Subnet is 50.1.2.0/24 Default Gateway is x.x.x.1 eth0 is device to gateway Do the following using iproute2: ip rule add table ...


1

You may want to enable forwarding: echo 1 >/proc/sys/net/ipv4/conf/all/forwarding Also, your tunneled IPs (here 10.0.0.0/8) are likely to be private, so do NAT/MASQUERADING: iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE


1

Systemd is an "init system" for Linux -- this is the first process started by the kernel when the system boots, and it is responsible for starting everything else. Your system already had an init process on it, so installing and using systemd isn't necessary to do what you want. The error you're seeing suggests that systemd isn't actually running, which ...


1

I don't believe that there's any specific command to do a syntax check, but you can run openvpn in the foreground, which should show the specific error: openvpn --config /path/to/server.conf


1

The correct way to do this is to have two ranges of IP addresses: one (/64) range for the interconnection between the OpenVPN server and the OpenVPN clients (let's say 2001:DB8:0:1::/64); one (/56) range that you will subnet into /64 prefixes that you will delegate to the client (let's say 2001:DB8:0:ff00::/56). For a given client, you can use this ...



Only top voted, non community-wiki answers of a minimum length are eligible