Hot answers tagged

5

I try to start it via normal service call:# service openvpn start work No, that's not normal. That's a quirk of System 5 rc toolsets that invokes a System 5 rc script with two arguments. The rc script takes the non-standard second argument as the basename of the OpenVPN configuration to use. This is Ubuntu Linux. You aren't using System 5 rc. You ...


4

You must check the routing table. With the route command, you can see how you traffic is routed, if there is a line like default 123.456.78.x is likely that your traffic is redirected on the VPN, however if your public ip is your isp it is very likely that the VPN rotate only traffic headed to work. These lines indicate that the traffic with a destination ...


3

Using the configuration file with a GUI If you look at the proxpn script, you will see that the command issued is: openvpn --config $OPENVPN_CONF \ --remote $remote $PORT \ --auth-nocache \ --auth-user-pass $AUTH_CREDS If you want to feed the OpenVPN config file to some other tool (like a GUI or a mobile client), you might need to add those extra ...


3

I've always had issues with iptables redirections (probably my fault, I'm pretty sure it's doable). But for a case like yours, it's IMO easier to do it in user-land without iptables. Basically, you need to have a daemon in your "default" workspace listening on TCP port 8112 and redirecting all traffic to 10.200.200.2 port 8112. So it's a simple TCP proxy. ...


3

Allow first your local connection and your RELATED, ESTABLISHED connections protocols. $ sudo iptables -A INPUT -p tcp -s 127.0.0.1 -j ACCEPT $ sudo iptables -A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT $ sudo iptables -A INPUT -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT $ sudo iptables -A INPUT -p icmp -m state --state ...


3

You should use the same CA and make sure it's secured (as anyone compromising it would be able to issue certificates for it and perform a MITM attack). You might consider putting a machine offline and using it for this purpose only. As long as it's for internal use only, a self-signed cert will work fine. Remember that you'll have to install the CA root ...


3

You can check the MAC of the client only if the client is on the same network segment, i.e. if there's no router in between (a switch is ok). You can see that with traceroute: if you run traceroute 192.0.2.1 from the server where 192.0.2.1 is the address of one of the devices, it must report only a single hop, the destination. Nasha's and yaegashi's answers ...


3

/etc/resolv.conf is built from pieces that are in the directory /run/resolvconf/interface (actual location on current Debian and Ubuntu) /etc/resolvconf/run/interface (old location, still existing via a symbolic link on Debian). Each piece is named after the interface that it is associated with. When they aren't static, the entries in ...


2

Target context type of the files is still wrong: svirt_sandbox_file_t The files in ~/.cert should be labeled as home_cert_t. Give it a try once more with restorecon -Rf ~/.cert or try to force the type: chcon -t home_cert_t ~/.cert/* It might be possible that there is some bug in selinux-policy or docker selinux policy that causes wrong default ...


2

Shorewall is a tool for configuring iptables/netfilter firewall rules, so the documentation for netfilter is a more effective place to look. It says: It is perfectly legal to specify an interface that currently does not exist; the rule will not match anything until the interface comes up. This is extremely useful for dial-up PPP links (usually interface ...


2

With very few exceptions, if somebody has your hardware in their hands, they can duplicate everything, simply by accessing and copying the whole storage. There's no extra encryption that would help. If you encrypt the disk, the disk encryption key has to be readable somewhere. Disk encryption is useless in your scenario. There is hardware that can't be ...


2

If there's a direct connection between your Raspberry Pi and the client, i.e. there's no routing and both are in the same segment, it's possible. Just use an ARP resolution, e.g. : arp <client_ip_address>.


2

Is your server a Linux host? If you have a white list of your clients, you can use iptables to accept requests only from them on specific input ports. You can also log requests from bad clients in dmesg. The following script defines MACCHECK chain to accept packets from approved 3 MACs, and drop others with logging. Then routes all packets of tcp/80 or ...


2

You need to add routing to your server so ssh packets get routed via the server's public ip not the vpn. Failing to do that means the ssh return packet gets routed via openvpn. This is why you get locked out of your server after you've inititated an openvpn client session. Lets assume your server's: Public IP is a.b.c.d Public IP Subnet is a.b.c.0/24 ...


2

The correct way to replace the default gateway is ip route del default via 192.168.144.1 ip route add default via x.y.w.z dev $DEV The reason why I did not include the values you would like to see (10.135.0.2 and tap0) in the previous command is that this is not the correct way to force all traffic thru the VPN. However, you cannot have a correct ...


