Tag Info

Hot answers tagged

5

You have the symptoms of an MTU problem: some TCP connections freeze, more or less reproducibly for a given command or URL but with no easily discernible overall pattern. A telltale symptom is that interactive ssh sessions work well as long as you don't run commands with large output. See Can't access select https sites on Linux over PPPoE for an ...


3

Those are the IP addresses of the local and remote tunnel endpoints (in that order). They're used for routing (and of course the local one is a local IP address, just like on any other interface). You could use public IPs, but its a waste of IP addresses in most cases—you can use internal (RFC1918) addresses even if you're routing a public subnet over the ...


3

You need to tell your router to use your server for this VPN subnet: the correct solution to your problem is to add a route on the router for the OpenVPN subnet. If you can't do this because you can't touch the router, another solution is to setup a NDP proxy for the clients on the eth0 link. As you're using a VPS you probably can't add routes to the ...


2

Before you start your VPN take a copy of netstat -rn and ifconfig -a. Start your VPN, and the differences in those two commands will tell you what networks the VPN creates in terms of routes, and what IP you've been assigned to gain visibility of those networks. You will also need to get the IP of the server providing your VPN (or traffic to the VPN server ...


2

I came across this issue as well. The solution I found was: Enable the EPEL repo (by default in Amazon Linux AMI it's disabled). Install easy-rsa with: yum install easy-rsa -y


2

You could simply synchronize the time using ntp right before your are starting the connection, e.g. by using a little script to connect to the VPN: #!/bin/sh ntpdate ntp.example.com openvpn --config myvpn.conf


2

How about workaround to logging into syslog? See usage --daemon [progname] (or --syslog [progname]) in man openvpn (http://openvpn.net/index.php/open-source/documentation/manuals/65-openvpn-20x-manpage.html)


2

Gilles' answer is completely correct, but there is also another potential cause for this. There was a bug in version 2.3.0 of OpenVPN which would disconnect clients when sending large chunks of data: https://community.openvpn.net/openvpn/ticket/263 This issue only occurred when using TCP. UDP was completely unaffected.


2

This one is the fatal error: Cannot load CA certificate file /home/mak/Downloads/ca.key There are a couple reasons that it may not be able to load the key: Permissions are wrong. Check to make sure the file is readable File doesn't exist. Confirm the path & name is correct. File is in the wrong format, or is not a CA certificate. Try openssl x509 ...


2

You shouldn't need to set the ip_forward = 1 unless the interface is acting as a NAT for the other devices, which shouldn't be the case if you've set them up as a bridge. Example Here's my KVM server setup which has a bridge device, br0, with the physical ethernet device, eth0 + all the interfaces for the KVM guests. $ brctl show bridge name bridge id ...


1

The LSB headers at the top of scripts in /etc/init.d/ define a bit more about the program and what they depend on. It looks like there's no LSB headers in the denyhosts init script. You could try to update (apt-get update) and then reinstall the package (apt-get install --reinstall denyhosts) but changes are you'll get the same (incorrect) script back. Try ...


1

If I read your question as 'I am remotely configuring my server to which I am logged in using scp', then here are a few guidelines on how to set up openvpn on that server (and your client): To start the OpenVPN listening service automatically on the server make sure you have a valid .conf file in the /etc/openvpn/ directory. When the openvpn service starts ...


1

Do I understand correctly? You want to establish a VPN connection as soon as you log in? There's a pam-module that sounds promising: pam-openvpn is a Linux PAM-module which works together with OpenVPN. With this pam-module it is possible to establish VPN connections when a user logs into a system and tear down the connection when the user logs ...


1

Normally it should work, but since the version of OpenVPN client on Fedora 4 is pretty old you might encounter some inconsistencies regarding option names and usage. Yes scp can used to copy openvpn client configs and certificates to the new Fedora 19 client.


1

The whole setup is too long to be described here, also there are multiple ways how you might want to configure it, so to provide an overview: You need to setup OpenVPN server. I would advice to do it on a VPS with external IP. Setup OpenVPN clients on other servers and android devices to connect to your OpenVPN server. You can find quick ...


1

I don't have the full output pre-grep because my scrollbuffer filled up, but: # ip addr show dev eth0 |grep 192.168.[12] inet 192.168.1.1/16 scope global eth0 inet 192.168.1.2/16 scope global secondary eth0 inet 192.168.1.3/16 scope global secondary eth0 inet 192.168.1.4/16 scope global secondary eth0 inet 192.168.1.5/16 scope global secondary eth0 ... ...


