Tag Info

Hot answers tagged

5

You have the symptoms of an MTU problem: some TCP connections freeze, more or less reproducibly for a given command or URL but with no easily discernible overall pattern. A telltale symptom is that interactive ssh sessions work well as long as you don't run commands with large output. See Can't access select https sites on Linux over PPPoE for an ...


4

You need to tell your router to use your server for this VPN subnet: the correct solution to your problem is to add a route on the router for the OpenVPN subnet. If you can't do this because you can't touch the router, another solution is to setup a NDP proxy for the clients on the eth0 link. As you're using a VPS you probably can't add routes to the ...


3

Those are the IP addresses of the local and remote tunnel endpoints (in that order). They're used for routing (and of course the local one is a local IP address, just like on any other interface). You could use public IPs, but its a waste of IP addresses in most cases—you can use internal (RFC1918) addresses even if you're routing a public subnet over the ...


3

You might want to run fixfiles -R openvpn restore An ls -alZ should give you something like this (showing your files are in the correct selinux context now): [root@server openvpn]# ls -alZ /etc/openvpn/ drwxr-xr-x. root root system_u:object_r:openvpn_etc_t:s0 . drwxr-xr-x. root root system_u:object_r:etc_t:s0 .. drwxr-xr-x. root root ...


2

I had the same problem and could solve it by removing the line "local xxx.xxx.xxx.xxx." out of the server.conf. via


2

I came across this issue as well. The solution I found was: Enable the EPEL repo (by default in Amazon Linux AMI it's disabled). Install easy-rsa with: yum install easy-rsa -y


2

You could simply synchronize the time using ntp right before your are starting the connection, e.g. by using a little script to connect to the VPN: #!/bin/sh ntpdate ntp.example.com openvpn --config myvpn.conf


2

Gilles' answer is completely correct, but there is also another potential cause for this. There was a bug in version 2.3.0 of OpenVPN which would disconnect clients when sending large chunks of data: https://community.openvpn.net/openvpn/ticket/263 This issue only occurred when using TCP. UDP was completely unaffected.


2

This one is the fatal error: Cannot load CA certificate file /home/mak/Downloads/ca.key There are a couple reasons that it may not be able to load the key: Permissions are wrong. Check to make sure the file is readable File doesn't exist. Confirm the path & name is correct. File is in the wrong format, or is not a CA certificate. Try openssl x509 ...


2

You shouldn't need to set the ip_forward = 1 unless the interface is acting as a NAT for the other devices, which shouldn't be the case if you've set them up as a bridge. Example Here's my KVM server setup which has a bridge device, br0, with the physical ethernet device, eth0 + all the interfaces for the KVM guests. $ brctl show bridge name bridge id ...


2

I don't know about pfSense, but from the OpenVPN perspective the line of interest here is Options error: --server directive network/netmask combination is invalid This means that you've specified a VPN network address and netmask that do not combine. OpenVPN checks the network address to have zeroes where the netmask expects zeroes. E.g. 192.168.1.0 + ...


2

I think the Debian OpenVPN setup with systemd is currently a tad bit broken. To get it to work on my machines I had to: Create /etc/systemd/system/openvpn@.service.d (the directory), and place in it a new file with this:[Unit] Requires=networking.service After=networking.serviceI called my file local-after-ifup.conf. It needs to end with .conf. (This is ...


2

Use the firewall-cmd command. Assuming you're opening the firewall up to OpenVPN on the default zone, carry out the following commands. If you are running it on a non-default zone, then add --zone=<zone> to the commands. First, list what's currently open: # firewall-cmd --list-services http https ssh Next, add the openvpn service: # firewall-cmd ...


1

This type of unit file is an Instantiated Service - more details are available here The following is the unit file for openvpn on CentOS 7: [Unit] Description=OpenVPN Robust And Highly Flexible Tunneling Application On %I After=syslog.target network.target [Service] PrivateTmp=true Type=forking PIDFile=/var/run/openvpn/%i.pid ExecStart=/usr/sbin/openvpn ...


1

https://forums.openvpn.net/topic10575.html http://openvpn.net/archive/openvpn-users/2007-02/msg00183.html http://openvpn.net/archive/openvpn-users/2005-11/msg00258.html https://groups.google.com/forum/#!topic/tunnelblick-discuss/7lGWKR1-rC4 http://comments.gmane.org/gmane.network.openvpn.user/30934 ...


