Hot answers tagged

4

I've always had issues with iptables redirections (probably my fault, I'm pretty sure it's doable). But for a case like yours, it's IMO easier to do it in user-land without iptables. Basically, you need to have a daemon in your "default" workspace listening on TCP port 8112 and redirecting all traffic to 10.200.200.2 port 8112. So it's a simple TCP proxy. ...


4

You must check the routing table. With the route command, you can see how you traffic is routed, if there is a line like default 123.456.78.x is likely that your traffic is redirected on the VPN, however if your public ip is your isp it is very likely that the VPN rotate only traffic headed to work. These lines indicate that the traffic with a destination ...


3

/etc/resolv.conf is built from pieces that are in the directory /run/resolvconf/interface (actual location on current Debian and Ubuntu) /etc/resolvconf/run/interface (old location, still existing via a symbolic link on Debian). Each piece is named after the interface that it is associated with. When they aren't static, the entries in /etc/resolvconf/run/...


3

Using the configuration file with a GUI If you look at the proxpn script, you will see that the command issued is: openvpn --config $OPENVPN_CONF \ --remote $remote $PORT \ --auth-nocache \ --auth-user-pass $AUTH_CREDS If you want to feed the OpenVPN config file to some other tool (like a GUI or a mobile client), you might need to add those extra ...


3

Allow first your local connection and your RELATED, ESTABLISHED connections protocols. $ sudo iptables -A INPUT -p tcp -s 127.0.0.1 -j ACCEPT $ sudo iptables -A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT $ sudo iptables -A INPUT -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT $ sudo iptables -A INPUT -p icmp -m state --state RELATED,...


3

From OpenVPN's man page: --server network netmask ['nopool'] A helper directive designed to simplify the configuration of OpenVPN's server mode. This directive will set up an OpenVPN server which will allocate addresses to clients out of the given network/netmask. The server itself will take the ".1" ...


2

From 'man openvpn': --ping-restart n Similar to --ping-exit, but trigger a SIGUSR1 restart after n seconds pass without reception of a ping or other packet from remote. This option is useful in cases where the remote peer has a dynamic IP address and a low-TTL DNS name is used to track the IP address using a service such as http://dyndns.org/ + a dynamic ...


2

Systemd is an "init system" for Linux -- this is the first process started by the kernel when the system boots, and it is responsible for starting everything else. Your system already had an init process on it, so installing and using systemd isn't necessary to do what you want. The error you're seeing suggests that systemd isn't actually running, which ...


2

You need to add routing to your server so ssh packets get routed via the server's public ip not the vpn. Failing to do that means the ssh return packet gets routed via openvpn. This is why you get locked out of your server after you've inititated an openvpn client session. Lets assume your server's: Public IP is a.b.c.d Public IP Subnet is a.b.c.0/24 ...


2

A workaround I use to get past the lack of functionality that comes with nmcli on debian-based systems is to use commands to copy an existing VPN config file in the /etc/NetworkManager/system-settings folder to a new file (as root, of course) in the same folder and make string replacements to the permitted user, gateway, username and password values in the ...


2

What the issue is So what you want is for the network address transfer to work (NAT). I don't pretend to be an iptables expert, but I can see based on this part of your iptables-save: *nat :PREROUTING ACCEPT [1710:298954] :INPUT ACCEPT [1480:280336] :OUTPUT ACCEPT [28:4162] :POSTROUTING ACCEPT [86:6162] -A PREROUTING -i wlan0 -p tcp -m mark --mark 0x3e7 -...


2

You do not really bind eth0 and tun0 any more than you bind wlan0 and tun0. You actually allow the the packets to pass from one interface to another, by setting ip_forwarding=1, either permanently by changing /etc/sysctl.conf, or temporarily by echo-ing 1 into /proc/sys/kernel/net/ipv4/ip_forward. The only thing that is missing is the change of packet ...


2

The correct way to replace the default gateway is ip route del default via 192.168.144.1 ip route add default via x.y.w.z dev $DEV The reason why I did not include the values you would like to see (10.135.0.2 and tap0) in the previous command is that this is not the correct way to force all traffic thru the VPN. However, you cannot have a correct ...


2

Target context type of the files is still wrong: svirt_sandbox_file_t The files in ~/.cert should be labeled as home_cert_t. Give it a try once more with restorecon -Rf ~/.cert or try to force the type: chcon -t home_cert_t ~/.cert/* It might be possible that there is some bug in selinux-policy or docker selinux policy that causes wrong default ...


2

Shorewall is a tool for configuring iptables/netfilter firewall rules, so the documentation for netfilter is a more effective place to look. It says: It is perfectly legal to specify an interface that currently does not exist; the rule will not match anything until the interface comes up. This is extremely useful for dial-up PPP links (usually interface ...


