Hot answers tagged

44 votes

How to refuse routes that are PUSHed by OpenVPN server?

Times have moved on, and as of 2017 (OpenVPN 2.4) this is possible with pull-filter accept "route 192.168." pull-filter ignore "route 172." pull-filter accept "route 1" pull-filter ignore "route " ...
user avatar
  • 1,495
36 votes
Accepted

Configuring OpenVPN to use Firewalld instead of iptables on Centos 7

Use the firewall-cmd command. Assuming you're opening the firewall up to OpenVPN on the default zone, carry out the following commands. If you are running it on a non-default zone, then add --zone=&...
user avatar
  • 31.8k
24 votes

Failed to request VPN secrets #3

In my case (In Debian 9 by Gnome 3.2) selecting the password option "Store the password for all users" in the VPN settings got it working. All other options produce the mentioned error.
user avatar
  • 666
22 votes

ssh into a server which is connected to a VPN service

You get locked out of your VPS because once the VPN service is up, your ssh packets get routed via the VPN not your VPS's public IP 50.2.1.3. Lets assume your server's: Public IP is 50.1.2.3 (as per ...
user avatar
  • 496
20 votes
Accepted

Changing OpenVPN device name

Yes, you can use the dev option to specify which device you want to use. You'll also have to add dev-type to specify tun or tap: dev ovpn-tcp dev-type tun Will use a tun device named ovpn-tcp, ...
user avatar
  • 102k
20 votes
Accepted

iptables forward traffic to vpn tunnel if open

You will need both sets of rules within iptables. The two rulesets ensure that traffic leaving by the specified interfaces is appropriately masqueraded. Here is my suggestion, which is a little ...
user avatar
  • 90.4k
19 votes
Accepted

Use service or systemctl to control openvpn daemon on boot?

OpenVPN is not the best place to start if one is learning systemd, because OpenVPN is not a simple service. OpenVPN is a templatized service under systemd. The service units are named openvpn@config....
user avatar
  • 62.4k
19 votes

Open VPN options error: --tls-auth fails with 'ta.key': no such file or directory

To generate the tls-auth key: openvpn --genkey --secret /etc/openvpn/ta.key
user avatar
  • 2,197
17 votes

OpenVPN - Understand the routing table + How to route only the traffic to a specific ip via the VPN

I don't understand the second default gateway, this is the default when the vpn is not active, is it simply bypassed? This is one of OpenVPN's hacks to route traffic through your tunnel while ...
user avatar
17 votes
Accepted

Ubuntu Server 16.04 - OpenVPN seems not to start, no logs get written

The problem is that service config /lib/systemd/system/openvpn.service just calls /bin/true (I have no idea on why it wasn't just removed). Usable configuration might be found in /lib/systemd/system/...
user avatar
  • 286
17 votes
Accepted

How to use --auth-nocache with correct TUN/TAP in openvpn?

You're storing your authentication data in a file. The fact that OpenVPN is additional storing it in RAM is then something you shouldn't care about. It's there for environments where you type the ...
user avatar
  • 102k
16 votes
Accepted

Route everything through VPN except SSH on Port 22

You need to add routing to your server so ssh packets get routed via the server's public ip not the vpn. Failing to do that means the ssh return packet gets routed via openvpn. This is why you get ...
user avatar
  • 496
16 votes
Accepted

Where does GNOME Network Manager store passwords?

Go to the /etc/NetworkManager/system-connections/ directory, here all the connection details are saved. And use the cat command or any text editor as root to view the saved passwords. There should be ...
user avatar
  • 1,451
15 votes

openvpn[]: Options error: In [CMD-LINE]:1: Error opening configuration file

You might want to run fixfiles -R openvpn restore An ls -alZ should give you something like this (showing your files are in the correct selinux context now): [root@server openvpn]# ls -alZ /etc/...
user avatar
15 votes

Import VPN config files to NetworkManager from command line

I'm using nmcli version 1.2.6 and I can use it to import openvpn configs. nmcli connection import type openvpn file ~/myconfig.ovpn From now on even in NetworkManager UI my vpn is visible. To ...
user avatar
  • 263
15 votes

port forwarding to application in network namespace with vpn

Interconnecting network namespace with main namespace always bothers me. The reason I usually create a namespace is because I want it isolated. Depending on what it is you are trying to achieve with ...
user avatar
  • 597
15 votes

How to allow SSH into Terminal after connecting to VPN server using NordVPN servers through OpenVPN?

