Tag Info

Hot answers tagged

7

Use the firewall-cmd command. Assuming you're opening the firewall up to OpenVPN on the default zone, carry out the following commands. If you are running it on a non-default zone, then add --zone=<zone> to the commands. First, list what's currently open: # firewall-cmd --list-services http https ssh Next, add the openvpn service: # firewall-cmd ...


4

Historically in IPv4, unnumbered interfaces were not possible. The only possible way to configured a point-to-point interface was with a local address and a remote address. The only way to route some other IP address through the point-to-point interface in question was to install a route using the interface's remote address as the gateway (there was no ...


3

You might want to run fixfiles -R openvpn restore An ls -alZ should give you something like this (showing your files are in the correct selinux context now): [root@server openvpn]# ls -alZ /etc/openvpn/ drwxr-xr-x. root root system_u:object_r:openvpn_etc_t:s0 . drwxr-xr-x. root root system_u:object_r:etc_t:s0 .. drwxr-xr-x. root root ...


3

You should use the same CA and make sure it's secured (as anyone compromising it would be able to issue certificates for it and perform a MITM attack). You might consider putting a machine offline and using it for this purpose only. As long as it's for internal use only, a self-signed cert will work fine. Remember that you'll have to install the CA root ...


3

You can check the MAC of the client only if the client is on the same network segment, i.e. if there's no router in between (a switch is ok). You can see that with traceroute: if you run traceroute 192.0.2.1 from the server where 192.0.2.1 is the address of one of the devices, it must report only a single hop, the destination. Nasha's and yaegashi's answers ...


2

I think the Debian OpenVPN setup with systemd is currently a tad bit broken. To get it to work on my machines I had to: Create /etc/systemd/system/openvpn@.service.d (the directory), and place in it a new file with this:[Unit] Requires=networking.service After=networking.serviceI called my file local-after-ifup.conf. It needs to end with .conf. (This is ...


2

SELinux is disallowing the openvpn executable from accessing files on the filesystem in a specific location. Your best friend for dealing with these is to use the SELinux troubleshooter GUI. $ sealert -b     You'll then want to follow the advice to add the necessary contexts to your filesystem to appease SELinux.      ...


2

You could modify the zone and add a Rich Rule which blocks all ssh traffic other than from a certain range - the Employee subnet. Find which zone your tun interface is in by listing all zones: firewall-cmd --list-all-zones | less In the output you should see something similar to: internal (active) interfaces: tun0 sources: services: dhcpv6-client ...


2

You can use the resolv.conf.head and resolv.conf.tail files to add lines before and after the content generated by resolvconf


2

For the message "Address already in use", I think it's because https listen also on TCP port 443.


2

I try to start it via normal service call:# service openvpn start work No, that's not normal. That's a quirk of System 5 rc toolsets that invokes a System 5 rc script with two arguments. The rc script takes the non-standard second argument as the basename of the OpenVPN configuration to use. This is Ubuntu Linux. You aren't using System 5 rc. You ...


2

If there's a direct connection between your Raspberry Pi and the client, i.e. there's no routing and both are in the same segment, it's possible. Just use an ARP resolution, e.g. : arp <client_ip_address>.


2

Is your server a Linux host? If you have a white list of your clients, you can use iptables to accept requests only from them on specific input ports. You can also log requests from bad clients in dmesg. The following script defines MACCHECK chain to accept packets from approved 3 MACs, and drop others with logging. Then routes all packets of tcp/80 or ...


2

With very few exceptions, if somebody has your hardware in their hands, they can duplicate everything, simply by accessing and copying the whole storage. There's no extra encryption that would help. If you encrypt the disk, the disk encryption key has to be readable somewhere. Disk encryption is useless in your scenario. There is hardware that can't be ...


1

You haven't added your tun0 device to any zone, so it defaults to the default zone, which in your case is the public zone. As root, run: firewall-cmd --zone=internal --add-interface=tun0 You can then leave ssh and https enabled in the internal zone and disable it in the public zone.


