Tag Info

Hot answers tagged

5

You have the symptoms of an MTU problem: some TCP connections freeze, more or less reproducibly for a given command or URL but with no easily discernible overall pattern. A telltale symptom is that interactive ssh sessions work well as long as you don't run commands with large output. See Can't access select https sites on Linux over PPPoE for an ...


4

You need to tell your router to use your server for this VPN subnet: the correct solution to your problem is to add a route on the router for the OpenVPN subnet. If you can't do this because you can't touch the router, another solution is to setup a NDP proxy for the clients on the eth0 link. As you're using a VPS you probably can't add routes to the ...


3

Use the firewall-cmd command. Assuming you're opening the firewall up to OpenVPN on the default zone, carry out the following commands. If you are running it on a non-default zone, then add --zone=<zone> to the commands. First, list what's currently open: # firewall-cmd --list-services http https ssh Next, add the openvpn service: # firewall-cmd ...


3

I don't know about pfSense, but from the OpenVPN perspective the line of interest here is Options error: --server directive network/netmask combination is invalid This means that you've specified a VPN network address and netmask that do not combine. OpenVPN checks the network address to have zeroes where the netmask expects zeroes. E.g. 192.168.1.0 + ...


3

You might want to run fixfiles -R openvpn restore An ls -alZ should give you something like this (showing your files are in the correct selinux context now): [root@server openvpn]# ls -alZ /etc/openvpn/ drwxr-xr-x. root root system_u:object_r:openvpn_etc_t:s0 . drwxr-xr-x. root root system_u:object_r:etc_t:s0 .. drwxr-xr-x. root root ...


2

push route "10.10.10.0 255.255.255.0 10.0.0.2 1" From the openvpn man page: --route network/IP [netmask] [gateway] [metric] This tells the server config to "push" to the client, the route command which sets a nwtworking route of the 10.10.10.0/24 subnet via the gateway 10.0.0.2 with a metric of 1. Metrics are used to give "preference" if multiple routes ...


2

You shouldn't need to set the ip_forward = 1 unless the interface is acting as a NAT for the other devices, which shouldn't be the case if you've set them up as a bridge. Example Here's my KVM server setup which has a bridge device, br0, with the physical ethernet device, eth0 + all the interfaces for the KVM guests. $ brctl show bridge name bridge id ...


2

I think the Debian OpenVPN setup with systemd is currently a tad bit broken. To get it to work on my machines I had to: Create /etc/systemd/system/openvpn@.service.d (the directory), and place in it a new file with this:[Unit] Requires=networking.service After=networking.serviceI called my file local-after-ifup.conf. It needs to end with .conf. (This is ...


2

Gilles' answer is completely correct, but there is also another potential cause for this. There was a bug in version 2.3.0 of OpenVPN which would disconnect clients when sending large chunks of data: https://community.openvpn.net/openvpn/ticket/263 This issue only occurred when using TCP. UDP was completely unaffected.


2

SELinux is disallowing the openvpn executable from accessing files on the filesystem in a specific location. Your best friend for dealing with these is to use the SELinux troubleshooter GUI. $ sealert -b     You'll then want to follow the advice to add the necessary contexts to your filesystem to appease SELinux.      ...


2

You could modify the zone and add a Rich Rule which blocks all ssh traffic other than from a certain range - the Employee subnet. Find which zone your tun interface is in by listing all zones: firewall-cmd --list-all-zones | less In the output you should see something similar to: internal (active) interfaces: tun0 sources: services: dhcpv6-client ...


1

I'm not 100% sure about whether or not storing the username/password combination in a variable will work - it definitely won't if your sudo configuration requires a password, but at the least you can implement a loop similar to what's below. If storing the username/password in the variable does work, you won't need to write a file with your credentials at ...


1

Nope, it's not enough to ACCEPT traffic on tun interface. You will also need to open 1194/udp port in INPUT chain. -A INPUT -i wlp3s0 -j ACCEPT -m udp -p udp --dport 1194 -m state --state NEW -j ACCEPT You should also setup a default policy for INPUT chain to DROP. Now you allow all incoming connections! *filter :INPUT DROP [323:24107] HTH


1

There's two parts to this answer, since an OpenVPN connection consists of two parts. Part 1 is the control channel, this is a TLS connection over which OpenVPN sends control messages and keys for the second part; the data channel. The data channel is where the actual network packets are transferred over. For the TLS control channel, support for GCM is ...