1

To me it looks like a simple login script that immediately connects to another box. Something like: ~$ cat .bash_profile clear telnet <the-other-box> Not sure why you mention OpenVPN. It doesn't look like OpenVPN is involved here...


1

The whole setup is too long to be described here, also there are multiple ways how you might want to configure it, so to provide an overview: You need to setup OpenVPN server. I would advice to do it on a VPS with external IP. Setup OpenVPN clients on other servers and android devices to connect to your OpenVPN server. You can find quick ...


1

The LSB headers at the top of scripts in /etc/init.d/ define a bit more about the program and what they depend on. It looks like there's no LSB headers in the denyhosts init script. You could try to update (apt-get update) and then reinstall the package (apt-get install --reinstall denyhosts) but changes are you'll get the same (incorrect) script back. Try ...


1

If I read your question as 'I am remotely configuring my server to which I am logged in using scp', then here are a few guidelines on how to set up openvpn on that server (and your client): To start the OpenVPN listening service automatically on the server make sure you have a valid .conf file in the /etc/openvpn/ directory. When the openvpn service starts ...


1

Do I understand correctly? You want to establish a VPN connection as soon as you log in? There's a pam-module that sounds promising: pam-openvpn is a Linux PAM-module which works together with OpenVPN. With this pam-module it is possible to establish VPN connections when a user logs into a system and tear down the connection when the user logs ...


1

Normally it should work, but since the version of OpenVPN client on Fedora 4 is pretty old you might encounter some inconsistencies regarding option names and usage. Yes scp can used to copy openvpn client configs and certificates to the new Fedora 19 client.


1

It's not even possible. Ethernet interfaces have a link layer (MAC address), tun interfaces don't. You can bridge Ethernet to tap interfaces. Apart from that: What is the purpose of a VPN? Usually it is to separate legitimate communication partners from the rest. What is the point if someone just needs to connect to the LAN in order to get privileged ...


1

I cannot say if VPNC will or won't work with Checkpoint, and in the past when I've attempted to use VPNC with Aventail/Nortel it did not work for me, so I reverted to using the native client software that was included by Aventail/Nortel on Fedora/CentOS/Ubuntu systems. I cover some of this at a highlevel on my blog in this article titled: Setting up Aventail ...


1

I don't have the full output pre-grep because my scrollbuffer filled up, but: # ip addr show dev eth0 |grep 192.168.[12] inet 192.168.1.1/16 scope global eth0 inet 192.168.1.2/16 scope global secondary eth0 inet 192.168.1.3/16 scope global secondary eth0 inet 192.168.1.4/16 scope global secondary eth0 inet 192.168.1.5/16 scope global secondary eth0 ... ...


1

You can install the openVpn Manager and do it from there i believe sudo apt-get install network-manager-openvpn-gnome You should get the openvpn option in the network-manager GUI menu


1

You need a different port on the VPN server, e.g. 23. Connections to that port get forwarded over the VPN by iptables: iptables -t nat -A \ PREROUTING -p tcp --dport 23 -j DNAT --to-destination 10.8.0.6:22 iptables -t nat -A \ POSTROUTING -o tun0 -m conntrack --ctstate DNAT -j SNAT --to-source 10.8.0.1 Forwarding must be allowed on the VPN server ...


1

That's actually the best error message I've seen. It tells you exactly what's wrong and how to fix it. I don't see any kind of problem if you really want to allow openvpn use port 1194. BTW, to make errors in english you can use LANG=C before the commands (not sure if you can with auth.log).


1

I've found this Github-Repo and now it works :-) https://github.com/masterkorp/openvpn-update-resolv-conf when I add this to my openvpn-client config # This updates the resolvconf with dns settings script-security 2 up /etc/openvpn/update-resolv-conf.sh down /etc/openvpn/update-resolv-conf.sh


1

Your client has to accept the ca-chain of your server. So if you are using a selv made certificate that is the way to go. Update: Further reading about ca-chains and root-CAs.


1

push route "10.10.10.0 255.255.255.0 10.0.0.2 1" From the openvpn man page: --route network/IP [netmask] [gateway] [metric] This tells the server config to "push" to the client, the route command which sets a nwtworking route of the 10.10.10.0/24 subnet via the gateway 10.0.0.2 with a metric of 1. Metrics are used to give "preference" if multiple routes ...



Only top voted, non community-wiki answers of a minimum length are eligible