New answers tagged openvpn
As I have said before: I'm guessing I'm missing something new with how systemd controls the service. Yes, and it is explained in the commentary at the top of /lib/systemd/system/openvpn.service. You, as the other questioner did, are calling a System 5 rc script directly. Do not call System 5 rc scripts directly, especially on a system where System 5 ...
The thread detailing this error can be found here. You can see RMerlin (the author) himself addressing this. RMerlin gives a solution to fix this problem In the meantime as I said, simply generate a new DH, and paste it on the DH field of your router to replace it. The OpenSSL version you use does not matter, you don't need the newer version to do this. ...
Let the server decide over the client machines place in the network. Check --client-config-dir in the manual openvpn(1). The configuration is selected by the CN Field of the client certificate. Tuning iptables can be done in some --up, --down, --ipchange, --iproute command, that is configured in your client configuration. So basically your script has to ...
Oh finally, I had a NULL feedback, cause of sudo only for terminal (tty). deactivted it for my user. It works a charm now. $ visudo #in sudoers : Defaults:myusername !requiretty
There are ways to start a script every time a particular interface goes online. Where they are depend on your distribution (please specify). There is also an easier option (which may or may not work), the "Use VPN..." option in the NetworkManager (Edit Connections menu). Are you using this last option and it does not work? Depending on what you use to ...
This file usually contain the certification authority root keys and it is required for check validity of certificate (of client and server). It is used to check the entire chain of certificates
Generate ca.crt on th server side. And yes, you have to copy it by the client side.
CA is an authority. No more, no less. This is not absolutely linked to server. CA is - to a certain extent - the very big boss. CA (is above)> server(s) > client(s). In addition, if your clients can connect 2 servers, no exclusions and so on, use a only one CA. That's perfectly normal.
With very few exceptions, if somebody has your hardware in their hands, they can duplicate everything, simply by accessing and copying the whole storage. There's no extra encryption that would help. If you encrypt the disk, the disk encryption key has to be readable somewhere. Disk encryption is useless in your scenario. There is hardware that can't be ...
When generating keys, you can set the expiration date for those keys. Assuming it's possible for legitimate users to update the client keys on their devices, you could set the keys to expire after a relatively short time. That would limit the time of potential exposure if a device is stolen.
You can check the MAC of the client only if the client is on the same network segment, i.e. if there's no router in between (a switch is ok). You can see that with traceroute: if you run traceroute 192.0.2.1 from the server where 192.0.2.1 is the address of one of the devices, it must report only a single hop, the destination. Nasha's and yaegashi's answers ...
Is your server a Linux host? If you have a white list of your clients, you can use iptables to accept requests only from them on specific input ports. You can also log requests from bad clients in dmesg. The following script defines MACCHECK chain to accept packets from approved 3 MACs, and drop others with logging. Then routes all packets of tcp/80 or ...
If there's a direct connection between your Raspberry Pi and the client, i.e. there's no routing and both are in the same segment, it's possible. Just use an ARP resolution, e.g. : arp <client_ip_address>.
This [most probably] is a routing issue. Your Samba server, as far as the remote part is concerned, is accessed from 192.168.20.0/100 so here are two possibilities: either route 192.168.20.0/100 traffic through the OpenVPN interface on the server — it does require a change in smb.conf to allow access from 192.168.20.0/100 though; or you can just NAT ...
Top 50 recent answers are included