When using the NordVPN Linux client, iptables are used to change traffic instead of modifying the routes. To allow SSH to go through, you need to whitelist the SSH port. nordvpn whitelist add port 22
user avatar
14 votes
Accepted

How to check server.conf error for OpenVPN

I don't believe that there's any specific command to do a syntax check, but you can run openvpn in the foreground, which should show the specific error: openvpn --config /path/to/server.conf
user avatar
  • 114k
14 votes

How to make OpenVPN to listen both TCP and UDP ports

The same openvpn process can't listen on UDP and TCP sockets at the same time. You have two good options: use two tap interfaces for openvpn. Have two openvpn server processes, one for each tap ...
user avatar
13 votes
Accepted

Using OpenVPN with systemd

I think the Debian OpenVPN setup with systemd is currently a tad bit broken. To get it to work on my machines I had to: Create /etc/systemd/system/openvpn@.service.d (the directory), and place in it ...
user avatar
  • 102k
13 votes
Accepted

Purpose of IP addresses on tun interface?

Historically in IPv4, unnumbered interfaces were not possible. The only possible way to configured a point-to-point interface was with a local address and a remote address. The only way to route some ...
user avatar
  • 41.1k
12 votes
Accepted

Routing public ipv6 traffic through openvpn tunnel

You need to tell your router to use your server for this VPN subnet: the correct solution to your problem is to add a route on the router for the OpenVPN subnet. If you can't do this because you can'...
user avatar
  • 1,668
11 votes

Feed all traffic through OpenVPN for a specific network namespace only

You can start the OpenVPN link inside a namespace and then run every command you want to use that OpenVPN link inside the namespace. Details on how to do it are presented in Running an OpenVPN tunnel ...
user avatar
11 votes
Accepted

port forwarding to application in network namespace with vpn

I've always had issues with iptables redirections (probably my fault, I'm pretty sure it's doable). But for a case like yours, it's IMO easier to do it in user-land without iptables. Basically, you ...
user avatar
  • 226
10 votes
Accepted

Settings when using a bridge

You shouldn't need to set the ip_forward = 1 unless the interface is acting as a NAT for the other devices, which shouldn't be the case if you've set them up as a bridge. Example Here's my KVM ...
user avatar
  • 346k
10 votes
Accepted

Debian 8 Jessie with OpenVPN client

As I have said before: I'm guessing I'm missing something new with how systemd controls the service. Yes, and it is explained in the commentary at the top of /lib/systemd/system/openvpn.service. ...
user avatar
  • 62.4k
10 votes

Starting openvpn client as daemon - in debian

Use the Debian-supplied mechanism Don't roll your own service units. Debian comes with a mechanism for scanning your OpenVPN configuration and making systemd services to match it. Use that. Make a ...
user avatar
  • 62.4k
9 votes

Using OpenVPN with systemd

This type of unit file is an Instantiated Service - more details are available here The following is the unit file for openvpn on CentOS 7: [Unit] Description=OpenVPN Robust And Highly Flexible ...
user avatar
  • 31.8k
9 votes
Accepted

Feed all traffic through OpenVPN for a specific network namespace only

It turns out that you can put a tunnel interface into a network namespace. My entire problem was down to a mistake in bringing up the interface: ip addr add dev $tun_tundv \ local $...
user avatar
  • 6,849

Only top scored, non community-wiki answers of a minimum length are eligible