1

From what I know, you can't implement every feature you require without custom / commercial products to lock down everything. Here are some thoughts to keep in mind while elaborating on how to meet the required critera: Typical VPN-solutions add routes. For routes to be added, the user needs to have administrative rights on the client computer. This isn't ...


1

You can use the resolv.conf.head and resolv.conf.tail files to add lines before and after the content generated by resolvconf


1

Gateway of your server (in the 192.168.1.0 network) most likely doesn't know about the existence of the 10.8.0.0 network. Either add a route in the router so it redirects those packets to your server or use NAT on the server for packets coming from the tun interface.


1

I assume that you want: one specific secondary VPN server to become the default gateway for a given client. If this is so, that can be done using route push. You already know that you can tell the client the address of its "new" gateway after the OpenVPN connection has gone up. Well, you can do so dynamically. From the manual: --client-connect ...


1

It turns out that you can put a tunnel interface into a network namespace. My entire problem was down to a mistake in bringing up the interface: ip addr add dev $tun_tundv \ local $ifconfig_local/$ifconfig_cidr \ broadcast $ifconfig_broadcast \ scope link The problem is "scope link", which I misunderstood as only affecting routing. It causes ...


1

This type of unit file is an Instantiated Service - more details are available here The following is the unit file for openvpn on CentOS 7: [Unit] Description=OpenVPN Robust And Highly Flexible Tunneling Application On %I After=syslog.target network.target [Service] PrivateTmp=true Type=forking PIDFile=/var/run/openvpn/%i.pid ExecStart=/usr/sbin/openvpn ...


1

https://forums.openvpn.net/topic10575.html http://openvpn.net/archive/openvpn-users/2007-02/msg00183.html http://openvpn.net/archive/openvpn-users/2005-11/msg00258.html https://groups.google.com/forum/#!topic/tunnelblick-discuss/7lGWKR1-rC4 http://comments.gmane.org/gmane.network.openvpn.user/30934 ...


1

To me it looks like a simple login script that immediately connects to another box. Something like: ~$ cat .bash_profile clear telnet <the-other-box> Not sure why you mention OpenVPN. It doesn't look like OpenVPN is involved here...


1

The LSB headers at the top of scripts in /etc/init.d/ define a bit more about the program and what they depend on. It looks like there's no LSB headers in the denyhosts init script. You could try to update (apt-get update) and then reinstall the package (apt-get install --reinstall denyhosts) but changes are you'll get the same (incorrect) script back. Try ...


1

If I read your question as 'I am remotely configuring my server to which I am logged in using scp', then here are a few guidelines on how to set up openvpn on that server (and your client): To start the OpenVPN listening service automatically on the server make sure you have a valid .conf file in the /etc/openvpn/ directory. When the openvpn service starts ...


1

Do I understand correctly? You want to establish a VPN connection as soon as you log in? There's a pam-module that sounds promising: pam-openvpn is a Linux PAM-module which works together with OpenVPN. With this pam-module it is possible to establish VPN connections when a user logs into a system and tear down the connection when the user logs ...


1

Normally it should work, but since the version of OpenVPN client on Fedora 4 is pretty old you might encounter some inconsistencies regarding option names and usage. Yes scp can used to copy openvpn client configs and certificates to the new Fedora 19 client.


1

The whole setup is too long to be described here, also there are multiple ways how you might want to configure it, so to provide an overview: You need to setup OpenVPN server. I would advice to do it on a VPS with external IP. Setup OpenVPN clients on other servers and android devices to connect to your OpenVPN server. You can find quick ...


1

From the Red Hat article in the comments the solution says This is expected behaviour. Not very helpful but it also points out the reason it happens. It references commit a17c2153d2e271b0cbacae9bed83b0eaa41db7e1 in the sunrpc package that moves where nfs authentication takes place. I won't copy/paste the entire commit but it mostly changes these ...


1

I cannot say if VPNC will or won't work with Checkpoint, and in the past when I've attempted to use VPNC with Aventail/Nortel it did not work for me, so I reverted to using the native client software that was included by Aventail/Nortel on Fedora/CentOS/Ubuntu systems. I cover some of this at a highlevel on my blog in this article titled: Setting up Aventail ...


1

I don't have the full output pre-grep because my scrollbuffer filled up, but: # ip addr show dev eth0 |grep 192.168.[12] inet 192.168.1.1/16 scope global eth0 inet 192.168.1.2/16 scope global secondary eth0 inet 192.168.1.3/16 scope global secondary eth0 inet 192.168.1.4/16 scope global secondary eth0 inet 192.168.1.5/16 scope global secondary eth0 ... ...



Only top voted, non community-wiki answers of a minimum length are eligible