2

You will need both sets of rules within iptables. The two rulesets ensure that traffic leaving by the specified interfaces is appropriately masqueraded. Here is my suggestion, which is a little simpler than yours: # Masquerade outgoing traffic iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE # Allow ...


2

Your rules don't make sense for the scenario you've described. I'll accept that the CONNTRACK chain handles the VPN inbound packets, so your VPN will work. However, if you want VoIP to run over the VPN then you don't need any rules at all on red0 that handle SIP traffic. It looks like you want to accepting unregistered SIP calls in to your public IP ...


1

UPDATE: For openvpn-as: The openvpn-as port is logged in the file /usr/local/openvpn_as/init.log You can find the port for example using grep: grep -rE "([0-9]{1,3}\.?){4}:[0-9]+/" /usr/local/openvpn_as The configuration of openvpn-as is handled by a script: /usr/local/openvpn_as/bin/ovpn-init For openvpn: The openvpn server port is defined using the ...


1

I read the instructions on: https://openvpn.net/index.php/open-source/documentation/howto.html#scope And I've added route 192.168.1.0 255.255.255.0 to the server.conf on my VPS and also iroute 192.168.1.0 255.255.255.0 to the correspondig ccd file for the client. And then I used the command route add -net 192.168.1.0 netmask 255.255.255.0 gw 10.8.0.6 and ...


1

I've managed to redirect the traffic on my Raspi with the following command: iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o tun0 -j MASQUERADE When I traceroute out of my NAS it goes through the tunnel. Now I only need to forward ports in this tunnel. UPDATE (solving the whole project): I finally found the correct port forwarding commands after ...


1

This applies to a routed network, not bridged (otherwise just configure the DHCP server). You should use the client-config-dir option on the server. You have to supply a directory that has a per-client configuration file. The name of the file should be the same as the name of the certificate (ie. the name of the certificate supplied to easy-rsa). Then you ...


1

The same openvpn process can't listen on UDP and TCP sockets at the same time. You have two good options: use two tap interfaces for openvpn. Have two openvpn server processes, one for each tap interface; one should listen on UDP, the other on TCP. Bridge these two tap interfaces on the server. use two tun interfaces. These can't be bridged, so if you ...


1

The Deluge User Guide has a page about that : Setting up Deluge with VPN. Scripts for a basic torrent-VPN setup can be found on this GitHub repo. The README.md file even has a little something about OpenVPN : To use these scripts with OpenVPN, make a clone of the repo and set the correct values for the interfaces and user in vpn_base.sh. Edit the openvpn ...


1

You cannot specifically target an application so the only solution with no dependencies is to create a iptables configuration that directs all the ports to your VPN. But you have to know what to forward and that is error prone. A better solution would be to use Linux Containers and run your app inside. Then have the container's network card forward all ...


1

I don't understand the second default gateway, this is the default when the vpn is not active, is it simply bypassed? This is one of OpenVPN's hacks to route traffic through your tunnel while maintaining your default gateway. The 0.0.0.0/1 and 128.0.0.0/1 routes take precedence over the 0.0.0.0/0 route and still match all addresses. Search for "def1" in ...


1

I solved problem with changing the network interfaces of pfsense from VIRTIO to E1000. It seems that some packages get lost with Proxmox's VIRTIO drivers.


1

The state extension differentiates the following states for a connection: NEW, ESTABLISHED, RELATED, INVALID, plus three others which are rarely used. A packet is only NEW if, informally speaking, server and client haven't been communicating in any way. After that, a packet usually belongs to an ESTABLISHED connection or is RELATED to one. This means that ...


1

You overwrite the one possible path to your real gateway: default via 10.89.0.153 dev tun0 proto static metric 50 which has higher priority than your real default route, and 192.168.1.0/24 via 10.89.0.153 dev tun0 proto static metric 50 which is useless and possibly harmful for your setup. Both these routes redefine 192.168.1.1 to go through tun0 ...


1

You get locked out of your vps because once the vpn service is up, your ssh packets get routed via the vpn not your vps's public IP 50.2.1.3. Lets assume your server's: Public IP is 50.1.2.3 (as per your example setup) Public IP Subnet is 50.1.2.0/24 Default Gateway is x.x.x.1 eth0 is device to gateway Do the following using iproute2: ip rule add table ...


1

You may want to enable forwarding: echo 1 >/proc/sys/net/ipv4/conf/all/forwarding Also, your tunneled IPs (here 10.0.0.0/8) are likely to be private, so do NAT/MASQUERADING: iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -o eth0 -j MASQUERADE



Only top voted, non community-wiki answers of a minimum length are eligible