2

As I have said before: I'm guessing I'm missing something new with how systemd controls the service. Yes, and it is explained in the commentary at the top of /lib/systemd/system/openvpn.service. You, as the other questioner did, are calling a System 5 rc script directly. Do not call System 5 rc scripts directly, especially on a system where System 5 ...


2

You would need policy routing to set up routing tables for each specific traffic. I've found a concise and good example in Linux Advanced Routing Mini HOWTO. Put the following line in /etc/iproute2/rt_tables: 1 DIRECT Then you can do like: iptables -t mangle -A PREROUTING -p tcp --dport 900:999 -j MARK --set-mark 1 ip route add default via <gateway ...


2

Do something like this server=$(cat /etc/openvpn/anonvpn.conf |grep remote|cut -d" " -f2) nextserver=$(grep -A1 $server /etc/openvpn/list.txt|grep -v $server) if [ -z "$nextserver" ]; then nextserver=$(head -n1 /etc/openvpn/list.txt) fi sed -i "s!$server!$nextserver!" /etc/openvpn/anonvpn.conf create the file /etc/openvpn/list.txt with your list of ...


2

From 'man openvpn': --ping-restart n Similar to --ping-exit, but trigger a SIGUSR1 restart after n seconds pass without reception of a ping or other packet from remote. This option is useful in cases where the remote peer has a dynamic IP address and a low-TTL DNS name is used to track the IP address using a service such as http://dyndns.org/ + a dynamic ...


2

You do not really bind eth0 and tun0 any more than you bind wlan0 and tun0. You actually allow the the packets to pass from one interface to another, by setting ip_forwarding=1, either permanently by changing /etc/sysctl.conf, or temporarily by echo-ing 1 into /proc/sys/kernel/net/ipv4/ip_forward. The only thing that is missing is the change of packet ...


2

What the issue is So what you want is for the network address transfer to work (NAT). I don't pretend to be an iptables expert, but I can see based on this part of your iptables-save: *nat :PREROUTING ACCEPT [1710:298954] :INPUT ACCEPT [1480:280336] :OUTPUT ACCEPT [28:4162] :POSTROUTING ACCEPT [86:6162] -A PREROUTING -i wlan0 -p tcp -m mark --mark 0x3e7 ...


1

You may want to enable forwarding: echo 1 >/proc/sys/net/ipv4/conf/all/forwarding Also, your tunneled IPs (here 10.0.0.0/8) are likely to be private, so do NAT/MASQUERADING: iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE


1

Systemd is an "init system" for Linux -- this is the first process started by the kernel when the system boots, and it is responsible for starting everything else. Your system already had an init process on it, so installing and using systemd isn't necessary to do what you want. The error you're seeing suggests that systemd isn't actually running, which ...


1

I don't believe that there's any specific command to do a syntax check, but you can run openvpn in the foreground, which should show the specific error: openvpn --config /path/to/server.conf


1

As openvpn needs root privileges to set routes or ip addresses for an interface it is very uncommon to run it as a user, if possible at all. But the command not found is a simple PATH topic. Check sudo which openvpn where root calls the binary. Normally openvpn lives in /usr/sbin, a location for daemon programs, that are started as root and possible ...


1

I solved problem with changing the network interfaces of pfsense from VIRTIO to E1000. It seems that some packages get lost with Proxmox's VIRTIO drivers.


1

You overwrite the one possible path to your real gateway: default via 10.89.0.153 dev tun0 proto static metric 50 which has higher priority than your real default route, and 192.168.1.0/24 via 10.89.0.153 dev tun0 proto static metric 50 which is useless and possibly harmful for your setup. Both these routes redefine 192.168.1.1 to go through tun0 ...


1

The state extension differentiates the following states for a connection: NEW, ESTABLISHED, RELATED, INVALID, plus three others which are rarely used. A packet is only NEW if, informally speaking, server and client haven't been communicating in any way. After that, a packet usually belongs to an ESTABLISHED connection or is RELATED to one. This means that ...


1

I don't understand the second default gateway, this is the default when the vpn is not active, is it simply bypassed? This is one of OpenVPN's hacks to route traffic through your tunnel while maintaining your default gateway. The 0.0.0.0/1 and 128.0.0.0/1 routes take precedence over the 0.0.0.0/0 route and still match all addresses. Search for "def1" ...


1

You cannot specifically target an application so the only solution with no dependencies is to create a iptables configuration that directs all the ports to your VPN. But you have to know what to forward and that is error prone. A better solution would be to use Linux Containers and run your app inside. Then have the container's network card forward all ...



Only top voted, non community-wiki answers of a minimum length are eligible