1

Gateway of your server (in the 192.168.1.0 network) most likely doesn't know about the existence of the 10.8.0.0 network. Either add a route in the router so it redirects those packets to your server or use NAT on the server for packets coming from the tun interface.


1

This type of unit file is an Instantiated Service - more details are available here The following is the unit file for openvpn on CentOS 7: [Unit] Description=OpenVPN Robust And Highly Flexible Tunneling Application On %I After=syslog.target network.target [Service] PrivateTmp=true Type=forking PIDFile=/var/run/openvpn/%i.pid ExecStart=/usr/sbin/openvpn ...


1

I turned out that I needed to update a second OpenVPN config file to look for auth.dat. Now it works.


1

I've found the problem: my key sizes were way too large. I am now using 2048 bit successfully. Obviously 8192 bits is a bit too much for openvpn


1

I recommend you go though OpenVPN HOWTO, it will get you started in no time, except installing. For install on CentOS I'll do: install EPEL repo with yum install epel-release install openvpn server with yum install openvpn


1

OpenVPN is an ordinary Unix daemon, you can run it just fine from the command line. Extra Packages for Enterprise Linux (EPEL) contains an OpenVPN package you can install. You'll then have to write (or copy over) a config file, certificates, etc.


1

i use the following iptables-rules for forwarding traffic from my ovpn server IPT=$(which iptables) WWW="eth0" ${IPT} -A INPUT -i ${WWW} -p udp --dport 1194 -m state --state NEW -j ACCEPT ${IPT} -A INPUT -i tun0 -j ACCEPT ${IPT} -A FORWARD -i tun0 -o ${WWW} -j ACCEPT ${IPT} -A FORWARD -i ${WWW} -o tun0 -j ACCEPT


1

On your server, net.ipv4.ip_forward=1 isn't enough, it only enables the forwarding code. You still have to tell the kernel (via iptables) what it's allowed to forward, from who, and to where. You should read the Linux IP Masquerade HOWTO. That's if you want to redirect all network traffic through your VPN connection (which is sometimes wanted for security ...


1

Run app1 on the default https port (443) and run app2 on another port (444 - Unless you're using SNPP in which case you'll need to choose another free port). Clone the https.xml file (located in /usr/lib/firewalld/services) to /etc/firewalld/services and rename it to (for example) https-app2.xml. Edit this new file and change the port to 444. Ensure that ...


1

This is a very broad question. I'll try to address a few of these. As installed, logrotate is called daily via a cron type of situation. In Centos 7, you can find the invokation of logrotate under /etc/cron.daily which is invoked via the daily entry (0daily) in a /etc/cron.d file. Of course, you can make changes to run this every hour or make further ...


1

Try starting the client with the --daemon option: openvpn --daemon From openvpn's man page: --daemon [progname] Become a daemon after all initialization functions are completed To interact with openvpn once it is a daemon, add the --management option to the command. This allows you to interact with it using telnet as described here. Alternatively, ...


1

Set your client to have a route parameter to only your home LAN. For example if your home LAN was 192.168.2.0, the the parameter would look like this in the .conf file: route 192.168.2.0 255.255.255.0 and dont push any routes from the server onto the client. This way when the tunnel comes up all you will route through it is the network you put in the ...


1

The first error is clear; the line you've commented out gives the permission that audit says is missing. The second part is more interesting, but what I suspect is the problem is the target context of the socket you're modifying (owned by unconfined_u). Because you've moved to static device nodes, your interfaces are no longer created by the openvpn process ...


1

I'm not 100% sure about whether or not storing the username/password combination in a variable will work - it definitely won't if your sudo configuration requires a password, but at the least you can implement a loop similar to what's below. If storing the username/password in the variable does work, you won't need to write a file with your credentials at ...


1

Nope, it's not enough to ACCEPT traffic on tun interface. You will also need to open 1194/udp port in INPUT chain. -A INPUT -i wlp3s0 -j ACCEPT -m udp -p udp --dport 1194 -m state --state NEW -j ACCEPT You should also setup a default policy for INPUT chain to DROP. Now you allow all incoming connections! *filter :INPUT DROP [323:24107] HTH



Only top voted, non community-wiki answers of a minimum length are eligible