Tag Info

New answers tagged

0

As for the server configuration, OpenVPN server should issue smth like push dhcp-option DNS XXX.XXX.XXX.XXX push dhcp-option DOMAIN mylocaldomain.local (see more details here). XXX.XXX.XXX.XXX is your DNS-server, mylocaldomain.local is your local domain. Can be easily found in OpenVPN client output (dhcp-option DNS ...,dhcp-option DOMAIN ...) when you ...


0

You can use iptables + ip-route together to achieve this. The idea is, iptables "mangles" a specified packet by "marking it", and then later, the ip route rules can direct such marked packets to a different gateway, ie, interface. I found a concise and simple example for you: http://lartc.org/howto/lartc.netfilter.html The example is that you have two ...


1

By default, OpenVPN does not reconfigure the DNS on non-Windows. You could use a hook (sorry the explanations are in French) in order to do this: #!/bin/sh # Write foreign options to stdout: foreign_options() { local i while true; do local varname=foreign_option_$i local value="$(eval echo \$$varname)" if [ -z "$value" ]; then ...


-1

You should try to configure your proxychains Edit /etc/proxychains.conf: change it to dynamic, and add socks5 127.0.0.1 9050 after socks4. use in a terminal: ~$ proxychains iceweasel www.dnsleaktest.com


3

You should use the same CA and make sure it's secured (as anyone compromising it would be able to issue certificates for it and perform a MITM attack). You might consider putting a machine offline and using it for this purpose only. As long as it's for internal use only, a self-signed cert will work fine. Remember that you'll have to install the CA root ...


0

Your question scares me. Generally speaking you don't create a CA for VPN services. You request a CA sign a CSR (Certificate Signing Request) in order to perform a repudiation for the TLS protocol which your trying to implement. I believe what your really asking is about a x.509 certificate, or specifically 'Should I create a separate x.509 certificate for ...


0

Yes you can. And no you should not (unless operating on a non-public net, which seems very very unlikely due to OpenVPN being a public access method to private subnet(s)). The reasons why correspond to the TLS protocols certificate validation process and the trust worthiness of the connections when It is self signed and not signed by a reputable ...


1

I understand the routing table is a "fall through" table Not really. The routing table is ordered from "most specific route" to "least specific route". Your default route is via br0, and is defined as the route of last resort because there is no netmask (i.e. genmask is 0.0.0.0). because the 1st entry is 0.0.0.0 all traffic will go through the tun1 ...


0

I think you can use route command instead of iptables: route 111.112.113.114 gw 10.182.1.5 Or you can also push the route from openvpn server's side.


0

I'm no expert, but from reading the man page below your quote: --dhcp-option type [parm] ... Note that if --dhcp-option is pushed via --push to a non-windows client, the option will be saved in the client's environment before the up script is called, under the name "foreign_option_{n}". and under foreign_option_{n}: ...


0

As I understand it, OpenVPN is a TLSv1 SSL Tunnel designed to create secure point to point connections, so if you didnt want authentication or encryption you would simply connect to the machines' public IP. I have setup OpenVPN several times and when testing we use no authentication and self-signed SSL certificates. This is by far the easiest way to setup ...


1

OpenVPN doesn't document the exact algorithm it uses to find free addresses in the pool because it's an implementation detail and it doesn't really matter as long as it's a free address. Nevertheless, you can see what algorithm it uses by looking at the function ifconfig_pool_find in pool.c: If in duplicate_cn mode, take the first free address. If the IP ...


0

It seems the virtual interface will not be RUNNING until a software is attached to it. As soon as my program (the simpletun.c example) attached to the interface, every thing became OK.


1

This is a known bug with NetworkManager, and it's been open since October 2010: https://bugzilla.gnome.org/show_bug.cgi?id=633337 It does not seem likely that NetworkManager will be able to import .ovpn files any time soon. Given this, you have two alternatives: Use the following command instead: sudo openvpn --config client.ovpn. This works for me in ...


1

Hardware network links can be either point to point or point to multipoint. ppp links are point to point, ethernet is point to multipoint. tun can act as either, in your case it is acting as a point to point link. a point to multipoint interface has four addresses associated with it, specifically ip address (the address of the interface), network address, ...


0

On a fresh Jessie_8.0.0 installation I did: copy the old /etc/openvpn/cluster.conf (plus *.key and *.crt) files from wheezy uncommented AUTOSTART="all" in /etc/default/openvpn - I think this had no effect /lib/systemd/system-generators/openvpn-generator cluster systemctl restart openvpn@cluster.service Now the tunnel is up - I will see what will happen ...


4

Historically in IPv4, unnumbered interfaces were not possible. The only possible way to configured a point-to-point interface was with a local address and a remote address. The only way to route some other IP address through the point-to-point interface in question was to install a route using the interface's remote address as the gateway (there was no ...


1

Encryption prevents your data from being read. But someone could still modify them; they won't know exactly what changes they're making (due to the encryption), but depending on what you're running over the link, that could be quite catastrophic to the application. Note that traffic analysis (looking at the size and timing of packets) can often give an ...



Top 50 recent answers are included