Hot answers tagged

5

Historically in IPv4, unnumbered interfaces were not possible. The only possible way to configured a point-to-point interface was with a local address and a remote address. The only way to route some other IP address through the point-to-point interface in question was to install a route using the interface's remote address as the gateway (there was no ...


5

I try to start it via normal service call:# service openvpn start work No, that's not normal. That's a quirk of System 5 rc toolsets that invokes a System 5 rc script with two arguments. The rc script takes the non-standard second argument as the basename of the OpenVPN configuration to use. This is Ubuntu Linux. You aren't using System 5 rc. You ...


4

You must check the routing table. With the route command, you can see how you traffic is routed, if there is a line like default 123.456.78.x is likely that your traffic is redirected on the VPN, however if your public ip is your isp it is very likely that the VPN rotate only traffic headed to work. These lines indicate that the traffic with a destination ...


3

You should use the same CA and make sure it's secured (as anyone compromising it would be able to issue certificates for it and perform a MITM attack). You might consider putting a machine offline and using it for this purpose only. As long as it's for internal use only, a self-signed cert will work fine. Remember that you'll have to install the CA root ...


3

You can check the MAC of the client only if the client is on the same network segment, i.e. if there's no router in between (a switch is ok). You can see that with traceroute: if you run traceroute 192.0.2.1 from the server where 192.0.2.1 is the address of one of the devices, it must report only a single hop, the destination. Nasha's and yaegashi's answers ...


3

As I have said before: I'm guessing I'm missing something new with how systemd controls the service. Yes, and it is explained in the commentary at the top of /lib/systemd/system/openvpn.service. You, as the other questioner did, are calling a System 5 rc script directly. Do not call System 5 rc scripts directly, especially on a system where System 5 ...


3

Using the configuration file with a GUI If you look at the proxpn script, you will see that the command issued is: openvpn --config $OPENVPN_CONF \ --remote $remote $PORT \ --auth-nocache \ --auth-user-pass $AUTH_CREDS If you want to feed the OpenVPN config file to some other tool (like a GUI or a mobile client), you might need to add those extra ...


3

Allow first your local connection and your RELATED, ESTABLISHED connections protocols. $ sudo iptables -A INPUT -p tcp -s 127.0.0.1 -j ACCEPT $ sudo iptables -A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT $ sudo iptables -A INPUT -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT $ sudo iptables -A INPUT -p icmp -m state --state ...


2

You could modify the zone and add a Rich Rule which blocks all ssh traffic other than from a certain range - the Employee subnet. Find which zone your tun interface is in by listing all zones: firewall-cmd --list-all-zones | less In the output you should see something similar to: internal (active) interfaces: tun0 sources: services: dhcpv6-client ...


2

Encryption prevents your data from being read. But someone could still modify them; they won't know exactly what changes they're making (due to the encryption), but depending on what you're running over the link, that could be quite catastrophic to the application. Note that traffic analysis (looking at the size and timing of packets) can often give an ...


2

With very few exceptions, if somebody has your hardware in their hands, they can duplicate everything, simply by accessing and copying the whole storage. There's no extra encryption that would help. If you encrypt the disk, the disk encryption key has to be readable somewhere. Disk encryption is useless in your scenario. There is hardware that can't be ...


2

Is your server a Linux host? If you have a white list of your clients, you can use iptables to accept requests only from them on specific input ports. You can also log requests from bad clients in dmesg. The following script defines MACCHECK chain to accept packets from approved 3 MACs, and drop others with logging. Then routes all packets of tcp/80 or ...


2

If there's a direct connection between your Raspberry Pi and the client, i.e. there's no routing and both are in the same segment, it's possible. Just use an ARP resolution, e.g. : arp <client_ip_address>.


2

For the message "Address already in use", I think it's because https listen also on TCP port 443.


2

You would need policy routing to set up routing tables for each specific traffic. I've found a concise and good example in Linux Advanced Routing Mini HOWTO. Put the following line in /etc/iproute2/rt_tables: 1 DIRECT Then you can do like: iptables -t mangle -A PREROUTING -p tcp --dport 900:999 -j MARK --set-mark 1 ip route add default via <gateway ...


