Tag Info

New answers tagged

1

You haven't added your tun0 device to any zone, so it defaults to the default zone, which in your case is the public zone. As root, run: firewall-cmd --zone=internal --add-interface=tun0 You can then leave ssh and https enabled in the internal zone and disable it in the public zone.


2

You could modify the zone and add a Rich Rule which blocks all ssh traffic other than from a certain range - the Employee subnet. Find which zone your tun interface is in by listing all zones: firewall-cmd --list-all-zones | less In the output you should see something similar to: internal (active) interfaces: tun0 sources: services: dhcpv6-client ...


0

Did you try following https://openvz.org/VPN_via_the_TUN/TAP_device ? Meanwhile I'd close this question, cause it clearly shows lack of efforts to resolve the problem before asking question.


1

The first error is clear; the line you've commented out gives the permission that audit says is missing. The second part is more interesting, but what I suspect is the problem is the target context of the socket you're modifying (owned by unconfined_u). Because you've moved to static device nodes, your interfaces are no longer created by the openvpn process ...


1

Try starting the client with the --daemon option: openvpn --daemon From openvpn's man page: --daemon [progname] Become a daemon after all initialization functions are completed To interact with openvpn once it is a daemon, add the --management option to the command. This allows you to interact with it using telnet as described here. Alternatively, ...


0

I don't SELinux, so can't assist with that. However, if your issue is keeping OpenVPN running, you may consider code like this: while sleep 5; do /command/to/start/OpenVPN done This assumes OpenVPN is running in the foreground. You may need to change your OpenVPN command line options to get it to stick in the foreground. This script sleeps five ...


0

You can run scripts from openvpn with e.g. the --up scriptname option. This would seem to me to be better than expecting the connection to be established a certain time after starting the openvpn process. You may have to experiment a bit with the possible ways of running scripts from openvpn, e.g. not using --up but instead using --client-connect etc.; ...


0

I think the best you can do right now is to set up OpenVPN properly to inform it that there is second server, like this: Implementing a load-balancing/failover configuration Client The OpenVPN client configuration can refer to multiple servers for load balancing and failover. For example: remote server1.mydomain remote server2.mydomain remote ...


0

OpenVPN allows IP routing which doesn't care about users. So there is no need to have two tunnels between the same systems.


1

Set your client to have a route parameter to only your home LAN. For example if your home LAN was 192.168.2.0, the the parameter would look like this in the .conf file: route 192.168.2.0 255.255.255.0 and dont push any routes from the server onto the client. This way when the tunnel comes up all you will route through it is the network you put in the ...


1

I'm not 100% sure about whether or not storing the username/password combination in a variable will work - it definitely won't if your sudo configuration requires a password, but at the least you can implement a loop similar to what's below. If storing the username/password in the variable does work, you won't need to write a file with your credentials at ...


0

For some reason your client is unable to delete the current default route when the tunnel opens, thereby causing two default routes to exist in the routing table. What you are going to have to do is give the current route a lower metric (higher number) before the tunnel comes up. You can see the metric with the route -n command: # route -n Kernel IP ...


0

Assuming your VPS Server Public IP is 1.2.3.4 and your VPN Public IP is 5.6.7.8 I would edit file /etc/ssh/sshd_config and add a line: ListenAddress 1.2.3.4 So SSHd would be accessible from outside the VPN connection.



Top 50 recent answers are included