1

You can install the openVpn Manager and do it from there i believe sudo apt-get install network-manager-openvpn-gnome You should get the openvpn option in the network-manager GUI menu


1

You need a different port on the VPN server, e.g. 23. Connections to that port get forwarded over the VPN by iptables: iptables -t nat -A \ PREROUTING -p tcp --dport 23 -j DNAT --to-destination 10.8.0.6:22 iptables -t nat -A \ POSTROUTING -o tun0 -m conntrack --ctstate DNAT -j SNAT --to-source 10.8.0.1 Forwarding must be allowed on the VPN server ...


1

It's not even possible. Ethernet interfaces have a link layer (MAC address), tun interfaces don't. You can bridge Ethernet to tap interfaces. Apart from that: What is the purpose of a VPN? Usually it is to separate legitimate communication partners from the rest. What is the point if someone just needs to connect to the LAN in order to get privileged ...


1

You can also use racoon, if cert is used for authentication. Configuration /etc/racoon/racoon.conf # Racoon IKE daemon configuration file. # See 'man racoon.conf' for a description of the format and entries. path include "/etc/racoon"; path pre_shared_key "/etc/racoon/psk.txt"; path certificate "/etc/racoon/certs"; path script "/etc/racoon/scripts"; sainfo ...


1

That's actually the best error message I've seen. It tells you exactly what's wrong and how to fix it. I don't see any kind of problem if you really want to allow openvpn use port 1194. BTW, to make errors in english you can use LANG=C before the commands (not sure if you can with auth.log).


1

Your client has to accept the ca-chain of your server. So if you are using a selv made certificate that is the way to go. Update: Further reading about ca-chains and root-CAs.


1

The problem is SELinux, editing /etc/sysconfig/selinux and setting SELINUX=permissive and then rebooting fixed it for me. I remember in fedora that there was a command that had to be run to allow the cert directory to be used properly, but I forget what that command is. Setting to permissive fixes completely but a more preferred way would be to fix it so ...


1

I found several: CentOS 6 How to Setup and Configure an OpenVPN Server on CentOS 6 How to Build OpenVPN Server on CentOS 6.x OpenVPN Community Wiki and Tracker - RHEL6 How to create a OpenVPN VPN Server on CentOS 6 64bit. Secure Communications with OpenVPN on CentOS 6 CentOS 5 OpenVPN Server On CentOS 5.2


1

Do this command to track those files down when an RPM is installed: $ rpm -ql openvpn and see where those files might actually be. For packages that haven't been installed yet you can query the yum repository using the command repoquery: $ repoquery -l openvpn Different distros put files in different locations. Though on my Fedora system the ...


1

it's hard to tell without more information... anyhow, you have either not properly configured your installation via the vars file or you haven't activated the vars file by running source vars prior to running ./build-ca the vars file contains (among other things) the definition of the KEY_CONFIG variable. the default (on my Debian system) is to call a ...


1

push route "10.10.10.0 255.255.255.0 10.0.0.2 1" From the openvpn man page: --route network/IP [netmask] [gateway] [metric] This tells the server config to "push" to the client, the route command which sets a nwtworking route of the 10.10.10.0/24 subnet via the gateway 10.0.0.2 with a metric of 1. Metrics are used to give "preference" if multiple routes ...


1

I had the same problem and could solve it by removing the line "local xxx.xxx.xxx.xxx." out of the server.conf. via


1

The error line: Thu Aug 29 12:02:46 2013 us=870025 MANAGEMENT: Socket bind failed on local address [AF_INET]xxxxx:1194: Cannot assign requested address is your clue to the problem. I would imagine there is some process already listening on port 1194. You can check that with a netstat -pnta and see if 1194 is listed as a state LISTEN proces: Active ...


1

You can configure OpenVPN not to exit when the connection goes down, and instead to reconnect (e.g., ping-restart instead of ping-exit). Also make sure you don't have things like inactive (exit on inactivity), or single-session. You can also configure OpenVPN to keep the tunnel around, so traffic will potentially be sent insecurely with persist-tun. In ...



Only top voted, non community-wiki answers of a minimum length are eligible