2

Do something like this server=$(cat /etc/openvpn/anonvpn.conf |grep remote|cut -d" " -f2) nextserver=$(grep -A1 $server /etc/openvpn/list.txt|grep -v $server) if [ -z "$nextserver" ]; then nextserver=$(head -n1 /etc/openvpn/list.txt) fi sed -i "s!$server!$nextserver!" /etc/openvpn/anonvpn.conf create the file /etc/openvpn/list.txt with your list of ...


2

From 'man openvpn': --ping-restart n Similar to --ping-exit, but trigger a SIGUSR1 restart after n seconds pass without reception of a ping or other packet from remote. This option is useful in cases where the remote peer has a dynamic IP address and a low-TTL DNS name is used to track the IP address using a service such as http://dyndns.org/ + a dynamic ...


2

You do not really bind eth0 and tun0 any more than you bind wlan0 and tun0. You actually allow the the packets to pass from one interface to another, by setting ip_forwarding=1, either permanently by changing /etc/sysctl.conf, or temporarily by echo-ing 1 into /proc/sys/kernel/net/ipv4/ip_forward. The only thing that is missing is the change of packet ...


2

What the issue is So what you want is for the network address transfer to work (NAT). I don't pretend to be an iptables expert, but I can see based on this part of your iptables-save: *nat :PREROUTING ACCEPT [1710:298954] :INPUT ACCEPT [1480:280336] :OUTPUT ACCEPT [28:4162] :POSTROUTING ACCEPT [86:6162] -A PREROUTING -i wlan0 -p tcp -m mark --mark 0x3e7 ...


2

The correct way to replace the default gateway is ip route del default via 192.168.144.1 ip route add default via x.y.w.z dev $DEV The reason why I did not include the values you would like to see (10.135.0.2 and tap0) in the previous command is that this is not the correct way to force all traffic thru the VPN. However, you cannot have a correct ...


2

I've always had issues with iptables redirections (probably my fault, I'm pretty sure it's doable). But for a case like yours, it's IMO easier to do it in user-land without iptables. Basically, you need to have a daemon in your "default" workspace listening on TCP port 8112 and redirecting all traffic to 10.200.200.2 port 8112. So it's a simple TCP proxy. ...


1

The problem here is that although clients of A (let's call them X, Y, Z) can route to B via your VPN link, there is no route from B back to clients X, Y, Z. Without specifics it's tricky to provide an exact solution. Consider this example, though: Your clients are in subnet 192.168.1.0/24 Server A has its end of the OpenVPN link as 192.168.2.1 Server B ...


1

You haven't added your tun0 device to any zone, so it defaults to the default zone, which in your case is the public zone. As root, run: firewall-cmd --zone=internal --add-interface=tun0 You can then leave ssh and https enabled in the internal zone and disable it in the public zone.


1

I understand the routing table is a "fall through" table Not really. The routing table is ordered from "most specific route" to "least specific route". Your default route is via br0, and is defined as the route of last resort because there is no netmask (i.e. genmask is 0.0.0.0). because the 1st entry is 0.0.0.0 all traffic will go through the tun1 ...


1

OpenVPN doesn't document the exact algorithm it uses to find free addresses in the pool because it's an implementation detail and it doesn't really matter as long as it's a free address. Nevertheless, you can see what algorithm it uses by looking at the function ifconfig_pool_find in pool.c: If in duplicate_cn mode, take the first free address. If the IP ...


1

Hardware network links can be either point to point or point to multipoint. ppp links are point to point, ethernet is point to multipoint. tun can act as either, in your case it is acting as a point to point link. a point to multipoint interface has four addresses associated with it, specifically ip address (the address of the interface), network address, ...


1

By default, OpenVPN does not reconfigure the DNS on non-Windows. You could use a hook (sorry the explanations are in French) in order to do this: #!/bin/sh # Write foreign options to stdout: foreign_options() { local i while true; do local varname=foreign_option_$i local value="$(eval echo \$$varname)" if [ -z "$value" ]; then ...


1

I turned out that I needed to update a second OpenVPN config file to look for auth.dat. Now it works.


1

I've found the problem: my key sizes were way too large. I am now using 2048 bit successfully. Obviously 8192 bits is a bit too much for openvpn


1

I recommend you go though OpenVPN HOWTO, it will get you started in no time, except installing. For install on CentOS I'll do: install EPEL repo with yum install epel-release install openvpn server with yum install openvpn



Only top voted, non community-wiki answers of a minimum length are eligible